Analysis Overview
SHA256
98579749cbc3ee54b9f1d614c2c8136e89d06071bb85e2ece10e27b54133a937
Threat Level: Shows suspicious behavior
The file 8e702f59b1e7076d0166f488c2c48b80_JaffaCakes118 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Loads dropped DLL
Checks whether UAC is enabled
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Unsigned PE
Suspicious use of SetWindowsHookEx
Modifies Internet Explorer settings
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-04 01:19
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-04 01:19
Reported
2024-11-04 03:06
Platform
win10v2004-20241007-en
Max time kernel
136s
Max time network
144s
Command Line
Signatures
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\8e702f59b1e7076d0166f488c2c48b80_JaffaCakes118.exe | N/A |
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Local\Temp\8e702f59b1e7076d0166f488c2c48b80_JaffaCakes118.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\8e702f59b1e7076d0166f488c2c48b80_JaffaCakes118.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\8e702f59b1e7076d0166f488c2c48b80_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\8e702f59b1e7076d0166f488c2c48b80_JaffaCakes118.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\8e702f59b1e7076d0166f488c2c48b80_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8e702f59b1e7076d0166f488c2c48b80_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | cen.incredibar.com | udp |
| IL | 82.80.204.5:80 | cen.incredibar.com | tcp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 53.210.109.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 10.27.171.150.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 85.65.42.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\IM_E678.tmp\ActionEngine.dll
| MD5 | 9f33f5afe6693f5ef2bab1ff9b68ca52 |
| SHA1 | 01b12b2c2b389d2337548b6d41a11be4516d8039 |
| SHA256 | 7da9d3591d9b319484e4f651a1218fcfce6254315c2dab77519c11279ba25ced |
| SHA512 | 221256a8048a442322e2da961add20e46ff669cab29274e41824d00638a2ca3ce0b29a3987856db891862983e5cf8d417d113fe7653ae62ba47d77f3bb716cad |
C:\Users\Admin\AppData\Local\Temp\IM_E678.tmp\instlangs.xml
| MD5 | aa91818150cfadb667ae6f914d43dca0 |
| SHA1 | 4411bd0038ccd464ed7597f0540cfe04867b9042 |
| SHA256 | 2aa71646493cf47b38be0920488159b154eaf19193dc4a6ecfa0a6509196c7c5 |
| SHA512 | dd1310dc52bb6cc4977341dc34fb6a273e1349602a5fb3037e0b0d087b8f0d2d7a04e2db32e2708379758266c31422d27b5a35f5ba068cd7dbdd211b07893ecd |
memory/3440-104-0x0000000002DD0000-0x0000000002DD1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IM_E678.tmp\Gui\splash.html
| MD5 | 0d0e0532f51af856688ad83abb889fde |
| SHA1 | a1949b703816fa1bc60cf9c395d6dbb0f6f5c61c |
| SHA256 | a358150647aaf4413fd2738c8ebcc0579b0bd4ccca8ba02738a4332a430f8ec8 |
| SHA512 | 29322e2446ae5a37a34f113be5924121ce7d8fcfc617818f59c407fe7da01153845a947464345d6b86463b18c75d0adae1cc7dd5f17cf2d29584ef9539d8e0df |
C:\Users\Admin\AppData\Local\Temp\IM_E678.tmp\Gui\jquery-1.3.2.min.js
| MD5 | bb381e2d19d8eace86b34d20759491a5 |
| SHA1 | 3dc9f7c2642efff4482e68c9d9df874bf98f5bcb |
| SHA256 | c8370a2d050359e9d505acc411e6f457a49b21360a21e6cbc9229bad3a767899 |
| SHA512 | abb2ad8b111271a82a04362940a7ab9930883ecb33497a1c53edcdc49f0634af5bf5b1bc7095bd18db26d212b059aece4577f85040b5f49c4982b468fe973c12 |
C:\Users\Admin\AppData\Local\Temp\IM_E678.tmp\Gui\jquery.localisation.min.js
| MD5 | f1cf73e00c240e9a4283201291d45a07 |
| SHA1 | 918c49cb6f1de521d91967b2508f19db1f38fea2 |
| SHA256 | 81bce5ff1003c9d5a688102d5d4c603841ed61c32628823dc48d560ec0d42cd2 |
| SHA512 | 2242892434a638a9344c87453c3d2a66a880278dcf66f1516f240131dca767248baf663ffc9365acad26550e5b20a742d8115d5976de3a094d0229d60844788f |
C:\Users\Admin\AppData\Local\Temp\IM_E678.tmp\Gui\translation.js
| MD5 | 682fea27f4c335defc18be6fb24d5748 |
| SHA1 | d4a1743d63508d18af4be59232f3d266228648fb |
| SHA256 | 928571317e90c4d6680931dffaaae85f382069be2bc72b875810ceb1f7c2744f |
| SHA512 | ef70ad8c291fe10c8b1d0dc060fc50b4593cf6fabc03a751aa62d5f4e375b1c80184337816a8e50430964960fc56324259f8833707320c7b757e388ecbd28341 |
C:\Users\Admin\AppData\Local\Temp\IM_E678.tmp\Gui\api.js
| MD5 | cad20144ce29f20fecd6c21c5c61dead |
| SHA1 | 6bbaeb0aae32a3828cb77f8bfd3fb493803f3626 |
| SHA256 | e68cb263198cf8cf93e5a60be4ff091606be78b0963aca0e519732187ea93e80 |
| SHA512 | 35e0f7c8cb13693d7e3a221f186bd72613544dc75e5355550bd0e7ed7054831258c5a487d20b412ce646313d24b3436baf10597baa8a359a319dbeee26580ad5 |
C:\Users\Admin\AppData\Local\Temp\IM_E678.tmp\Gui\splash.js
| MD5 | 354dce57695e99df9e6faba76346496f |
| SHA1 | ca364e2daa4a80cfed7412b0f0374f1f82fa7146 |
| SHA256 | bb39b6b14ae7f032922366943b342f58be120242020b1fa4dbb3310e39928823 |
| SHA512 | 8f34ae59e5502c70659e358d03709cfdfd01ec2128110932910e8de16888857896e86707c279b3f67edb54059a08ab6ce05b742342e825e2894580ae4a4639ee |
memory/3440-151-0x0000000002DD0000-0x0000000002DD1000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-04 01:19
Reported
2024-11-04 03:01
Platform
win7-20241010-en
Max time kernel
95s
Max time network
100s
Command Line
Signatures
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\8e702f59b1e7076d0166f488c2c48b80_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\8e702f59b1e7076d0166f488c2c48b80_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\8e702f59b1e7076d0166f488c2c48b80_JaffaCakes118.exe | N/A |
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Local\Temp\8e702f59b1e7076d0166f488c2c48b80_JaffaCakes118.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\8e702f59b1e7076d0166f488c2c48b80_JaffaCakes118.exe | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main | C:\Users\Admin\AppData\Local\Temp\8e702f59b1e7076d0166f488c2c48b80_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Users\Admin\AppData\Local\Temp\8e702f59b1e7076d0166f488c2c48b80_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Users\Admin\AppData\Local\Temp\8e702f59b1e7076d0166f488c2c48b80_JaffaCakes118.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\8e702f59b1e7076d0166f488c2c48b80_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\8e702f59b1e7076d0166f488c2c48b80_JaffaCakes118.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\8e702f59b1e7076d0166f488c2c48b80_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8e702f59b1e7076d0166f488c2c48b80_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | cen.incredibar.com | udp |
| IL | 82.80.204.5:80 | cen.incredibar.com | tcp |
| US | 8.8.8.8:53 | www5l.incredimail.com | udp |
| NL | 18.239.36.48:80 | www5l.incredimail.com | tcp |
| US | 8.8.8.8:53 | www5.incredimail.com | udp |
| IL | 82.80.204.63:80 | www5.incredimail.com | tcp |
| IL | 82.80.204.63:80 | www5.incredimail.com | tcp |
| IL | 82.80.204.63:80 | www5.incredimail.com | tcp |
| IL | 82.80.204.63:80 | www5.incredimail.com | tcp |
Files
\Users\Admin\AppData\Local\Temp\IM_D088.tmp\ActionEngine.dll
| MD5 | 9f33f5afe6693f5ef2bab1ff9b68ca52 |
| SHA1 | 01b12b2c2b389d2337548b6d41a11be4516d8039 |
| SHA256 | 7da9d3591d9b319484e4f651a1218fcfce6254315c2dab77519c11279ba25ced |
| SHA512 | 221256a8048a442322e2da961add20e46ff669cab29274e41824d00638a2ca3ce0b29a3987856db891862983e5cf8d417d113fe7653ae62ba47d77f3bb716cad |
C:\Users\Admin\AppData\Local\Temp\IM_D088.tmp\instlangs.xml
| MD5 | aa91818150cfadb667ae6f914d43dca0 |
| SHA1 | 4411bd0038ccd464ed7597f0540cfe04867b9042 |
| SHA256 | 2aa71646493cf47b38be0920488159b154eaf19193dc4a6ecfa0a6509196c7c5 |
| SHA512 | dd1310dc52bb6cc4977341dc34fb6a273e1349602a5fb3037e0b0d087b8f0d2d7a04e2db32e2708379758266c31422d27b5a35f5ba068cd7dbdd211b07893ecd |
memory/2220-103-0x0000000000510000-0x0000000000511000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IM_D088.tmp\Gui\splash.html
| MD5 | 0d0e0532f51af856688ad83abb889fde |
| SHA1 | a1949b703816fa1bc60cf9c395d6dbb0f6f5c61c |
| SHA256 | a358150647aaf4413fd2738c8ebcc0579b0bd4ccca8ba02738a4332a430f8ec8 |
| SHA512 | 29322e2446ae5a37a34f113be5924121ce7d8fcfc617818f59c407fe7da01153845a947464345d6b86463b18c75d0adae1cc7dd5f17cf2d29584ef9539d8e0df |
C:\Users\Admin\AppData\Local\Temp\IM_D088.tmp\Gui\jquery-1.3.2.min.js
| MD5 | bb381e2d19d8eace86b34d20759491a5 |
| SHA1 | 3dc9f7c2642efff4482e68c9d9df874bf98f5bcb |
| SHA256 | c8370a2d050359e9d505acc411e6f457a49b21360a21e6cbc9229bad3a767899 |
| SHA512 | abb2ad8b111271a82a04362940a7ab9930883ecb33497a1c53edcdc49f0634af5bf5b1bc7095bd18db26d212b059aece4577f85040b5f49c4982b468fe973c12 |
C:\Users\Admin\AppData\Local\Temp\IM_D088.tmp\Gui\jquery.localisation.min.js
| MD5 | f1cf73e00c240e9a4283201291d45a07 |
| SHA1 | 918c49cb6f1de521d91967b2508f19db1f38fea2 |
| SHA256 | 81bce5ff1003c9d5a688102d5d4c603841ed61c32628823dc48d560ec0d42cd2 |
| SHA512 | 2242892434a638a9344c87453c3d2a66a880278dcf66f1516f240131dca767248baf663ffc9365acad26550e5b20a742d8115d5976de3a094d0229d60844788f |
C:\Users\Admin\AppData\Local\Temp\IM_D088.tmp\Gui\translation.js
| MD5 | 682fea27f4c335defc18be6fb24d5748 |
| SHA1 | d4a1743d63508d18af4be59232f3d266228648fb |
| SHA256 | 928571317e90c4d6680931dffaaae85f382069be2bc72b875810ceb1f7c2744f |
| SHA512 | ef70ad8c291fe10c8b1d0dc060fc50b4593cf6fabc03a751aa62d5f4e375b1c80184337816a8e50430964960fc56324259f8833707320c7b757e388ecbd28341 |
C:\Users\Admin\AppData\Local\Temp\IM_D088.tmp\Gui\api.js
| MD5 | cad20144ce29f20fecd6c21c5c61dead |
| SHA1 | 6bbaeb0aae32a3828cb77f8bfd3fb493803f3626 |
| SHA256 | e68cb263198cf8cf93e5a60be4ff091606be78b0963aca0e519732187ea93e80 |
| SHA512 | 35e0f7c8cb13693d7e3a221f186bd72613544dc75e5355550bd0e7ed7054831258c5a487d20b412ce646313d24b3436baf10597baa8a359a319dbeee26580ad5 |
C:\Users\Admin\AppData\Local\Temp\IM_D088.tmp\Gui\splash.js
| MD5 | 354dce57695e99df9e6faba76346496f |
| SHA1 | ca364e2daa4a80cfed7412b0f0374f1f82fa7146 |
| SHA256 | bb39b6b14ae7f032922366943b342f58be120242020b1fa4dbb3310e39928823 |
| SHA512 | 8f34ae59e5502c70659e358d03709cfdfd01ec2128110932910e8de16888857896e86707c279b3f67edb54059a08ab6ce05b742342e825e2894580ae4a4639ee |
C:\Users\Admin\AppData\Local\Temp\IM_D088.tmp\Gui\language\splash-strings.js
| MD5 | 157d5a5389521369e8d42bf50dd9e4e5 |
| SHA1 | 32f0877615d73dd0f952dbaf1425e2e61e8082aa |
| SHA256 | 5688c7509f409b9f06d40f247000833f8318e4d20dbb6a2dff7fdb74df220bed |
| SHA512 | 75a583cfa7bd4fb4eaa73b3e189a5dba4116479c5ac5c6be8db95bb656b3951013493ada964d8abf4d5140732ae3e0e1e09e9f48622d445460532ec8eef06f1b |
memory/2220-177-0x0000000000510000-0x0000000000511000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IM_D088.tmp\utilities.xml
| MD5 | 01b9f54d1ea0c9effb02d069fab5ffe7 |
| SHA1 | 416b077b44c0834303003b5ae2b33b9e36d2e5a0 |
| SHA256 | 6b1b97697dcab08312e9ae4621fd15d3de617b4edea512d0c53ea6c097293372 |
| SHA512 | 564d8bbf12815a645b798ede97b61d8d86a57ab6dfc3bf97e7abf847008cd18c093b37694a48c49531e9d3848771d435fe4c67f5745e02ebdda78d7beb74736e |
C:\Users\Admin\AppData\Local\Temp\ImInstaller\IncrediMail\status.xml
| MD5 | c74cc101f96818463168d4c98437507e |
| SHA1 | 394129eeed767b675d5db8b588857916571f2169 |
| SHA256 | 3600f0a96ddc4c3f2515e5bda69eed1e6b6ca643c28cbc15dee3b96ea10ac1fc |
| SHA512 | a12fb7b28a1b8cd9ada2e5a27952f0887e4996d5b10d6cd977a646d9348eea03dc67fb83d00f219f2c256de5c7e2de1e7029d106b363a6299cc558bf73e462ec |