Analysis
- max time kernel
135s - max time network
106s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
16/05/2024, 16:49
General
- Target 4c16fd554caa65c4004f54e9cf68e6d1_JaffaCakes118.exe
- Size 252KB
- Sample240516-vb61vsec83
- SHA256 a618e2d8cee974b52243f6da4167a85dd1b1ddc49aa5183e1b06f41c4dbc9768
Score
7/10
Malware Config
Signatures
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c16fd554caa65c4004f54e9cf68e6d1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4c16fd554caa65c4004f54e9cf68e6d1_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3572-0-0x00007FF9335B3000-0x00007FF9335B5000-memory.dmp
memory/3572-1-0x000001DDF59F0000-0x000001DDF5A38000-memory.dmp
memory/3572-2-0x00007FF9335B0000-0x00007FF934071000-memory.dmp
memory/3572-3-0x00007FF9335B0000-0x00007FF934071000-memory.dmp