Analysis Overview
SHA256
12c620e143987ad28fe072cdd8dfc5b0e2cde3492cae25168e13435463323d18
Threat Level: Known bad
The file eb4412b32b90cbff3cff3a2762623f9c_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
AgentTesla
AgentTesla payload
Executes dropped EXE
Obfuscated with Agile.Net obfuscator
Suspicious use of SetThreadContext
Unsigned PE
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-04-10 14:21
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-10 14:21
Reported
2024-04-10 14:24
Platform
win7-20240221-en
Max time kernel
117s
Max time network
121s
Command Line
Signatures
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\eb4412b32b90cbff3cff3a2762623f9c_JaffaCakes118.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\eb4412b32b90cbff3cff3a2762623f9c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb4412b32b90cbff3cff3a2762623f9c_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 142.250.178.4:443 | www.google.com | tcp |
| NL | 23.62.61.57:443 | www.bing.com | tcp |
| GB | 142.250.178.4:443 | www.google.com | tcp |
| NL | 23.62.61.57:443 | www.bing.com | tcp |
Files
memory/3036-0-0x0000000000010000-0x0000000000094000-memory.dmp
memory/3036-1-0x0000000074BD0000-0x00000000752BE000-memory.dmp
memory/3036-2-0x0000000004C70000-0x0000000004CB0000-memory.dmp
memory/3036-3-0x0000000074BD0000-0x00000000752BE000-memory.dmp
memory/3036-4-0x0000000004C70000-0x0000000004CB0000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-10 14:21
Reported
2024-04-10 14:24
Platform
win10v2004-20240226-en
Max time kernel
166s
Max time network
182s
Command Line
Signatures
AgentTesla
AgentTesla payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe | N/A |
Obfuscated with Agile.Net obfuscator
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1656 set thread context of 1564 | N/A | C:\Users\Admin\AppData\Local\Temp\eb4412b32b90cbff3cff3a2762623f9c_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\eb4412b32b90cbff3cff3a2762623f9c_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\eb4412b32b90cbff3cff3a2762623f9c_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\eb4412b32b90cbff3cff3a2762623f9c_JaffaCakes118.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\eb4412b32b90cbff3cff3a2762623f9c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb4412b32b90cbff3cff3a2762623f9c_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
Network
| Country | Destination | Domain | Proto |
| NL | 52.142.223.178:80 | tcp | |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 142.250.178.4:443 | www.google.com | tcp |
| US | 8.8.8.8:53 | 4.178.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 75.159.190.20.in-addr.arpa | udp |
| NL | 23.62.61.99:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 99.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 90.65.42.20.in-addr.arpa | udp |
Files
memory/1656-1-0x0000000000350000-0x00000000003D4000-memory.dmp
memory/1656-0-0x0000000074F50000-0x0000000075700000-memory.dmp
memory/1656-2-0x0000000004D80000-0x0000000004E1C000-memory.dmp
memory/1656-3-0x0000000004C90000-0x0000000004CA0000-memory.dmp
memory/1656-4-0x0000000005BF0000-0x0000000005C18000-memory.dmp
memory/1656-5-0x0000000005CA0000-0x0000000005D06000-memory.dmp
memory/1656-6-0x0000000005C60000-0x0000000005C82000-memory.dmp
memory/1656-7-0x0000000005EB0000-0x0000000005F42000-memory.dmp
memory/1656-8-0x0000000004C90000-0x0000000004CA0000-memory.dmp
memory/1656-9-0x0000000074F50000-0x0000000075700000-memory.dmp
memory/1656-10-0x0000000004C90000-0x0000000004CA0000-memory.dmp
memory/1656-11-0x0000000004C90000-0x0000000004CA0000-memory.dmp
memory/1656-13-0x0000000000B20000-0x0000000000B34000-memory.dmp
memory/1656-14-0x0000000000CD0000-0x0000000000CD6000-memory.dmp
memory/1564-16-0x0000000000400000-0x000000000043C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
| MD5 | 5d4073b2eb6d217c19f2b22f21bf8d57 |
| SHA1 | f0209900fbf08d004b886a0b3ba33ea2b0bf9da8 |
| SHA256 | ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3 |
| SHA512 | 9ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159 |
memory/1564-20-0x0000000074F50000-0x0000000075700000-memory.dmp
memory/1656-21-0x0000000074F50000-0x0000000075700000-memory.dmp
memory/1564-22-0x00000000054D0000-0x0000000005A74000-memory.dmp
memory/1564-23-0x00000000051C0000-0x00000000051D0000-memory.dmp
memory/1564-24-0x0000000074F50000-0x0000000075700000-memory.dmp
memory/1564-25-0x00000000051C0000-0x00000000051D0000-memory.dmp
memory/1564-26-0x00000000051A0000-0x00000000051B8000-memory.dmp