Analysis Overview
SHA256
0f1ec47370820485c7d46563ed77ec1bec66c4d79ddd2b68da796e16232846a3
Threat Level: Known bad
The file eebe64044af61dc30328295994dc3196_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
RedLine
RedLine payload
SectopRAT
SectopRAT payload
Unsigned PE
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2024-04-12 00:51
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-12 00:51
Reported
2024-04-12 00:54
Platform
win7-20240319-en
Max time kernel
142s
Max time network
149s
Command Line
Signatures
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\eebe64044af61dc30328295994dc3196_JaffaCakes118.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\eebe64044af61dc30328295994dc3196_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eebe64044af61dc30328295994dc3196_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| RU | 185.215.113.114:8887 | tcp | |
| RU | 185.215.113.114:8887 | tcp | |
| RU | 185.215.113.114:8887 | tcp | |
| RU | 185.215.113.114:8887 | tcp | |
| RU | 185.215.113.114:8887 | tcp | |
| RU | 185.215.113.114:8887 | tcp | |
| RU | 185.215.113.114:8887 | tcp |
Files
memory/2516-1-0x0000000000A60000-0x0000000000B60000-memory.dmp
memory/2516-2-0x0000000000220000-0x000000000024F000-memory.dmp
memory/2516-3-0x0000000000400000-0x00000000008BE000-memory.dmp
memory/2516-5-0x0000000074340000-0x0000000074A2E000-memory.dmp
memory/2516-6-0x0000000004C20000-0x0000000004C60000-memory.dmp
memory/2516-4-0x00000000003D0000-0x00000000003F0000-memory.dmp
memory/2516-7-0x0000000004C20000-0x0000000004C60000-memory.dmp
memory/2516-8-0x0000000002410000-0x000000000242E000-memory.dmp
memory/2516-9-0x0000000004C20000-0x0000000004C60000-memory.dmp
memory/2516-11-0x0000000000A60000-0x0000000000B60000-memory.dmp
memory/2516-12-0x0000000074340000-0x0000000074A2E000-memory.dmp
memory/2516-13-0x0000000004C20000-0x0000000004C60000-memory.dmp
memory/2516-15-0x0000000004C20000-0x0000000004C60000-memory.dmp
memory/2516-16-0x0000000004C20000-0x0000000004C60000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-12 00:51
Reported
2024-04-12 00:54
Platform
win10v2004-20240226-en
Max time kernel
148s
Max time network
150s
Command Line
Signatures
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\eebe64044af61dc30328295994dc3196_JaffaCakes118.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\eebe64044af61dc30328295994dc3196_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eebe64044af61dc30328295994dc3196_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| RU | 185.215.113.114:8887 | tcp | |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| RU | 185.215.113.114:8887 | tcp | |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 130.118.77.104.in-addr.arpa | udp |
| RU | 185.215.113.114:8887 | tcp | |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| RU | 185.215.113.114:8887 | tcp | |
| US | 8.8.8.8:53 | 249.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| RU | 185.215.113.114:8887 | tcp | |
| RU | 185.215.113.114:8887 | tcp | |
| RU | 185.215.113.114:8887 | tcp |
Files
memory/860-1-0x0000000000B40000-0x0000000000C40000-memory.dmp
memory/860-2-0x0000000002600000-0x000000000262F000-memory.dmp
memory/860-3-0x0000000000400000-0x00000000008BE000-memory.dmp
memory/860-4-0x00000000028B0000-0x00000000028D0000-memory.dmp
memory/860-5-0x0000000074F10000-0x00000000756C0000-memory.dmp
memory/860-6-0x0000000005180000-0x0000000005190000-memory.dmp
memory/860-7-0x0000000005180000-0x0000000005190000-memory.dmp
memory/860-8-0x0000000005190000-0x0000000005734000-memory.dmp
memory/860-9-0x0000000002A00000-0x0000000002A1E000-memory.dmp
memory/860-10-0x0000000005740000-0x0000000005D58000-memory.dmp
memory/860-11-0x0000000005010000-0x0000000005022000-memory.dmp
memory/860-12-0x0000000005030000-0x000000000506C000-memory.dmp
memory/860-13-0x0000000005180000-0x0000000005190000-memory.dmp
memory/860-14-0x0000000005090000-0x00000000050DC000-memory.dmp
memory/860-15-0x0000000005E00000-0x0000000005F0A000-memory.dmp
memory/860-17-0x0000000002600000-0x000000000262F000-memory.dmp
memory/860-18-0x0000000000B40000-0x0000000000C40000-memory.dmp
memory/860-19-0x0000000074F10000-0x00000000756C0000-memory.dmp
memory/860-21-0x0000000005180000-0x0000000005190000-memory.dmp
memory/860-22-0x0000000005180000-0x0000000005190000-memory.dmp
memory/860-23-0x0000000005180000-0x0000000005190000-memory.dmp