379f4c57ae3a0643b260d8cf97a2b7aeea4b00903d4fee346cfed36d60b06651

General

Target

4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe
Size

9.1MB
MD5

4a900f2aa71746ea06b562a2af8bcd1c
SHA1

58eabb8a1e9c57cbff797ead0d64fff4600765c0
SHA256

379f4c57ae3a0643b260d8cf97a2b7aeea4b00903d4fee346cfed36d60b06651
SHA512

00080d464f7c21b48a104f4ea2500969f16e31a216ede5553597b959e97254f98951daa60f4625cf238ca0995309b74fdbc6f66b2ca1c1977f91048a9d2888e9
SSDEEP

196608:auhsIrbKdj7G6Re1WQkY1XEUkQmajXnlU0PHkHOjCBpOIVERR:aSbKLerk63VnLnlUC22CJE

Score

7^/10

agilenet

Malware Config

Signatures

Obfuscated with Agile.Net obfuscator 4 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/1740-8-0x0000000000060000-0x00000000014CA000-memory.dmp	agile_net
behavioral1/memory/1740-9-0x0000000000060000-0x00000000014CA000-memory.dmp	agile_net
behavioral1/memory/1740-17-0x0000000000060000-0x00000000014CA000-memory.dmp	agile_net
behavioral1/memory/1740-34-0x0000000000060000-0x00000000014CA000-memory.dmp	agile_net

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe

pid process

1740 4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2684 1740 WerFault.exe 4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 1740 4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe

pid process

1740 4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe

pid	process
1740	4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe

pid	pid_target	process	target process
2684	1740	WerFault.exe	4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1740	4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe

pid	process
1740	4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe

description	pid	process	target process
PID 1740 wrote to memory of 2684	1740	4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe	WerFault.exe
PID 1740 wrote to memory of 2684	1740	4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe	WerFault.exe
PID 1740 wrote to memory of 2684	1740	4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe	WerFault.exe
PID 1740 wrote to memory of 2684	1740	4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 1408
2⤵
- Program crash
PID:2684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1740-0-0x0000000000060000-0x00000000014CA000-memory.dmp

Filesize
20.4MB

Download
memory/1740-1-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/1740-2-0x00000000774F0000-0x00000000774F1000-memory.dmp

Filesize
4KB

Download
memory/1740-4-0x000000007EBB0000-0x000000007EBB1000-memory.dmp

Filesize
4KB

Download
memory/1740-3-0x000000007EBC0000-0x000000007EBC1000-memory.dmp

Filesize
4KB

Download
memory/1740-5-0x000000007EBC0000-0x000000007EBC1000-memory.dmp

Filesize
4KB

Download
memory/1740-6-0x000000007EBB0000-0x000000007EBB1000-memory.dmp

Filesize
4KB

Download
memory/1740-7-0x00000000743EE000-0x00000000743EF000-memory.dmp

Filesize
4KB

Download
memory/1740-8-0x0000000000060000-0x00000000014CA000-memory.dmp

Filesize
20.4MB

Download
memory/1740-9-0x0000000000060000-0x00000000014CA000-memory.dmp

Filesize
20.4MB

Download
memory/1740-12-0x0000000010000000-0x00000000100BE000-memory.dmp

Filesize
760KB

Download
memory/1740-16-0x0000000001CD0000-0x0000000001CE0000-memory.dmp

Filesize
64KB

Download
memory/1740-17-0x0000000000060000-0x00000000014CA000-memory.dmp

Filesize
20.4MB

Download
memory/1740-18-0x0000000010000000-0x00000000100BE000-memory.dmp

Filesize
760KB

Download
memory/1740-19-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download
memory/1740-20-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download
memory/1740-21-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download
memory/1740-22-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download
memory/1740-23-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download
memory/1740-24-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download
memory/1740-25-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download
memory/1740-26-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download
memory/1740-27-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download
memory/1740-28-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download
memory/1740-29-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download
memory/1740-30-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download
memory/1740-33-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/1740-35-0x0000000010000000-0x00000000100BE000-memory.dmp

Filesize
760KB

Download
memory/1740-34-0x0000000000060000-0x00000000014CA000-memory.dmp

Filesize
20.4MB

Download
memory/1740-38-0x00000000743EE000-0x00000000743EF000-memory.dmp

Filesize
4KB

Download
memory/1740-39-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing