Analysis
-
max time kernel
139s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
10-05-2024 05:59
General
-
Target
2dafed2d8919d3f2081327eed37b28e6_JaffaCakes118.exe
-
Size
743KB
-
MD5
2dafed2d8919d3f2081327eed37b28e6
-
SHA1
635290d8a7a9c522045b7cdbad14c9c228f36523
-
SHA256
6a0712ac14ace1977933ffcfa1ed35283aea2c6cf78161a78d25f84d90f9c816
-
SHA512
307becd9679ee76175a7ad8e7ba4ab1609a4dc9912c6a8fe563f665fb92f2e69f7301896d8762fa588144b41e6e5111950d435709259b3f2a1511c204e6f114f
-
SSDEEP
12288:Y9twMz8CcvDNqBTdilufZnEM8A5Nm2INpE3q9EDWQr/Xq+3aaqyi3f:qnI5qKlu+Mjg2sE3qYNTXq+3rQ
Score
10/10
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2dafed2d8919d3f2081327eed37b28e6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2dafed2d8919d3f2081327eed37b28e6_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
784KB
-
Filesize
1.2MB
-
Filesize
160KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
7.7MB