Analysis
- max time kernel
147s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
22/08/2024, 02:19
General
- Target b5faa8cb97d8e4243e7682e87b4564d5_JaffaCakes118.exe
- Size 5.2MB
- Sample240822-cr7yzstdpe
- SHA256 d22e27507344c9b12dc9430cbdb3b542ec8ad2e68c2619f62fa7e1bd19ff6494
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5faa8cb97d8e4243e7682e87b4564d5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b5faa8cb97d8e4243e7682e87b4564d5_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
SiticoneDotNetRT64.dll
memory/2456-0-0x00007FFE06703000-0x00007FFE06705000-memory.dmp
memory/2456-1-0x0000018BD5870000-0x0000018BD5DA6000-memory.dmp
memory/2456-2-0x00007FFE06700000-0x00007FFE071C1000-memory.dmp
memory/2456-3-0x0000018BF02E0000-0x0000018BF0488000-memory.dmp
memory/2456-4-0x00007FFE06700000-0x00007FFE071C1000-memory.dmp
memory/2456-11-0x00007FFE19F40000-0x00007FFE19F67000-memory.dmp
memory/2456-14-0x00007FFE06700000-0x00007FFE071C1000-memory.dmp
memory/2456-15-0x0000018BF1060000-0x0000018BF1588000-memory.dmp
memory/2456-16-0x00007FFE06700000-0x00007FFE071C1000-memory.dmp
memory/2456-17-0x00007FFE06700000-0x00007FFE071C1000-memory.dmp
memory/2456-18-0x00007FFE19F40000-0x00007FFE19F67000-memory.dmp