Analysis Overview
SHA256
511b9b5dbdae2d2930fc3062c70e916e0f29ebeef9c4798a2d7a7614973e1427
Threat Level: Shows suspicious behavior
The file 3f070220e46476b98ad310565fa79c8c_JaffaCakes118 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Registers COM server for autorun
Checks installed software on the system
Checks whether UAC is enabled
Unsigned PE
Suspicious use of SetWindowsHookEx
Modifies Internet Explorer settings
Modifies registry class
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-13 10:26
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-13 10:26
Reported
2024-05-13 10:29
Platform
win10v2004-20240426-en
Max time kernel
130s
Max time network
100s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 76.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.142.211.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 142.53.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 79.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| NL | 23.62.61.194:443 | www.bing.com | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 194.61.62.23.in-addr.arpa | udp |
Files
memory/4736-3-0x0000000002E20000-0x0000000002F65000-memory.dmp
memory/4736-9-0x0000000002E20000-0x0000000002F65000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-13 10:26
Reported
2024-05-13 10:29
Platform
win7-20231129-en
Max time kernel
120s
Max time network
121s
Command Line
Signatures
Registers COM server for autorun
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32 | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe" | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe" | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
Checks installed software on the system
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Interface | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Programmable | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\ = "JSIELib" | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\Interface | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\ = "{157B1AA6-3E5C-404A-9118-C1D91F537040}" | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\Version = "1.0" | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32 | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS\ = "0" | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\TypeLib | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe" | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe" | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040} | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5} | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe" | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TypeLib\ = "{7E77E9F2-D76B-4D54-B515-9A7F93DF03DF}" | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326} | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32 | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\ = "TinyJSObject Class" | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TypeLib | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326} | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\ = "{157B1AA6-3E5C-404A-9118-C1D91F537040}" | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Version\ = "1.0" | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0 | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0 | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\win32 | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ = "ITinyJSObject" | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32 | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ = "ITinyJSObject" | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Version | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\Version = "1.0" | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f070220e46476b98ad310565fa79c8c_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | c1.allocal.info | udp |
| US | 8.8.8.8:53 | r1.joburnt.net | udp |
| US | 8.8.8.8:53 | c2.allocal.info | udp |
Files
memory/2856-2-0x0000000002030000-0x0000000002175000-memory.dmp
memory/2856-10-0x0000000002030000-0x0000000002175000-memory.dmp
memory/2856-9-0x0000000002030000-0x0000000002175000-memory.dmp
memory/2856-11-0x0000000002030000-0x0000000002175000-memory.dmp
memory/2856-13-0x0000000000360000-0x0000000000361000-memory.dmp
memory/2856-15-0x0000000000360000-0x0000000000361000-memory.dmp