Analysis Overview
SHA256
879dc8e07024665309bc0fe9e3c086d36a3397a76ca66f992fbfb07d9c99416b
Threat Level: Shows suspicious behavior
The file ecd1348ce2cfc15734ef751141e40068_JaffaCakes118 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Obfuscated with Agile.Net obfuscator
Loads dropped DLL
Suspicious use of NtSetInformationThreadHideFromDebugger
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-09-20 04:10
Signatures
Obfuscated with Agile.Net obfuscator
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-09-20 04:10
Reported
2024-09-20 04:13
Platform
win7-20240903-en
Max time kernel
150s
Max time network
124s
Command Line
Signatures
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe | N/A |
Obfuscated with Agile.Net obfuscator
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe"
Network
Files
memory/2252-0-0x000007FEF5983000-0x000007FEF5984000-memory.dmp
memory/2252-1-0x00000000012E0000-0x0000000001806000-memory.dmp
memory/2252-2-0x000007FEF5980000-0x000007FEF636C000-memory.dmp
memory/2252-3-0x000000001B650000-0x000000001B7F8000-memory.dmp
\Users\Admin\AppData\Local\Temp\32a4a32f-b10a-42fc-a699-939a32e55fe5\SiticoneDotNetRT64.dll
| MD5 | 9c43f77cb7cff27cb47ed67babe3eda5 |
| SHA1 | b0400cf68249369d21de86bd26bb84ccffd47c43 |
| SHA256 | f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e |
| SHA512 | cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7 |
memory/2252-10-0x000007FEF78B0000-0x000007FEF78D7000-memory.dmp
memory/2252-13-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-12-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-11-0x000007FEF42C0000-0x000007FEF43EC000-memory.dmp
memory/2252-15-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-17-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-19-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-21-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-23-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-25-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-27-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-31-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-29-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-33-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-35-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-37-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-39-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-41-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-43-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-45-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-47-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-49-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-51-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-53-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-55-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-57-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-59-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-61-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-63-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-65-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-67-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-69-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-71-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-73-0x000000001B650000-0x000000001B7F4000-memory.dmp
memory/2252-11026-0x000007FEF5980000-0x000007FEF636C000-memory.dmp
memory/2252-11027-0x000007FEF5980000-0x000007FEF636C000-memory.dmp
memory/2252-11029-0x000007FEF5980000-0x000007FEF636C000-memory.dmp
memory/2252-11028-0x000007FEF5980000-0x000007FEF636C000-memory.dmp
memory/2252-11030-0x000007FEF5980000-0x000007FEF636C000-memory.dmp
memory/2252-11031-0x000007FEF5980000-0x000007FEF636C000-memory.dmp
memory/2252-11032-0x000007FEF5980000-0x000007FEF636C000-memory.dmp
memory/2252-11033-0x000007FEF5980000-0x000007FEF636C000-memory.dmp
memory/2252-11034-0x000007FEF5983000-0x000007FEF5984000-memory.dmp
memory/2252-11035-0x000007FEF5980000-0x000007FEF636C000-memory.dmp
memory/2252-11036-0x000007FEF78B0000-0x000007FEF78D7000-memory.dmp
memory/2252-11037-0x000007FEF5980000-0x000007FEF636C000-memory.dmp
memory/2252-11038-0x000007FEF5980000-0x000007FEF636C000-memory.dmp
memory/2252-11039-0x000007FEF5980000-0x000007FEF636C000-memory.dmp
memory/2252-11040-0x000007FEF5980000-0x000007FEF636C000-memory.dmp
memory/2252-11041-0x000007FEF5980000-0x000007FEF636C000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-09-20 04:10
Reported
2024-09-20 04:13
Platform
win10v2004-20240802-en
Max time kernel
149s
Max time network
158s
Command Line
Signatures
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe | N/A |
Obfuscated with Agile.Net obfuscator
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 34.56.20.217.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 140.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| IE | 52.111.236.23:443 | tcp | |
| US | 8.8.8.8:53 | 25.140.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 201.64.52.20.in-addr.arpa | udp |
Files
memory/3504-0-0x00007FF990C73000-0x00007FF990C75000-memory.dmp
memory/3504-1-0x00000141C7900000-0x00000141C7E26000-memory.dmp
memory/3504-2-0x00007FF990C70000-0x00007FF991731000-memory.dmp
memory/3504-3-0x00000141E2550000-0x00000141E26F8000-memory.dmp
memory/3504-10-0x00007FF9A42C0000-0x00007FF9A42E7000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\32a4a32f-b10a-42fc-a699-939a32e55fe5\SiticoneDotNetRT64.dll
| MD5 | 9c43f77cb7cff27cb47ed67babe3eda5 |
| SHA1 | b0400cf68249369d21de86bd26bb84ccffd47c43 |
| SHA256 | f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e |
| SHA512 | cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7 |
memory/3504-25-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-23-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-21-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-17-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-39-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-19-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-15-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-13-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-12-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-11-0x00007FF9A00B0000-0x00007FF9A01FE000-memory.dmp
memory/3504-71-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-63-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-74-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-69-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-67-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-65-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-61-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-59-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-57-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-55-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-53-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-51-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-49-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-47-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-45-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-43-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-41-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-37-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-35-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-33-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-31-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-29-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-27-0x00000141E2550000-0x00000141E26F4000-memory.dmp
memory/3504-2820-0x00007FF990C73000-0x00007FF990C75000-memory.dmp
memory/3504-3389-0x00007FF990C70000-0x00007FF991731000-memory.dmp
memory/3504-3811-0x00007FF9A42C0000-0x00007FF9A42E7000-memory.dmp
memory/3504-11029-0x00007FF990C70000-0x00007FF991731000-memory.dmp
memory/3504-11030-0x00000141E3ED0000-0x00000141E43F8000-memory.dmp
memory/3504-11031-0x00007FF990C70000-0x00007FF991731000-memory.dmp
memory/3504-11032-0x00007FF990C70000-0x00007FF991731000-memory.dmp
memory/3504-11033-0x00007FF990C70000-0x00007FF991731000-memory.dmp
memory/3504-11034-0x00007FF990C70000-0x00007FF991731000-memory.dmp
memory/3504-11035-0x00007FF990C70000-0x00007FF991731000-memory.dmp
memory/3504-11036-0x00007FF990C70000-0x00007FF991731000-memory.dmp
memory/3504-11037-0x00007FF990C70000-0x00007FF991731000-memory.dmp
memory/3504-11038-0x00007FF990C70000-0x00007FF991731000-memory.dmp
memory/3504-11039-0x00007FF990C70000-0x00007FF991731000-memory.dmp
memory/3504-11040-0x00007FF990C70000-0x00007FF991731000-memory.dmp
memory/3504-11041-0x00007FF990C70000-0x00007FF991731000-memory.dmp