Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
16-05-2024 16:49
General
-
Target
4c16fd554caa65c4004f54e9cf68e6d1_JaffaCakes118.exe
-
Size
252KB
-
MD5
4c16fd554caa65c4004f54e9cf68e6d1
-
SHA1
8d332be44287dbcb6a031f2a46d58145d9e7c1a4
-
SHA256
a618e2d8cee974b52243f6da4167a85dd1b1ddc49aa5183e1b06f41c4dbc9768
-
SHA512
142ad9de000c5f61cd8987f53987a2d76a6cf681623ac1964eabc8dbf183665ea149a000f8ae08318d6a788a869a5d9872ab238968a691a6f62639d08f6b73a6
-
SSDEEP
6144:QFQQF842a8JqjT0EA5vW/g4VPfcX0lclJ:yerJUKQV3e
Score
7/10
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c16fd554caa65c4004f54e9cf68e6d1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4c16fd554caa65c4004f54e9cf68e6d1_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1720 -s 9802⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1720-0-0x000007FEF5783000-0x000007FEF5784000-memory.dmpFilesize
4KB
-
memory/1720-1-0x0000000001390000-0x00000000013D8000-memory.dmpFilesize
288KB
-
memory/1720-2-0x000007FEF5780000-0x000007FEF616C000-memory.dmpFilesize
9.9MB
-
memory/1720-3-0x000007FEF5783000-0x000007FEF5784000-memory.dmpFilesize
4KB
-
memory/1720-4-0x000007FEF5780000-0x000007FEF616C000-memory.dmpFilesize
9.9MB