Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
25-05-2024 05:41
General
-
Target
7102d59c864fe9a460ca83bfcf43e769_JaffaCakes118.exe
-
Size
807KB
-
MD5
7102d59c864fe9a460ca83bfcf43e769
-
SHA1
ee1f370bbc8b334a91aae31d8a08b26e10ccc092
-
SHA256
8e65edcc4c3da34f59ca1339f4d54c4547c05d58bbb8db44a997b9272d0407ae
-
SHA512
cfe1ac944e7732a21c8128e13667a1bc07f35a7b6864aecd58b6fbb074eda515da7a226d330ba262544a6c92b5ab32e9b82a16cdc6b0007424b0301fecdb67de
-
SSDEEP
12288:8sj0OuyoKkHNa7yeCsRR9U8RpKPZBW32XJ4Mj+fMgE7ISW5hyXionjq2iNlZnA34:XUeMvwo2CEL31/+c46yW
Score
7/10
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7102d59c864fe9a460ca83bfcf43e769_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7102d59c864fe9a460ca83bfcf43e769_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2180-0-0x0000000074A0E000-0x0000000074A0F000-memory.dmpFilesize
4KB
-
memory/2180-1-0x0000000000C90000-0x0000000000D60000-memory.dmpFilesize
832KB
-
memory/2180-2-0x0000000000310000-0x000000000032A000-memory.dmpFilesize
104KB
-
memory/2180-3-0x0000000074A00000-0x00000000750EE000-memory.dmpFilesize
6.9MB
-
memory/2180-4-0x0000000074A00000-0x00000000750EE000-memory.dmpFilesize
6.9MB
-
memory/2180-5-0x0000000074A0E000-0x0000000074A0F000-memory.dmpFilesize
4KB
-
memory/2180-6-0x0000000074A00000-0x00000000750EE000-memory.dmpFilesize
6.9MB