Malware Analysis Report

2025-06-16 06:39

Sample ID 240825-l67q7s1akp
Target c081fd598d958e659409a2c23f590767_JaffaCakes118
SHA256 20b28f547abd38083ad2df49304ae7c1476f98fecb095ffba84e735e3f210aa9
Tags
discovery evasion trojan
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

20b28f547abd38083ad2df49304ae7c1476f98fecb095ffba84e735e3f210aa9

Threat Level: Shows suspicious behavior

The file c081fd598d958e659409a2c23f590767_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery evasion trojan

Loads dropped DLL

Checks whether UAC is enabled

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-25 10:09

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-25 10:09

Reported

2024-08-25 10:12

Platform

win7-20240704-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe"

Signatures

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2312 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe
PID 2312 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe
PID 2312 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe
PID 2312 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe
PID 2312 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe
PID 2312 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe
PID 2312 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe
PID 2460 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe
PID 2460 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe
PID 2460 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe
PID 2460 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe
PID 2460 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe
PID 2460 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe
PID 2460 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 service.downloadadmin.com udp
US 18.233.221.25:80 service.downloadadmin.com tcp
US 18.233.221.25:80 service.downloadadmin.com tcp

Files

memory/2476-13-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

memory/2476-10-0x0000000000270000-0x00000000002A6000-memory.dmp

\Users\Admin\AppData\Local\Temp\1g5FtL2d27bn8q5KRpB\shared_library.dll

MD5 5e778c2e85d5e69dc954204c385a8675
SHA1 2fe5caf49a765d0b14bcb566ba42f4629a9b1cd1
SHA256 e972766211090485d57f9fdb316c63d247a8a42028b9bcaf5439c2586ec8234a
SHA512 14e2631d57e96885603f00c132627c8930509a510d45f49d75eb634e2537fc2a841aeeade74575290f5c677df046f1ffeffb9d5fb52652b33c9c591ce6e5db1b

memory/2476-5-0x0000000000250000-0x0000000000266000-memory.dmp

\Users\Admin\AppData\Local\Temp\1g5FtL2d27bn8q5KRpB\extramod.dll

MD5 60d3fe46288cd8cfb5ff7d06e285f335
SHA1 03d4cd2364321a82f8aea4c6c3ff12946c181c94
SHA256 e5d6610f6f690a078eb33ced642ddc8c696e49509156ed3771b843cf69f5bc81
SHA512 acaa04d8ce4acc1518c6f8a055539559f009fa5c0c39b16d3ccb232347ce960c688c2fe3fb8971448d5ea65fb10408dad51a602ee394046f6f6973915c6ec5cd

\Users\Admin\AppData\Local\Temp\1g5FtL2d27bn8q5KRpB\lua51.dll

MD5 f0c59526f8186eadaf2171b8fd2967c1
SHA1 8ffbe3e03d8139b50b41931c7b3360a0eebdb5cb
SHA256 6e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6
SHA512 dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854

memory/2476-14-0x000000007EF90000-0x000000007EFA0000-memory.dmp

memory/2476-15-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

\Users\Admin\AppData\Local\Temp\1g5FtL2d27bn8q5KRpB\loading_screen.dll

MD5 44dac7f87bdf94d553f8d2cf073d605d
SHA1 21bf5d714b9fcab32ba40ff7d36e48c378b67a06
SHA256 0e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66
SHA512 92c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774

memory/2476-21-0x000000007EF00000-0x000000007EF10000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-25 10:09

Reported

2024-08-25 10:12

Platform

win10v2004-20240802-en

Max time kernel

94s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe"

Signatures

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 service.downloadadmin.com udp
US 23.23.235.104:80 service.downloadadmin.com tcp
US 23.23.235.104:80 service.downloadadmin.com tcp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 104.235.23.23.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 192.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\4CBYAvq5uYueQmKOSVr\lua51.dll

MD5 f0c59526f8186eadaf2171b8fd2967c1
SHA1 8ffbe3e03d8139b50b41931c7b3360a0eebdb5cb
SHA256 6e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6
SHA512 dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854

C:\Users\Admin\AppData\Local\Temp\4CBYAvq5uYueQmKOSVr\extramod.dll

MD5 60d3fe46288cd8cfb5ff7d06e285f335
SHA1 03d4cd2364321a82f8aea4c6c3ff12946c181c94
SHA256 e5d6610f6f690a078eb33ced642ddc8c696e49509156ed3771b843cf69f5bc81
SHA512 acaa04d8ce4acc1518c6f8a055539559f009fa5c0c39b16d3ccb232347ce960c688c2fe3fb8971448d5ea65fb10408dad51a602ee394046f6f6973915c6ec5cd

memory/2764-7-0x0000000000760000-0x0000000000776000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4CBYAvq5uYueQmKOSVr\shared_library.dll

MD5 5e778c2e85d5e69dc954204c385a8675
SHA1 2fe5caf49a765d0b14bcb566ba42f4629a9b1cd1
SHA256 e972766211090485d57f9fdb316c63d247a8a42028b9bcaf5439c2586ec8234a
SHA512 14e2631d57e96885603f00c132627c8930509a510d45f49d75eb634e2537fc2a841aeeade74575290f5c677df046f1ffeffb9d5fb52652b33c9c591ce6e5db1b

memory/2764-14-0x0000000002230000-0x0000000002266000-memory.dmp

memory/2764-17-0x000000007FE40000-0x000000007FE50000-memory.dmp

memory/2764-18-0x000000007FE30000-0x000000007FE40000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4CBYAvq5uYueQmKOSVr\loading_screen.dll

MD5 44dac7f87bdf94d553f8d2cf073d605d
SHA1 21bf5d714b9fcab32ba40ff7d36e48c378b67a06
SHA256 0e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66
SHA512 92c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774

memory/2764-24-0x000000007FE40000-0x000000007FE50000-memory.dmp