Malware Analysis Report

2025-03-15 05:54

Sample ID 240628-ddvl6sxelc
Target 188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118
SHA256 e24a5b91a3375c8fe393aa28e1c5e348799528592b2524173217cdd440e474f9
Tags
vmprotect
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

e24a5b91a3375c8fe393aa28e1c5e348799528592b2524173217cdd440e474f9

Threat Level: Shows suspicious behavior

The file 188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

vmprotect

VMProtect packed file

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Unsigned PE

Program crash

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-28 02:54

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-28 02:54

Reported

2024-06-28 02:56

Platform

win7-20240611-en

Max time kernel

121s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe"

Signatures

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2752 set thread context of 3044 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2752 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 2752 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 2752 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 2752 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 2752 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 2752 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 2752 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 2752 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 2752 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 2752 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.26345.com udp
HK 45.194.21.45:80 www.26345.com tcp
HK 45.194.21.45:80 www.26345.com tcp

Files

memory/2752-1-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2752-0-0x0000000000400000-0x0000000000631000-memory.dmp

memory/2752-2-0x0000000000400000-0x0000000000631000-memory.dmp

memory/3044-23-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/3044-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/3044-29-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/3044-28-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/3044-8-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/3044-6-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/3044-20-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/3044-13-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/3044-31-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/3044-36-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/3044-48-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/3044-45-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/3044-49-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/3044-44-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/3044-46-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/3044-43-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/2752-50-0x0000000000400000-0x0000000000631000-memory.dmp

memory/2752-51-0x0000000000220000-0x0000000000221000-memory.dmp

memory/3044-52-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/3044-53-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/3044-54-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/3044-57-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/3044-56-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/3044-55-0x0000000000400000-0x00000000005B0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-28 02:54

Reported

2024-06-28 02:56

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe"

Signatures

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 60 set thread context of 2124 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\svchost.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 60 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 60 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 60 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 60 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 60 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 60 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 60 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 60 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 60 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 60 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 60 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 60 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 60 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\188799ec4f0a8c652a2cb6e131d45693_JaffaCakes118.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2124 -ip 2124

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 1792

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 www.26345.com udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
HK 45.194.21.45:80 www.26345.com tcp
HK 45.194.21.45:80 www.26345.com tcp
US 8.8.8.8:53 45.21.194.45.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp

Files

memory/60-0-0x0000000000400000-0x0000000000631000-memory.dmp

memory/60-3-0x0000000000400000-0x0000000000631000-memory.dmp

memory/60-2-0x0000000000400000-0x0000000000631000-memory.dmp

memory/60-1-0x0000000002380000-0x0000000002381000-memory.dmp

memory/2124-13-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/2124-12-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/2124-21-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/2124-16-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/2124-9-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/2124-6-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/2124-20-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/2124-17-0x0000000000400000-0x00000000005B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\e574722.tmp

MD5 5870ea0d6ba8dd6e2008466bdd00e0f4
SHA1 d41bf60d0dedff90e3cfc1b41b7e1a73df39a7d5
SHA256 5a7dac8c8b5d7cf1115246dfaf994e7f50e16a7eac1488642396f5e23fddfe0d
SHA512 0c620d5e7383adcf979feccc3b1bad584a5cec8b3d74d0ace8bb786f1f04ba87fa70d59d041dc3833977d44a75f2070181d4054c7c0b9c4ce2d66249b4b3c837

C:\Users\Admin\AppData\Local\Temp\e574721.tmp

MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

C:\Users\Admin\AppData\Local\Temp\e574733.tmp

MD5 f6b847a54cfb804a25b8842b45fd1d50
SHA1 bb22fef07ce1577c8a7fa057d8cf05502c013bfc
SHA256 5dd2f5a957946e0b6f63660ebd897851aad4795d4c847396c47ddbb647715583
SHA512 dd08a55f538e2a33e6a0c496dc97ae9045594cbbf62f7894ae8ded63f4dc0b2e89c5935269adfd1c19607b1d2474bddc49f6acb955e6dc53a55560663ca2137a

memory/2124-58-0x0000000000400000-0x00000000005B0000-memory.dmp

memory/60-59-0x0000000000400000-0x0000000000631000-memory.dmp

memory/60-60-0x0000000002380000-0x0000000002381000-memory.dmp