Analysis
- max time kernel
143s - max time network
173s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
08/04/2024, 23:55
General
- Target e8bcb3434260dafc15e70affded06507_JaffaCakes118.exe
- Size 945KB
- Sample240408-3ypzvsba4v
- SHA256 85674ca76f50b85d949c57b7e42e8aeac6312ab176439e7e2d15d41af5bd844b
Malware Config
Signatures
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8bcb3434260dafc15e70affded06507_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e8bcb3434260dafc15e70affded06507_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1932-0-0x0000000074400000-0x0000000074BB0000-memory.dmp
memory/1932-1-0x00000000001E0000-0x00000000002D2000-memory.dmp
memory/1932-2-0x00000000053A0000-0x0000000005944000-memory.dmp
memory/1932-3-0x0000000004CA0000-0x0000000004D32000-memory.dmp
memory/1932-4-0x0000000004DF0000-0x0000000005144000-memory.dmp
memory/1932-5-0x0000000005E80000-0x00000000063AC000-memory.dmp
memory/1932-6-0x0000000005270000-0x000000000530C000-memory.dmp
memory/1932-7-0x0000000005260000-0x0000000005270000-memory.dmp
memory/1932-8-0x0000000006E40000-0x0000000006E68000-memory.dmp
memory/1932-9-0x0000000006F90000-0x0000000006FF6000-memory.dmp
memory/1932-10-0x0000000006F50000-0x0000000006F72000-memory.dmp
memory/1932-11-0x0000000074400000-0x0000000074BB0000-memory.dmp
memory/1932-12-0x0000000005260000-0x0000000005270000-memory.dmp
memory/1932-14-0x0000000074400000-0x0000000074BB0000-memory.dmp