Malware Analysis Report

2025-01-03 08:20

Sample ID 240705-tkesas1ekp
Target 2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118
SHA256 92308177ee6693a11cd706276c5726de00eb79abf20dcb51faeb1ad66f8b473d
Tags
metasploit backdoor persistence trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

92308177ee6693a11cd706276c5726de00eb79abf20dcb51faeb1ad66f8b473d

Threat Level: Known bad

The file 2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

metasploit backdoor persistence trojan upx

MetaSploit

Loads dropped DLL

UPX packed file

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-05 16:06

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-05 16:06

Reported

2024-07-05 16:09

Platform

win7-20240221-en

Max time kernel

150s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe"

Signatures

MetaSploit

trojan backdoor metasploit

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\AdobeARMS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\AdobeARMS.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\AdobeARMS = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeARMS.exe" C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeARMS = "\\AdobeARMS.exe" C:\Users\Admin\AppData\Roaming\AdobeARMS.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\AdobeARMS = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeARMS.exe" C:\Users\Admin\AppData\Roaming\AdobeARMS.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\patches = "1" C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2412 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe
PID 2412 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe
PID 2412 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe
PID 2412 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe
PID 2412 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe
PID 2412 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe
PID 2412 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe
PID 2412 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe
PID 2240 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\AdobeARMS.exe
PID 2240 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\AdobeARMS.exe
PID 2240 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\AdobeARMS.exe
PID 2240 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\AdobeARMS.exe
PID 2604 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\AdobeARMS.exe C:\Users\Admin\AppData\Roaming\AdobeARMS.exe
PID 2604 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\AdobeARMS.exe C:\Users\Admin\AppData\Roaming\AdobeARMS.exe
PID 2604 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\AdobeARMS.exe C:\Users\Admin\AppData\Roaming\AdobeARMS.exe
PID 2604 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\AdobeARMS.exe C:\Users\Admin\AppData\Roaming\AdobeARMS.exe
PID 2604 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\AdobeARMS.exe C:\Users\Admin\AppData\Roaming\AdobeARMS.exe
PID 2604 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\AdobeARMS.exe C:\Users\Admin\AppData\Roaming\AdobeARMS.exe
PID 2604 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\AdobeARMS.exe C:\Users\Admin\AppData\Roaming\AdobeARMS.exe
PID 2604 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\AdobeARMS.exe C:\Users\Admin\AppData\Roaming\AdobeARMS.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\AdobeARMS.exe

C:\Users\Admin\AppData\Roaming\AdobeARMS.exe 388 "C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\AdobeARMS.exe

"C:\Users\Admin\AppData\Roaming\AdobeARMS.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 oldschne.mine.nu udp

Files

memory/2240-0-0x0000000000400000-0x000000000048C000-memory.dmp

memory/2412-9-0x0000000000400000-0x000000000040E000-memory.dmp

memory/2240-13-0x0000000000400000-0x000000000048C000-memory.dmp

memory/2240-14-0x0000000000400000-0x000000000048C000-memory.dmp

memory/2240-12-0x0000000000400000-0x000000000048C000-memory.dmp

memory/2240-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

C:\Users\Admin\AppData\Roaming\AdobeARMS.exe

MD5 2705b56c3ab535f3010fc730f2b88e22
SHA1 60211d8cfad0807b4daf478f300299fb05c73947
SHA256 92308177ee6693a11cd706276c5726de00eb79abf20dcb51faeb1ad66f8b473d
SHA512 2343b568c8282e196662de40b878c13a3f4afb8097e4704268a405f356e4f35413a35f1ef531a1cdbd4c7f085d7cbab82503473c1f53400e1887c429188b1999

memory/2240-5-0x0000000000400000-0x000000000048C000-memory.dmp

memory/2240-11-0x0000000000400000-0x000000000048C000-memory.dmp

memory/2240-3-0x0000000000400000-0x000000000048C000-memory.dmp

memory/2240-2-0x0000000000400000-0x000000000048C000-memory.dmp

memory/2240-27-0x0000000000400000-0x000000000048C000-memory.dmp

memory/2584-40-0x0000000000400000-0x000000000048C000-memory.dmp

memory/2584-42-0x0000000000400000-0x000000000048C000-memory.dmp

memory/2584-44-0x0000000000400000-0x000000000048C000-memory.dmp

memory/2584-43-0x0000000000400000-0x000000000048C000-memory.dmp

memory/2584-41-0x0000000000400000-0x000000000048C000-memory.dmp

memory/2604-38-0x0000000000400000-0x000000000040E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-05 16:06

Reported

2024-07-05 16:09

Platform

win10v2004-20240704-en

Max time kernel

147s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe"

Signatures

MetaSploit

trojan backdoor metasploit

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\AdobeARMS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\AdobeARMS.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeARMS = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeARMS.exe" C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeARMS = "\\AdobeARMS.exe" C:\Users\Admin\AppData\Roaming\AdobeARMS.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeARMS = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeARMS.exe" C:\Users\Admin\AppData\Roaming\AdobeARMS.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\patches = "1" C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3860 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe
PID 3860 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe
PID 3860 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe
PID 3860 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe
PID 3860 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe
PID 3860 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe
PID 3860 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe
PID 3860 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe
PID 4640 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\AdobeARMS.exe
PID 4640 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\AdobeARMS.exe
PID 4640 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\AdobeARMS.exe
PID 3760 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Roaming\AdobeARMS.exe C:\Users\Admin\AppData\Roaming\AdobeARMS.exe
PID 3760 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Roaming\AdobeARMS.exe C:\Users\Admin\AppData\Roaming\AdobeARMS.exe
PID 3760 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Roaming\AdobeARMS.exe C:\Users\Admin\AppData\Roaming\AdobeARMS.exe
PID 3760 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Roaming\AdobeARMS.exe C:\Users\Admin\AppData\Roaming\AdobeARMS.exe
PID 3760 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Roaming\AdobeARMS.exe C:\Users\Admin\AppData\Roaming\AdobeARMS.exe
PID 3760 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Roaming\AdobeARMS.exe C:\Users\Admin\AppData\Roaming\AdobeARMS.exe
PID 3760 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Roaming\AdobeARMS.exe C:\Users\Admin\AppData\Roaming\AdobeARMS.exe
PID 3760 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Roaming\AdobeARMS.exe C:\Users\Admin\AppData\Roaming\AdobeARMS.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3860 -ip 3860

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 376

C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\AdobeARMS.exe

C:\Users\Admin\AppData\Roaming\AdobeARMS.exe 908 "C:\Users\Admin\AppData\Local\Temp\2705b56c3ab535f3010fc730f2b88e22_JaffaCakes118.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3760 -ip 3760

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 376

C:\Users\Admin\AppData\Roaming\AdobeARMS.exe

"C:\Users\Admin\AppData\Roaming\AdobeARMS.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 oldschne.mine.nu udp
US 8.8.8.8:53 oldschne.mine.nu udp
US 8.8.8.8:53 oldschne.mine.nu udp
US 8.8.8.8:53 oldschne.mine.nu udp
US 8.8.8.8:53 oldschne.mine.nu udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 oldschne.mine.nu udp
US 8.8.8.8:53 98.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 oldschne.mine.nu udp
US 8.8.8.8:53 oldschne.mine.nu udp
US 8.8.8.8:53 oldschne.mine.nu udp
US 8.8.8.8:53 oldschne.mine.nu udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 oldschne.mine.nu udp
US 8.8.8.8:53 oldschne.mine.nu udp
US 8.8.8.8:53 oldschne.mine.nu udp
US 8.8.8.8:53 oldschne.mine.nu udp
US 8.8.8.8:53 oldschne.mine.nu udp
US 8.8.8.8:53 oldschne.mine.nu udp
US 8.8.8.8:53 oldschne.mine.nu udp
US 8.8.8.8:53 oldschne.mine.nu udp
US 8.8.8.8:53 oldschne.mine.nu udp
US 8.8.8.8:53 oldschne.mine.nu udp
US 8.8.8.8:53 oldschne.mine.nu udp
US 8.8.8.8:53 oldschne.mine.nu udp
US 8.8.8.8:53 oldschne.mine.nu udp
US 8.8.8.8:53 oldschne.mine.nu udp

Files

memory/4640-1-0x0000000000400000-0x000000000048C000-memory.dmp

memory/4640-2-0x0000000000400000-0x000000000048C000-memory.dmp

memory/3860-5-0x0000000000400000-0x000000000040E000-memory.dmp

memory/4640-0-0x0000000000400000-0x000000000048C000-memory.dmp

memory/4640-8-0x0000000000400000-0x000000000048C000-memory.dmp

memory/4640-7-0x0000000000400000-0x000000000048C000-memory.dmp

C:\Users\Admin\AppData\Roaming\AdobeARMS.exe

MD5 2705b56c3ab535f3010fc730f2b88e22
SHA1 60211d8cfad0807b4daf478f300299fb05c73947
SHA256 92308177ee6693a11cd706276c5726de00eb79abf20dcb51faeb1ad66f8b473d
SHA512 2343b568c8282e196662de40b878c13a3f4afb8097e4704268a405f356e4f35413a35f1ef531a1cdbd4c7f085d7cbab82503473c1f53400e1887c429188b1999

memory/4640-14-0x0000000000400000-0x000000000048C000-memory.dmp

memory/4640-6-0x0000000000400000-0x000000000048C000-memory.dmp

memory/2880-25-0x0000000000400000-0x000000000048C000-memory.dmp

memory/3760-27-0x0000000000400000-0x000000000040E000-memory.dmp

memory/2880-26-0x0000000000400000-0x000000000048C000-memory.dmp

memory/2880-24-0x0000000000400000-0x000000000048C000-memory.dmp

memory/2880-23-0x0000000000400000-0x000000000048C000-memory.dmp

memory/2880-28-0x0000000000400000-0x000000000048C000-memory.dmp

memory/2880-29-0x0000000000400000-0x000000000048C000-memory.dmp