785872bbef35d86fe6ce8a53be29995cfd0f251d2a171145bd6685bebe63ebc8

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 04:54

Target

74622fbc3aae349b7771709444183314_JaffaCakes118.exe
Size

143KB
MD5

74622fbc3aae349b7771709444183314
SHA1

9dcada7455205b44b5fe69f765caecca4f14403c
SHA256

785872bbef35d86fe6ce8a53be29995cfd0f251d2a171145bd6685bebe63ebc8
SHA512

bd99850093c58cc9c4f59747b1718a04b8000f890f61cc7ad94d87677a69c353992514db5f53ac1cb967d37443c23910abb64a1867861026b9330df84d8f057c
SSDEEP

3072:G4CRQsybVqJBnmTQekycmL8nf19wNe2FzWW/IgQJi/u/p:G4COv8XmTjkLm8nfsxF7wjim

Score

7^/10

agilenet

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

Processes:

resource	yara_rule
behavioral1/memory/1304-2-0x00000000003B0000-0x00000000003D8000-memory.dmp	agile_net

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

74622fbc3aae349b7771709444183314_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 1304 74622fbc3aae349b7771709444183314_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1304	74622fbc3aae349b7771709444183314_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\74622fbc3aae349b7771709444183314_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\74622fbc3aae349b7771709444183314_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1304

memory/1304-0-0x00000000749DE000-0x00000000749DF000-memory.dmp

Filesize
4KB

Download
memory/1304-1-0x0000000000380000-0x00000000003AA000-memory.dmp

Filesize
168KB

Download
memory/1304-2-0x00000000003B0000-0x00000000003D8000-memory.dmp

Filesize
160KB

Download
memory/1304-3-0x00000000749D0000-0x00000000750BE000-memory.dmp

Filesize
6.9MB

Download