Analysis
- max time kernel
100s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
19/04/2024, 03:53
General
- Target f972545552f70575e7266e71f049c43c_JaffaCakes118.exe
- Size 5.1MB
- Sample240419-ef5etsfh96
- SHA256 9f64025e2573f707cbf9b9248ac60df31996f8c792dd81b560e4ac59739f8d66
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 34 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f972545552f70575e7266e71f049c43c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f972545552f70575e7266e71f049c43c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
AgileDotNetRT64.dll
memory/3232-38-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-42-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-3-0x000001A961F80000-0x000001A96214E000-memory.dmp
memory/3232-1-0x00007FF9C2F50000-0x00007FF9C3A11000-memory.dmp
memory/3232-10-0x00007FF9D22E0000-0x00007FF9D242E000-memory.dmp
memory/3232-11-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-12-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-14-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-16-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-18-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-20-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-22-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-24-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-26-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-28-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-30-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-32-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-34-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-36-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-0-0x000001A9474C0000-0x000001A9479D8000-memory.dmp
memory/3232-2-0x000001A947DA0000-0x000001A947DB0000-memory.dmp
memory/3232-44-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-40-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-46-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-48-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-50-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-52-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-54-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-56-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-60-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-58-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-62-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-64-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-66-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-68-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-70-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-72-0x000001A961F80000-0x000001A962149000-memory.dmp
memory/3232-3761-0x00007FF9C2F50000-0x00007FF9C3A11000-memory.dmp
memory/3232-4127-0x000001A947DA0000-0x000001A947DB0000-memory.dmp
memory/3232-11447-0x000001A947DA0000-0x000001A947DB0000-memory.dmp
memory/3232-11448-0x000001A947DA0000-0x000001A947DB0000-memory.dmp