379f4c57ae3a0643b260d8cf97a2b7aeea4b00903d4fee346cfed36d60b06651

General

Target

4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe
Size

9.1MB
MD5

4a900f2aa71746ea06b562a2af8bcd1c
SHA1

58eabb8a1e9c57cbff797ead0d64fff4600765c0
SHA256

379f4c57ae3a0643b260d8cf97a2b7aeea4b00903d4fee346cfed36d60b06651
SHA512

00080d464f7c21b48a104f4ea2500969f16e31a216ede5553597b959e97254f98951daa60f4625cf238ca0995309b74fdbc6f66b2ca1c1977f91048a9d2888e9
SSDEEP

196608:auhsIrbKdj7G6Re1WQkY1XEUkQmajXnlU0PHkHOjCBpOIVERR:aSbKLerk63VnLnlUC22CJE

Score

7^/10

agilenet

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe

pid process

3164 4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe

pid	process
3164	4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe

Obfuscated with Agile.Net obfuscator 5 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/3164-9-0x0000000000F20000-0x000000000238A000-memory.dmp	agile_net
behavioral2/memory/3164-10-0x0000000000F20000-0x000000000238A000-memory.dmp	agile_net
behavioral2/memory/3164-19-0x0000000000F20000-0x000000000238A000-memory.dmp	agile_net
behavioral2/memory/3164-34-0x0000000000F20000-0x000000000238A000-memory.dmp	agile_net
behavioral2/memory/3164-36-0x0000000000F20000-0x000000000238A000-memory.dmp	agile_net

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe

pid process

3164 4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe
3164 4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3080 3164 WerFault.exe 4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 3164 4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe

pid process

3164 4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe

pid	process
3164	4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe
3164	4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe

pid	pid_target	process	target process
3080	3164	WerFault.exe	4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	3164	4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe

pid	process
3164	4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 2168
2⤵
- Program crash
PID:3080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3164 -ip 3164
1⤵
PID:1144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\evb70AD.tmp
Filesize
1KB

MD5
7eea1b45d6f5cfb7d8211293fdb0b953

SHA1
7f2ab34af34a5423b734f8a94e5b61c4cb774805

SHA256
67b843fe0401061f447b9f76078f31b5517aab89e1712922736fdc6bcd8507b3

SHA512
f3ae3ef31c41a685ec52ff9323ba504d86901a30a759b7f6e1acf3d7576ee8f4361598b380f47e08a9ca4bdee360a6e4e2ef53a82b6d80550c98f051dd4ce248

Download Submit
memory/3164-21-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download
memory/3164-38-0x000000007F8C0000-0x000000007FC91000-memory.dmp

Filesize
3.8MB

Download
memory/3164-20-0x0000000005890000-0x00000000058A0000-memory.dmp

Filesize
64KB

Download
memory/3164-5-0x000000007F8B0000-0x000000007F8B1000-memory.dmp

Filesize
4KB

Download
memory/3164-4-0x000000007F8A0000-0x000000007F8A1000-memory.dmp

Filesize
4KB

Download
memory/3164-7-0x000000007F8A0000-0x000000007F8A1000-memory.dmp

Filesize
4KB

Download
memory/3164-6-0x000000007F8B0000-0x000000007F8B1000-memory.dmp

Filesize
4KB

Download
memory/3164-8-0x00000000746FE000-0x00000000746FF000-memory.dmp

Filesize
4KB

Download
memory/3164-9-0x0000000000F20000-0x000000000238A000-memory.dmp

Filesize
20.4MB

Download
memory/3164-10-0x0000000000F20000-0x000000000238A000-memory.dmp

Filesize
20.4MB

Download
memory/3164-2-0x00000000779B3000-0x00000000779B4000-memory.dmp

Filesize
4KB

Download
memory/3164-14-0x0000000010000000-0x00000000100BE000-memory.dmp

Filesize
760KB

Download
memory/3164-18-0x0000000010000000-0x00000000100BE000-memory.dmp

Filesize
760KB

Download
memory/3164-19-0x0000000000F20000-0x000000000238A000-memory.dmp

Filesize
20.4MB

Download
memory/3164-3-0x000000007F8C0000-0x000000007FC91000-memory.dmp

Filesize
3.8MB

Download
memory/3164-22-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download
memory/3164-1-0x00000000779B2000-0x00000000779B3000-memory.dmp

Filesize
4KB

Download
memory/3164-23-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download
memory/3164-24-0x000000000AC80000-0x000000000AD1C000-memory.dmp

Filesize
624KB

Download
memory/3164-25-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download
memory/3164-26-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download
memory/3164-27-0x000000000B2D0000-0x000000000B874000-memory.dmp

Filesize
5.6MB

Download
memory/3164-28-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download
memory/3164-29-0x000000000AD20000-0x000000000ADB2000-memory.dmp

Filesize
584KB

Download
memory/3164-30-0x00000000057C0000-0x00000000057CA000-memory.dmp

Filesize
40KB

Download
memory/3164-31-0x0000000008260000-0x00000000082B6000-memory.dmp

Filesize
344KB

Download
memory/3164-35-0x0000000010000000-0x00000000100BE000-memory.dmp

Filesize
760KB

Download
memory/3164-34-0x0000000000F20000-0x000000000238A000-memory.dmp

Filesize
20.4MB

Download
memory/3164-36-0x0000000000F20000-0x000000000238A000-memory.dmp

Filesize
20.4MB

Download
memory/3164-39-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download
memory/3164-0-0x0000000000F20000-0x000000000238A000-memory.dmp

Filesize
20.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads