Analysis Overview
SHA256
38b3aef879b86d7486227e076d97501ae9529e53ea3bf85661cd0f719c75de95
Threat Level: Shows suspicious behavior
The file a3ee25e31b3b2f8d5ee5ae5922a9cbd7_JaffaCakes118 was found to be: Shows suspicious behavior.
Malicious Activity Summary
UPX packed file
Reads user/profile data of web browsers
Checks installed software on the system
Adds Run key to start application
Suspicious use of SetThreadContext
Program crash
Unsigned PE
Suspicious use of SetWindowsHookEx
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-13 05:12
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-13 05:12
Reported
2024-06-13 05:15
Platform
win7-20240611-en
Max time kernel
150s
Max time network
146s
Command Line
Signatures
Reads user/profile data of web browsers
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NetworkChecker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a3ee25e31b3b2f8d5ee5ae5922a9cbd7_JaffaCakes118.exe" | C:\Users\Admin\AppData\Local\Temp\a3ee25e31b3b2f8d5ee5ae5922a9cbd7_JaffaCakes118.exe | N/A |
Checks installed software on the system
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2432 set thread context of 3036 | N/A | C:\Users\Admin\AppData\Local\Temp\a3ee25e31b3b2f8d5ee5ae5922a9cbd7_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\a3ee25e31b3b2f8d5ee5ae5922a9cbd7_JaffaCakes118.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\a3ee25e31b3b2f8d5ee5ae5922a9cbd7_JaffaCakes118.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\a3ee25e31b3b2f8d5ee5ae5922a9cbd7_JaffaCakes118.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\a3ee25e31b3b2f8d5ee5ae5922a9cbd7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3ee25e31b3b2f8d5ee5ae5922a9cbd7_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\a3ee25e31b3b2f8d5ee5ae5922a9cbd7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3ee25e31b3b2f8d5ee5ae5922a9cbd7_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\a3ee25e31b3b2f8d5ee5ae5922a9cbd7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3ee25e31b3b2f8d5ee5ae5922a9cbd7_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\a3ee25e31b3b2f8d5ee5ae5922a9cbd7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3ee25e31b3b2f8d5ee5ae5922a9cbd7_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| US | 69.253.165.9:80 | tcp | |
| UA | 31.128.67.10:80 | tcp | |
| GE | 78.139.185.21:80 | tcp | |
| GE | 46.49.42.28:80 | tcp | |
| ES | 176.104.87.30:80 | tcp | |
| US | 5.105.69.96:80 | tcp | |
| US | 173.26.193.99:80 | tcp | |
| UA | 109.162.91.105:80 | tcp | |
| UA | 5.58.67.110:80 | tcp | |
| NL | 85.17.31.111:80 | tcp | |
| UA | 88.135.234.206:80 | tcp | |
| IN | 103.4.210.207:80 | tcp | |
| RO | 5.12.96.213:80 | tcp | |
| UA | 178.165.11.214:80 | tcp | |
| KR | 112.185.254.215:80 | tcp | |
| UA | 176.8.25.249:80 | tcp | |
| DE | 178.26.132.252:80 | tcp | |
| VN | 27.2.45.253:80 | tcp | |
| PT | 176.223.5.255:80 | tcp | |
| SG | 111.91.49.255:80 | tcp | |
| GB | 217.36.88.83:80 | tcp | |
| UA | 5.105.56.87:80 | tcp | |
| RO | 84.247.37.90:80 | tcp | |
| UA | 37.115.43.92:80 | tcp | |
| UA | 37.115.21.94:80 | tcp | |
| GE | 5.178.141.52:80 | tcp | |
| HK | 103.24.206.52:80 | tcp | |
| UA | 176.36.6.55:80 | tcp | |
| UA | 37.229.246.57:80 | tcp | |
| GE | 5.178.165.58:80 | tcp | |
| RU | 37.193.33.48:80 | tcp | |
| UA | 193.110.144.49:80 | tcp | |
| MD | 188.237.206.58:80 | tcp | |
| DE | 188.40.133.60:80 | tcp | |
| UA | 77.123.9.65:80 | tcp |
Files
memory/2432-0-0x00000000002E0000-0x00000000002E4000-memory.dmp
memory/3036-1-0x00000000001B0000-0x00000000002AA000-memory.dmp
memory/3036-11-0x0000000000400000-0x0000000000645000-memory.dmp
memory/3036-14-0x0000000000400000-0x0000000000645000-memory.dmp
memory/3036-15-0x0000000000400000-0x0000000000645000-memory.dmp
memory/2432-12-0x0000000000400000-0x0000000000406000-memory.dmp
memory/3036-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/3036-8-0x0000000000400000-0x0000000000645000-memory.dmp
memory/3036-7-0x0000000000400000-0x0000000000645000-memory.dmp
memory/3036-5-0x0000000000400000-0x0000000000645000-memory.dmp
memory/3036-3-0x0000000000400000-0x0000000000645000-memory.dmp
memory/3036-16-0x0000000000400000-0x0000000000645000-memory.dmp
memory/3036-17-0x0000000000400000-0x0000000000645000-memory.dmp
memory/3036-20-0x0000000000400000-0x0000000000645000-memory.dmp
memory/3036-18-0x0000000000400000-0x0000000000645000-memory.dmp
memory/3036-21-0x0000000000400000-0x0000000000645000-memory.dmp
memory/3036-23-0x0000000000400000-0x0000000000645000-memory.dmp
memory/3036-22-0x0000000000400000-0x0000000000645000-memory.dmp
memory/3036-24-0x0000000000400000-0x0000000000645000-memory.dmp
memory/3036-25-0x0000000000400000-0x0000000000645000-memory.dmp
memory/3036-29-0x0000000000400000-0x0000000000645000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-13 05:12
Reported
2024-06-13 05:15
Platform
win10v2004-20240611-en
Max time kernel
78s
Max time network
123s
Command Line
Signatures
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\a3ee25e31b3b2f8d5ee5ae5922a9cbd7_JaffaCakes118.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\a3ee25e31b3b2f8d5ee5ae5922a9cbd7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3ee25e31b3b2f8d5ee5ae5922a9cbd7_JaffaCakes118.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1716 -ip 1716
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 408
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 8.8.8.8:53 | 91.90.14.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 10.27.171.150.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 20.189.173.13:443 | tcp | |
| US | 8.8.8.8:53 | 164.189.21.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| NL | 23.62.61.97:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 82.90.14.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
Files
memory/1716-0-0x0000000000400000-0x0000000000406000-memory.dmp