Malware Analysis Report

2024-11-30 19:35

Sample ID 240920-ervd1aycnk
Target ecd1348ce2cfc15734ef751141e40068_JaffaCakes118
SHA256 879dc8e07024665309bc0fe9e3c086d36a3397a76ca66f992fbfb07d9c99416b
Tags
agilenet
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

879dc8e07024665309bc0fe9e3c086d36a3397a76ca66f992fbfb07d9c99416b

Threat Level: Shows suspicious behavior

The file ecd1348ce2cfc15734ef751141e40068_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

agilenet

Obfuscated with Agile.Net obfuscator

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-09-20 04:10

Signatures

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-20 04:10

Reported

2024-09-20 04:13

Platform

win7-20240903-en

Max time kernel

150s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe"

Network

N/A

Files

memory/2252-0-0x000007FEF5983000-0x000007FEF5984000-memory.dmp

memory/2252-1-0x00000000012E0000-0x0000000001806000-memory.dmp

memory/2252-2-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

memory/2252-3-0x000000001B650000-0x000000001B7F8000-memory.dmp

\Users\Admin\AppData\Local\Temp\32a4a32f-b10a-42fc-a699-939a32e55fe5\SiticoneDotNetRT64.dll

MD5 9c43f77cb7cff27cb47ed67babe3eda5
SHA1 b0400cf68249369d21de86bd26bb84ccffd47c43
SHA256 f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e
SHA512 cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7

memory/2252-10-0x000007FEF78B0000-0x000007FEF78D7000-memory.dmp

memory/2252-13-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-12-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-11-0x000007FEF42C0000-0x000007FEF43EC000-memory.dmp

memory/2252-15-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-17-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-19-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-21-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-23-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-25-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-27-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-31-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-29-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-33-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-35-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-37-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-39-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-41-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-43-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-45-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-47-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-49-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-51-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-53-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-55-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-57-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-59-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-61-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-63-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-65-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-67-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-69-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-71-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-73-0x000000001B650000-0x000000001B7F4000-memory.dmp

memory/2252-11026-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

memory/2252-11027-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

memory/2252-11029-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

memory/2252-11028-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

memory/2252-11030-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

memory/2252-11031-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

memory/2252-11032-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

memory/2252-11033-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

memory/2252-11034-0x000007FEF5983000-0x000007FEF5984000-memory.dmp

memory/2252-11035-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

memory/2252-11036-0x000007FEF78B0000-0x000007FEF78D7000-memory.dmp

memory/2252-11037-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

memory/2252-11038-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

memory/2252-11039-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

memory/2252-11040-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

memory/2252-11041-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-20 04:10

Reported

2024-09-20 04:13

Platform

win10v2004-20240802-en

Max time kernel

149s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\ecd1348ce2cfc15734ef751141e40068_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 34.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
IE 52.111.236.23:443 tcp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 201.64.52.20.in-addr.arpa udp

Files

memory/3504-0-0x00007FF990C73000-0x00007FF990C75000-memory.dmp

memory/3504-1-0x00000141C7900000-0x00000141C7E26000-memory.dmp

memory/3504-2-0x00007FF990C70000-0x00007FF991731000-memory.dmp

memory/3504-3-0x00000141E2550000-0x00000141E26F8000-memory.dmp

memory/3504-10-0x00007FF9A42C0000-0x00007FF9A42E7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\32a4a32f-b10a-42fc-a699-939a32e55fe5\SiticoneDotNetRT64.dll

MD5 9c43f77cb7cff27cb47ed67babe3eda5
SHA1 b0400cf68249369d21de86bd26bb84ccffd47c43
SHA256 f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e
SHA512 cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7

memory/3504-25-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-23-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-21-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-17-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-39-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-19-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-15-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-13-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-12-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-11-0x00007FF9A00B0000-0x00007FF9A01FE000-memory.dmp

memory/3504-71-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-63-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-74-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-69-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-67-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-65-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-61-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-59-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-57-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-55-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-53-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-51-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-49-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-47-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-45-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-43-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-41-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-37-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-35-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-33-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-31-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-29-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-27-0x00000141E2550000-0x00000141E26F4000-memory.dmp

memory/3504-2820-0x00007FF990C73000-0x00007FF990C75000-memory.dmp

memory/3504-3389-0x00007FF990C70000-0x00007FF991731000-memory.dmp

memory/3504-3811-0x00007FF9A42C0000-0x00007FF9A42E7000-memory.dmp

memory/3504-11029-0x00007FF990C70000-0x00007FF991731000-memory.dmp

memory/3504-11030-0x00000141E3ED0000-0x00000141E43F8000-memory.dmp

memory/3504-11031-0x00007FF990C70000-0x00007FF991731000-memory.dmp

memory/3504-11032-0x00007FF990C70000-0x00007FF991731000-memory.dmp

memory/3504-11033-0x00007FF990C70000-0x00007FF991731000-memory.dmp

memory/3504-11034-0x00007FF990C70000-0x00007FF991731000-memory.dmp

memory/3504-11035-0x00007FF990C70000-0x00007FF991731000-memory.dmp

memory/3504-11036-0x00007FF990C70000-0x00007FF991731000-memory.dmp

memory/3504-11037-0x00007FF990C70000-0x00007FF991731000-memory.dmp

memory/3504-11038-0x00007FF990C70000-0x00007FF991731000-memory.dmp

memory/3504-11039-0x00007FF990C70000-0x00007FF991731000-memory.dmp

memory/3504-11040-0x00007FF990C70000-0x00007FF991731000-memory.dmp

memory/3504-11041-0x00007FF990C70000-0x00007FF991731000-memory.dmp