Analysis
- max time kernel
66s - max time network
55s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
30/04/2024, 14:53
General
- Target 09fff56e224edb4185180ea67556b454_JaffaCakes118.exe
- Size 430KB
- Sample240430-r9jfnsbb99
- SHA256 ff948942d51c6d63c952d82d2c936e7872c60d4b8a7da30c9868ab2a93b6aeed
Malware Config
Signatures
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\09fff56e224edb4185180ea67556b454_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\09fff56e224edb4185180ea67556b454_JaffaCakes118.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 13522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5020 -ip 50201⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5020-0-0x0000000000800000-0x0000000000872000-memory.dmp
memory/5020-1-0x00000000749D0000-0x0000000075180000-memory.dmp
memory/5020-2-0x0000000000EF0000-0x0000000000EF6000-memory.dmp
memory/5020-3-0x0000000005210000-0x0000000005220000-memory.dmp
memory/5020-4-0x0000000009D50000-0x000000000A2F4000-memory.dmp
memory/5020-5-0x00000000053C0000-0x0000000005452000-memory.dmp
memory/5020-6-0x0000000005380000-0x000000000538A000-memory.dmp
memory/5020-7-0x00000000055D0000-0x0000000005636000-memory.dmp
memory/5020-8-0x0000000006180000-0x00000000061E6000-memory.dmp
memory/5020-9-0x00000000057F0000-0x0000000005806000-memory.dmp
memory/5020-10-0x00000000749D0000-0x0000000075180000-memory.dmp