Analysis
-
max time kernel
141s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
17-05-2024 20:02
Behavioral task
behavioral1
Sample
513f18cd4a807a7770a2dd5605c28ce3_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
513f18cd4a807a7770a2dd5605c28ce3_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
513f18cd4a807a7770a2dd5605c28ce3_JaffaCakes118.exe
-
Size
1.0MB
-
MD5
513f18cd4a807a7770a2dd5605c28ce3
-
SHA1
d17614e74c75e6bcfefbc61434e3cffe8fc622ae
-
SHA256
f67fd1318417095c3460f6e8d2796c77c805db6807c3db87836d62dde9da6a3a
-
SHA512
86fbd16a10621d573ad5a76da901c4dff25b245d4c4080abe5f33f0c195928c53d07e3ca6391f52cdd2f609365d7c5e62f8b349b701c69a936b8cf981ef97a73
-
SSDEEP
24576:YQS4p3lrGhylrGht+RVVSLZswB3O4w9WmA8128M:YY3lrGhylrGhwqZRO4um
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
513f18cd4a807a7770a2dd5605c28ce3_JaffaCakes118.exepid process 2036 513f18cd4a807a7770a2dd5605c28ce3_JaffaCakes118.exe -
Obfuscated with Agile.Net obfuscator 4 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/2036-0-0x0000000000400000-0x00000000004DC000-memory.dmp agile_net behavioral1/memory/2036-3-0x0000000000400000-0x0000000000498000-memory.dmp agile_net behavioral1/memory/2036-18-0x0000000002410000-0x0000000002428000-memory.dmp agile_net behavioral1/memory/2036-31-0x0000000000400000-0x00000000004DC000-memory.dmp agile_net
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
121KB
MD53843aa072ded27b8a239b976565dfea8
SHA1e29dc8b174abbd5d7ba7aa587639202330d40bd1
SHA2564dbd79e2b560c256a6e32726de9dffe08fd17fe3733a871a58c3af93c42d0269
SHA5127a7071434aa45ccda5d62d2c71da6a94cd10835a530ed89a229a6c31876ce3e6c3d089c1998f8ea38f0a684eddf3c2c8f17c1f9fc4e7143d8de0f7423ecf843a
-
Filesize
1KB
MD58294f7443966ed83dec91c24545c6038
SHA1cc7494adb2aa98d44ecc202ddbe0445c3b909293
SHA256b48764df100f9ad15b8d0a6a6b43b905c0effe326fd987d3ff90ec0793cf290f
SHA5124bc9c619f85473036ab06ac61b8ff331c71b865b4c33b25b1a71d0f94dc27655e21b5f4472c4c0c4f80d7283a85425b88d60c9d2e3bae970048f5932360a928c