Malware Analysis Report

2025-01-03 08:15

Sample ID 240705-k5nfhaybkc
Target 26cf2e3331c449ce00052580b9edc486_JaffaCakes118
SHA256 660fd3686ae8931dc161cafa764e73a19eb7f6805aadaa6a42de281bf9d730a6
Tags
metasploit backdoor persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

660fd3686ae8931dc161cafa764e73a19eb7f6805aadaa6a42de281bf9d730a6

Threat Level: Known bad

The file 26cf2e3331c449ce00052580b9edc486_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

metasploit backdoor persistence trojan

MetaSploit

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

Program crash

Unsigned PE

Runs net.exe

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-05 09:11

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-05 09:11

Reported

2024-07-05 09:13

Platform

win10v2004-20240704-en

Max time kernel

95s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4320 -ip 4320

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 276

Network

Country Destination Domain Proto
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

memory/4320-0-0x0000000000400000-0x0000000000427000-memory.dmp

memory/4320-1-0x0000000000400000-0x0000000000427000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-05 09:11

Reported

2024-07-05 09:13

Platform

win7-20240611-en

Max time kernel

144s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe"

Signatures

MetaSploit

trojan backdoor metasploit

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\usbmagr.exe N/A
N/A N/A C:\Windows\usbmagr.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Universal Serial Bus device = "usbmagr.exe" C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1752 set thread context of 2216 N/A C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe
PID 2960 set thread context of 2728 N/A C:\Windows\usbmagr.exe C:\Windows\usbmagr.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\usbmagr.exe C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe N/A
File opened for modification C:\Windows\usbmagr.exe C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe N/A

Enumerates physical storage devices

Runs net.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1752 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe
PID 1752 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe
PID 1752 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe
PID 1752 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe
PID 1752 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe
PID 1752 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe
PID 1752 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe
PID 1752 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe
PID 1752 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe
PID 2216 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2216 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2216 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2216 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2216 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe C:\Windows\usbmagr.exe
PID 2216 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe C:\Windows\usbmagr.exe
PID 2216 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe C:\Windows\usbmagr.exe
PID 2216 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe C:\Windows\usbmagr.exe
PID 2316 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2316 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2316 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2316 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2696 wrote to memory of 2708 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2696 wrote to memory of 2708 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2696 wrote to memory of 2708 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2696 wrote to memory of 2708 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2960 wrote to memory of 2728 N/A C:\Windows\usbmagr.exe C:\Windows\usbmagr.exe
PID 2960 wrote to memory of 2728 N/A C:\Windows\usbmagr.exe C:\Windows\usbmagr.exe
PID 2960 wrote to memory of 2728 N/A C:\Windows\usbmagr.exe C:\Windows\usbmagr.exe
PID 2960 wrote to memory of 2728 N/A C:\Windows\usbmagr.exe C:\Windows\usbmagr.exe
PID 2960 wrote to memory of 2728 N/A C:\Windows\usbmagr.exe C:\Windows\usbmagr.exe
PID 2960 wrote to memory of 2728 N/A C:\Windows\usbmagr.exe C:\Windows\usbmagr.exe
PID 2960 wrote to memory of 2728 N/A C:\Windows\usbmagr.exe C:\Windows\usbmagr.exe
PID 2960 wrote to memory of 2728 N/A C:\Windows\usbmagr.exe C:\Windows\usbmagr.exe
PID 2960 wrote to memory of 2728 N/A C:\Windows\usbmagr.exe C:\Windows\usbmagr.exe
PID 2728 wrote to memory of 2648 N/A C:\Windows\usbmagr.exe C:\Windows\SysWOW64\cmd.exe
PID 2728 wrote to memory of 2648 N/A C:\Windows\usbmagr.exe C:\Windows\SysWOW64\cmd.exe
PID 2728 wrote to memory of 2648 N/A C:\Windows\usbmagr.exe C:\Windows\SysWOW64\cmd.exe
PID 2728 wrote to memory of 2648 N/A C:\Windows\usbmagr.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2648 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2648 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2648 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2476 wrote to memory of 2496 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2476 wrote to memory of 2496 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2476 wrote to memory of 2496 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2476 wrote to memory of 2496 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\26cf2e3331c449ce00052580b9edc486_JaffaCakes118.exe

NULL

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\x.bat" "

C:\Windows\usbmagr.exe

"C:\Windows\usbmagr.exe"

C:\Windows\SysWOW64\net.exe

net stop "Security Center"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Security Center"

C:\Windows\usbmagr.exe

NULL

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\x.bat" "

C:\Windows\SysWOW64\net.exe

net stop "Security Center"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Security Center"

Network

Country Destination Domain Proto
US 8.8.8.8:53 shell.virtual-rejectz.com udp

Files

memory/1752-0-0x0000000000400000-0x0000000000427000-memory.dmp

memory/1752-1-0x0000000000220000-0x0000000000247000-memory.dmp

memory/2216-2-0x0000000000400000-0x0000000000459000-memory.dmp

memory/2216-5-0x0000000000400000-0x0000000000459000-memory.dmp

memory/1752-3-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2216-6-0x0000000000400000-0x0000000000459000-memory.dmp

C:\x.bat

MD5 e6ed7be2b9572503f07663ca6e53759f
SHA1 7ad80bd38f2a27e06c111b551c76ad0a0585c194
SHA256 b1a6c027d18eb5766129a059f68201e6fb8c68d095f3932983009fe5ae2e4df9
SHA512 e0010782b4fe567290536743375112db3107f8390d4c5cbb97f1bf1a8c83825399e1fe2fe9793d351896bb704f3bdec583fa7241b853b136fa9440a927d94227

C:\Windows\usbmagr.exe

MD5 26cf2e3331c449ce00052580b9edc486
SHA1 ec7102fd563a2c27da29b1818d5bcf269fb57314
SHA256 660fd3686ae8931dc161cafa764e73a19eb7f6805aadaa6a42de281bf9d730a6
SHA512 692f33c5d347557640c1780c3e476665a3d9920e56e95ee9eda27ba4393d3ba5533338abc64cf90be822b600f5955d46b1d99040fcb7cb0e0ddccd5fd06ea671

memory/2216-22-0x0000000002CC0000-0x0000000002CE7000-memory.dmp

memory/2216-24-0x0000000000400000-0x0000000000459000-memory.dmp

memory/2960-29-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2728-32-0x0000000000400000-0x0000000000459000-memory.dmp

memory/2728-41-0x0000000000400000-0x0000000000459000-memory.dmp

memory/2728-43-0x0000000000400000-0x0000000000459000-memory.dmp

memory/2728-46-0x0000000000400000-0x0000000000459000-memory.dmp

memory/2728-49-0x0000000000400000-0x0000000000459000-memory.dmp

memory/2728-55-0x0000000000400000-0x0000000000459000-memory.dmp