Analysis

  • max time kernel
    143s
  • max time network
    173s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-04-2024 23:55

General

  • Target

    e8bcb3434260dafc15e70affded06507_JaffaCakes118.exe

  • Size

    945KB

  • MD5

    e8bcb3434260dafc15e70affded06507

  • SHA1

    38c0a175a040ab3cff1f5dbb40dfb3ff63f2f5b7

  • SHA256

    85674ca76f50b85d949c57b7e42e8aeac6312ab176439e7e2d15d41af5bd844b

  • SHA512

    569ed941c31f354be655b1a546d597fb86d8ee03c784d76beb1347c4be4f96e58444ee7265e16edf67b35186de45ba178c31aa921fa1bf08082c5d5a99074dd4

  • SSDEEP

    12288:Ik074tcvDgEWPoQsLhBN9aTom5OuoeRCE/zHrkDtd:R07vLPhf9aTXEuh/sx

Score
7/10

Malware Config

Signatures

  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e8bcb3434260dafc15e70affded06507_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e8bcb3434260dafc15e70affded06507_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1932-0-0x0000000074400000-0x0000000074BB0000-memory.dmp

    Filesize

    7.7MB

  • memory/1932-1-0x00000000001E0000-0x00000000002D2000-memory.dmp

    Filesize

    968KB

  • memory/1932-2-0x00000000053A0000-0x0000000005944000-memory.dmp

    Filesize

    5.6MB

  • memory/1932-3-0x0000000004CA0000-0x0000000004D32000-memory.dmp

    Filesize

    584KB

  • memory/1932-4-0x0000000004DF0000-0x0000000005144000-memory.dmp

    Filesize

    3.3MB

  • memory/1932-5-0x0000000005E80000-0x00000000063AC000-memory.dmp

    Filesize

    5.2MB

  • memory/1932-6-0x0000000005270000-0x000000000530C000-memory.dmp

    Filesize

    624KB

  • memory/1932-7-0x0000000005260000-0x0000000005270000-memory.dmp

    Filesize

    64KB

  • memory/1932-8-0x0000000006E40000-0x0000000006E68000-memory.dmp

    Filesize

    160KB

  • memory/1932-9-0x0000000006F90000-0x0000000006FF6000-memory.dmp

    Filesize

    408KB

  • memory/1932-10-0x0000000006F50000-0x0000000006F72000-memory.dmp

    Filesize

    136KB

  • memory/1932-11-0x0000000074400000-0x0000000074BB0000-memory.dmp

    Filesize

    7.7MB

  • memory/1932-12-0x0000000005260000-0x0000000005270000-memory.dmp

    Filesize

    64KB

  • memory/1932-14-0x0000000074400000-0x0000000074BB0000-memory.dmp

    Filesize

    7.7MB