Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
05-05-2024 16:49
General
-
Target
18882465f8b6e72a46669d4aa2e78cb1_JaffaCakes118.exe
-
Size
424KB
-
MD5
18882465f8b6e72a46669d4aa2e78cb1
-
SHA1
b05a070b6c3fec5330d1413594a4b17b19099a02
-
SHA256
6e521645df736e76b57cdf6996cee4a5148e649cee75be8f36ccfb008f047fa6
-
SHA512
388e34cfc7a43a062e0c389611036b7953a99d4def7699852d875c2fcdc7c6a79205d85fa128aae9d48d9c37888d60611390640086a7e7a3e4b0e38173964e44
-
SSDEEP
6144:6N9JYSDAzaiTCXkJNlMgpV5Nj3QmlsPt5GM/x1lPWojLWYM+6LpfeR14Kn3r/u/t:67RAzTukj/Nj5OlzW3ppWbhn3TcWId
Score
7/10
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\18882465f8b6e72a46669d4aa2e78cb1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\18882465f8b6e72a46669d4aa2e78cb1_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2028-0-0x00000000745EE000-0x00000000745EF000-memory.dmpFilesize
4KB
-
memory/2028-1-0x0000000000DD0000-0x0000000000E40000-memory.dmpFilesize
448KB
-
memory/2028-2-0x00000000745E0000-0x0000000074CCE000-memory.dmpFilesize
6.9MB
-
memory/2028-3-0x00000000004D0000-0x00000000004E4000-memory.dmpFilesize
80KB
-
memory/2028-4-0x00000000745E0000-0x0000000074CCE000-memory.dmpFilesize
6.9MB