Malware Analysis Report

2025-08-10 15:24

Sample ID 241103-ft151awbrg
Target 89c742b35826d51946f74631288c1171_JaffaCakes118
SHA256 01ca2ff67af9d0c5881b6936157e9fbe697ea05174847a565ffc1c9b062a5b0a
Tags
discovery evasion execution persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

01ca2ff67af9d0c5881b6936157e9fbe697ea05174847a565ffc1c9b062a5b0a

Threat Level: Likely malicious

The file 89c742b35826d51946f74631288c1171_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

discovery evasion execution persistence

Stops running service(s)

Uses Session Manager for persistence

Adds Run key to start application

Drops file in System32 directory

Launches sc.exe

Unsigned PE

System Location Discovery: System Language Discovery

Scheduled Task/Job: Scheduled Task

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-03 05:10

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-03 05:10

Reported

2024-11-03 05:13

Platform

win7-20240903-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe"

Signatures

Stops running service(s)

evasion execution

Uses Session Manager for persistence

persistence
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000 C:\Windows\SysWOW64\reg.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000 C:\Windows\SysWOW64\reg.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000 C:\Windows\SysWOW64\reg.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\win = "C:\\win.exe" C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\reg_0001.txt C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2104 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2104 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2104 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2104 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2104 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2104 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2104 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2104 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2104 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 2104 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 2104 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 2104 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 2104 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 2104 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 2104 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 2104 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 2104 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 2104 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 2104 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 2104 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe"

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn startt /tr c:\autoexec.bat /sc onstart /ru system

C:\Windows\SysWOW64\sc.exe

sc delete GbpSv

C:\Windows\SysWOW64\reg.exe

reg add "HKLM\SYSTEM\ControlSet001\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKLM\SYSTEM\ControlSet002\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 bindz.100webspace.net udp
US 198.23.57.33:80 bindz.100webspace.net tcp

Files

memory/2104-0-0x0000000000270000-0x0000000000271000-memory.dmp

memory/2104-3-0x0000000000270000-0x0000000000271000-memory.dmp

memory/2104-2-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/2104-4-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/2104-5-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/2104-6-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/2104-7-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/2104-8-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/2104-9-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/2104-10-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/2104-11-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/2104-12-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/2104-13-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/2104-14-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/2104-15-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/2104-16-0x0000000000400000-0x0000000001A14000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-03 05:10

Reported

2024-11-03 05:13

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe"

Signatures

Stops running service(s)

evasion execution

Uses Session Manager for persistence

persistence
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000 C:\Windows\SysWOW64\reg.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000 C:\Windows\SysWOW64\reg.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\Session manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000 C:\Windows\SysWOW64\reg.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win = "C:\\win.exe" C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\reg_0001.txt C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3288 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 3288 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 3288 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 3288 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3288 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3288 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3288 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 3288 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 3288 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 3288 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 3288 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 3288 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 3288 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 3288 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 3288 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\89c742b35826d51946f74631288c1171_JaffaCakes118.exe"

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn startt /tr c:\autoexec.bat /sc onstart /ru system

C:\Windows\SysWOW64\sc.exe

sc delete GbpSv

C:\Windows\SysWOW64\reg.exe

reg add "HKLM\SYSTEM\ControlSet001\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKLM\SYSTEM\ControlSet002\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 bindz.100webspace.net udp
US 198.23.57.33:80 bindz.100webspace.net tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 33.57.23.198.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

memory/3288-0-0x0000000003980000-0x0000000003981000-memory.dmp

memory/3288-3-0x0000000003980000-0x0000000003981000-memory.dmp

memory/3288-2-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/3288-4-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/3288-5-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/3288-6-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/3288-7-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/3288-8-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/3288-9-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/3288-10-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/3288-11-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/3288-12-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/3288-13-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/3288-14-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/3288-15-0x0000000000400000-0x0000000001A14000-memory.dmp

memory/3288-16-0x0000000000400000-0x0000000001A14000-memory.dmp