Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-04-2024 17:10

General

  • Target

    d9c2993126c94ccfd546f3a9f3f84ab5_JaffaCakes118.exe

  • Size

    6.8MB

  • MD5

    d9c2993126c94ccfd546f3a9f3f84ab5

  • SHA1

    9fd3a5ef9d341b95352394d3795cd4efbb23c62f

  • SHA256

    77ce302fda0f50d3ecbf90a2a66820038e92d191022be38b1ffe3988a8b8d3d2

  • SHA512

    aeac9b7d02563c226d42fb506cbe1b49b4918d75d121022b380880cc0abfcdc2a497eb8dec1b1bb6a42406e592874aedbcb2fd82e575f0e20d92286bbe9f6d16

  • SSDEEP

    98304:irDWx+sEyGH9uTxld4arwlwZ6szR4QR66CxVCiKjjnteQxNGJO1Ik9tItz2t4e:iWx+sUH9oXdfrwknr+VCvnteQaOIkp

Score
7/10

Malware Config

Signatures

  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d9c2993126c94ccfd546f3a9f3f84ab5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d9c2993126c94ccfd546f3a9f3f84ab5_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1760-1-0x00000000000F0000-0x00000000007B6000-memory.dmp

    Filesize

    6.8MB

  • memory/1760-0-0x0000000074810000-0x0000000074FC0000-memory.dmp

    Filesize

    7.7MB

  • memory/1760-2-0x0000000005130000-0x0000000005484000-memory.dmp

    Filesize

    3.3MB

  • memory/1760-3-0x0000000005530000-0x00000000055CC000-memory.dmp

    Filesize

    624KB

  • memory/1760-4-0x00000000050D0000-0x00000000050E0000-memory.dmp

    Filesize

    64KB

  • memory/1760-5-0x0000000006380000-0x00000000063A8000-memory.dmp

    Filesize

    160KB

  • memory/1760-6-0x0000000006430000-0x0000000006496000-memory.dmp

    Filesize

    408KB

  • memory/1760-7-0x0000000006400000-0x0000000006422000-memory.dmp

    Filesize

    136KB

  • memory/1760-8-0x0000000006640000-0x00000000066D2000-memory.dmp

    Filesize

    584KB

  • memory/1760-9-0x000000000ACA0000-0x000000000B244000-memory.dmp

    Filesize

    5.6MB

  • memory/1760-11-0x0000000074810000-0x0000000074FC0000-memory.dmp

    Filesize

    7.7MB