Analysis Overview
SHA256
20b28f547abd38083ad2df49304ae7c1476f98fecb095ffba84e735e3f210aa9
Threat Level: Shows suspicious behavior
The file c081fd598d958e659409a2c23f590767_JaffaCakes118 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Loads dropped DLL
Checks whether UAC is enabled
Unsigned PE
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-25 10:09
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-25 10:09
Reported
2024-08-25 10:12
Platform
win7-20240704-en
Max time kernel
117s
Max time network
118s
Command Line
Signatures
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe | N/A |
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | service.downloadadmin.com | udp |
| US | 18.233.221.25:80 | service.downloadadmin.com | tcp |
| US | 18.233.221.25:80 | service.downloadadmin.com | tcp |
Files
memory/2476-13-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2476-10-0x0000000000270000-0x00000000002A6000-memory.dmp
\Users\Admin\AppData\Local\Temp\1g5FtL2d27bn8q5KRpB\shared_library.dll
| MD5 | 5e778c2e85d5e69dc954204c385a8675 |
| SHA1 | 2fe5caf49a765d0b14bcb566ba42f4629a9b1cd1 |
| SHA256 | e972766211090485d57f9fdb316c63d247a8a42028b9bcaf5439c2586ec8234a |
| SHA512 | 14e2631d57e96885603f00c132627c8930509a510d45f49d75eb634e2537fc2a841aeeade74575290f5c677df046f1ffeffb9d5fb52652b33c9c591ce6e5db1b |
memory/2476-5-0x0000000000250000-0x0000000000266000-memory.dmp
\Users\Admin\AppData\Local\Temp\1g5FtL2d27bn8q5KRpB\extramod.dll
| MD5 | 60d3fe46288cd8cfb5ff7d06e285f335 |
| SHA1 | 03d4cd2364321a82f8aea4c6c3ff12946c181c94 |
| SHA256 | e5d6610f6f690a078eb33ced642ddc8c696e49509156ed3771b843cf69f5bc81 |
| SHA512 | acaa04d8ce4acc1518c6f8a055539559f009fa5c0c39b16d3ccb232347ce960c688c2fe3fb8971448d5ea65fb10408dad51a602ee394046f6f6973915c6ec5cd |
\Users\Admin\AppData\Local\Temp\1g5FtL2d27bn8q5KRpB\lua51.dll
| MD5 | f0c59526f8186eadaf2171b8fd2967c1 |
| SHA1 | 8ffbe3e03d8139b50b41931c7b3360a0eebdb5cb |
| SHA256 | 6e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6 |
| SHA512 | dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854 |
memory/2476-14-0x000000007EF90000-0x000000007EFA0000-memory.dmp
memory/2476-15-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
\Users\Admin\AppData\Local\Temp\1g5FtL2d27bn8q5KRpB\loading_screen.dll
| MD5 | 44dac7f87bdf94d553f8d2cf073d605d |
| SHA1 | 21bf5d714b9fcab32ba40ff7d36e48c378b67a06 |
| SHA256 | 0e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66 |
| SHA512 | 92c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774 |
memory/2476-21-0x000000007EF00000-0x000000007EF10000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-08-25 10:09
Reported
2024-08-25 10:12
Platform
win10v2004-20240802-en
Max time kernel
94s
Max time network
124s
Command Line
Signatures
Loads dropped DLL
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | service.downloadadmin.com | udp |
| US | 23.23.235.104:80 | service.downloadadmin.com | tcp |
| US | 23.23.235.104:80 | service.downloadadmin.com | tcp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 150.171.28.10:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 104.235.23.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 192.142.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\4CBYAvq5uYueQmKOSVr\lua51.dll
| MD5 | f0c59526f8186eadaf2171b8fd2967c1 |
| SHA1 | 8ffbe3e03d8139b50b41931c7b3360a0eebdb5cb |
| SHA256 | 6e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6 |
| SHA512 | dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854 |
C:\Users\Admin\AppData\Local\Temp\4CBYAvq5uYueQmKOSVr\extramod.dll
| MD5 | 60d3fe46288cd8cfb5ff7d06e285f335 |
| SHA1 | 03d4cd2364321a82f8aea4c6c3ff12946c181c94 |
| SHA256 | e5d6610f6f690a078eb33ced642ddc8c696e49509156ed3771b843cf69f5bc81 |
| SHA512 | acaa04d8ce4acc1518c6f8a055539559f009fa5c0c39b16d3ccb232347ce960c688c2fe3fb8971448d5ea65fb10408dad51a602ee394046f6f6973915c6ec5cd |
memory/2764-7-0x0000000000760000-0x0000000000776000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\4CBYAvq5uYueQmKOSVr\shared_library.dll
| MD5 | 5e778c2e85d5e69dc954204c385a8675 |
| SHA1 | 2fe5caf49a765d0b14bcb566ba42f4629a9b1cd1 |
| SHA256 | e972766211090485d57f9fdb316c63d247a8a42028b9bcaf5439c2586ec8234a |
| SHA512 | 14e2631d57e96885603f00c132627c8930509a510d45f49d75eb634e2537fc2a841aeeade74575290f5c677df046f1ffeffb9d5fb52652b33c9c591ce6e5db1b |
memory/2764-14-0x0000000002230000-0x0000000002266000-memory.dmp
memory/2764-17-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/2764-18-0x000000007FE30000-0x000000007FE40000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\4CBYAvq5uYueQmKOSVr\loading_screen.dll
| MD5 | 44dac7f87bdf94d553f8d2cf073d605d |
| SHA1 | 21bf5d714b9fcab32ba40ff7d36e48c378b67a06 |
| SHA256 | 0e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66 |
| SHA512 | 92c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774 |
memory/2764-24-0x000000007FE40000-0x000000007FE50000-memory.dmp