Analysis
-
max time kernel
143s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 21:09
Behavioral task
behavioral1
Sample
2bb73d090c181abfe7b8b26d740630f5_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2bb73d090c181abfe7b8b26d740630f5_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
2bb73d090c181abfe7b8b26d740630f5_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
2bb73d090c181abfe7b8b26d740630f5
-
SHA1
a5b60cb4a77a7ba556e4f7538fd6aae748aa4be3
-
SHA256
3074052eeaec43a07f07188d572ddff1e3abccf687d42d6dd69265b52f0cd5b1
-
SHA512
831520da01bee6e480b16b2741e45a0b0846425898683837fefd652c1da60a4c600313101415586c00ad418f8a470a3af0038d7cae7ec11f4e2db1419c2d081a
-
SSDEEP
24576:DpRqBoB2aRP2mDu6SYZGYO3lYeTqOxt6Z4IRF+ZlFi9X6w78nwP99qBQ9PnU:DpEBzaRJulQPfPn
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
2bb73d090c181abfe7b8b26d740630f5_JaffaCakes118.exepid process 4152 2bb73d090c181abfe7b8b26d740630f5_JaffaCakes118.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/4152-1-0x0000000000320000-0x000000000048C000-memory.dmp agile_net -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
2bb73d090c181abfe7b8b26d740630f5_JaffaCakes118.exepid process 4152 2bb73d090c181abfe7b8b26d740630f5_JaffaCakes118.exe 4152 2bb73d090c181abfe7b8b26d740630f5_JaffaCakes118.exe 4152 2bb73d090c181abfe7b8b26d740630f5_JaffaCakes118.exe 4152 2bb73d090c181abfe7b8b26d740630f5_JaffaCakes118.exe 4152 2bb73d090c181abfe7b8b26d740630f5_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2bb73d090c181abfe7b8b26d740630f5_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 4152 2bb73d090c181abfe7b8b26d740630f5_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
2bb73d090c181abfe7b8b26d740630f5_JaffaCakes118.exepid process 4152 2bb73d090c181abfe7b8b26d740630f5_JaffaCakes118.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
2bb73d090c181abfe7b8b26d740630f5_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations 2bb73d090c181abfe7b8b26d740630f5_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations\LowRiskFileTypes = ".exe;.bat;.cmd;.vbs" 2bb73d090c181abfe7b8b26d740630f5_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bb73d090c181abfe7b8b26d740630f5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2bb73d090c181abfe7b8b26d740630f5_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\fa32f865-d1ad-4d9d-bcfc-27e4a6aeec49\AgileDotNetRT.dllFilesize
94KB
MD514ff402962ad21b78ae0b4c43cd1f194
SHA1f8a510eb26666e875a5bdd1cadad40602763ad72
SHA256fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b
SHA512daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b
-
memory/4152-12-0x0000000073040000-0x00000000730C9000-memory.dmpFilesize
548KB
-
memory/4152-2-0x0000000074630000-0x0000000074DE0000-memory.dmpFilesize
7.7MB
-
memory/4152-3-0x0000000005450000-0x00000000059F4000-memory.dmpFilesize
5.6MB
-
memory/4152-4-0x0000000004EA0000-0x0000000004F32000-memory.dmpFilesize
584KB
-
memory/4152-1-0x0000000000320000-0x000000000048C000-memory.dmpFilesize
1.4MB
-
memory/4152-0-0x000000007463E000-0x000000007463F000-memory.dmpFilesize
4KB
-
memory/4152-13-0x0000000005080000-0x000000000508A000-memory.dmpFilesize
40KB
-
memory/4152-14-0x0000000005420000-0x000000000543C000-memory.dmpFilesize
112KB
-
memory/4152-15-0x0000000074630000-0x0000000074DE0000-memory.dmpFilesize
7.7MB
-
memory/4152-16-0x0000000074630000-0x0000000074DE0000-memory.dmpFilesize
7.7MB
-
memory/4152-17-0x000000007463E000-0x000000007463F000-memory.dmpFilesize
4KB
-
memory/4152-18-0x0000000074630000-0x0000000074DE0000-memory.dmpFilesize
7.7MB