Analysis Overview
SHA256
0ec96f55ab244cfcbd09b2df441da777ff9d367d7d19a2871b4fef19c2ede76d
Threat Level: Shows suspicious behavior
The file ef32bf3b0f05a4d6e5c050670ce92ee1_JaffaCakes118 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Themida packer
Unsigned PE
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-04-12 05:08
Signatures
Themida packer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-12 05:08
Reported
2024-04-12 05:10
Platform
win10v2004-20240226-en
Max time kernel
92s
Max time network
126s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\ef32bf3b0f05a4d6e5c050670ce92ee1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ef32bf3b0f05a4d6e5c050670ce92ee1_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 24.139.73.23.in-addr.arpa | udp |
Files
memory/2660-1-0x0000000002510000-0x0000000002675000-memory.dmp
memory/2660-0-0x00000000008D0000-0x00000000008D1000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-12 05:08
Reported
2024-04-12 05:10
Platform
win7-20240221-en
Max time kernel
120s
Max time network
124s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\ef32bf3b0f05a4d6e5c050670ce92ee1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ef32bf3b0f05a4d6e5c050670ce92ee1_JaffaCakes118.exe"
Network
Files
memory/2224-1-0x0000000002010000-0x0000000002175000-memory.dmp
memory/2224-0-0x00000000002E0000-0x00000000002E1000-memory.dmp
memory/2224-2-0x00000000002E0000-0x00000000002E1000-memory.dmp