Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
08/04/2024, 01:55
General
- Target e65ce22f7f71995d14d99ee0ee6e7cd2_JaffaCakes118.exe
- Size 1.3MB
- Sample240408-cb8wcade23
- SHA256 61d83fa892b524f95cb41aae3dc8eaaa79f4812c8db494caecd9bf08ca7922f5
Score
7/10
Malware Config
Signatures
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e65ce22f7f71995d14d99ee0ee6e7cd2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e65ce22f7f71995d14d99ee0ee6e7cd2_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/880-0-0x00000227F8880000-0x00000227F8BE4000-memory.dmp
memory/880-1-0x00007FFC1E080000-0x00007FFC1EB41000-memory.dmp
memory/880-4-0x00000227F9230000-0x00000227F9231000-memory.dmp
memory/880-3-0x00000227F9220000-0x00000227F9230000-memory.dmp
memory/880-2-0x00000227F9220000-0x00000227F9230000-memory.dmp
memory/880-5-0x00007FFC1E080000-0x00007FFC1EB41000-memory.dmp