Analysis
- max time kernel
142s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
09/04/2024, 09:52
General
- Target e9b97ecd9f20a6c26319e7ceda18dcac_JaffaCakes118.exe
- Size 476KB
- Sample240409-lwdelsca67
- SHA256 8edfa267269f2c48ba0416cb55c0ba2bb8cd0f38950f2d9eebc9dfd58c5448d9
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9b97ecd9f20a6c26319e7ceda18dcac_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e9b97ecd9f20a6c26319e7ceda18dcac_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3760 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
.dll
memory/1108-0-0x0000000000790000-0x000000000080E000-memory.dmp
memory/1108-1-0x00007FFC4DDD0000-0x00007FFC4E891000-memory.dmp
memory/1108-3-0x000000001B3B0000-0x000000001B3C0000-memory.dmp
memory/1108-9-0x00007FFC5FAA0000-0x00007FFC5FAC8000-memory.dmp
memory/1108-10-0x00007FFC4C680000-0x00007FFC4C7CE000-memory.dmp
memory/1108-12-0x00007FFC4DDD0000-0x00007FFC4E891000-memory.dmp
memory/1108-13-0x00007FFC5FAA0000-0x00007FFC5FAC8000-memory.dmp