Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
26-05-2024 04:54
General
-
Target
74622fbc3aae349b7771709444183314_JaffaCakes118.exe
-
Size
143KB
-
MD5
74622fbc3aae349b7771709444183314
-
SHA1
9dcada7455205b44b5fe69f765caecca4f14403c
-
SHA256
785872bbef35d86fe6ce8a53be29995cfd0f251d2a171145bd6685bebe63ebc8
-
SHA512
bd99850093c58cc9c4f59747b1718a04b8000f890f61cc7ad94d87677a69c353992514db5f53ac1cb967d37443c23910abb64a1867861026b9330df84d8f057c
-
SSDEEP
3072:G4CRQsybVqJBnmTQekycmL8nf19wNe2FzWW/IgQJi/u/p:G4COv8XmTjkLm8nfsxF7wjim
Score
7/10
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\74622fbc3aae349b7771709444183314_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\74622fbc3aae349b7771709444183314_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1316-0-0x00000000753BE000-0x00000000753BF000-memory.dmpFilesize
4KB
-
memory/1316-1-0x0000000000B30000-0x0000000000B5A000-memory.dmpFilesize
168KB
-
memory/1316-2-0x0000000005470000-0x0000000005498000-memory.dmpFilesize
160KB
-
memory/1316-3-0x0000000005CA0000-0x0000000006244000-memory.dmpFilesize
5.6MB
-
memory/1316-4-0x0000000005620000-0x00000000056B2000-memory.dmpFilesize
584KB
-
memory/1316-6-0x00000000753B0000-0x0000000075B60000-memory.dmpFilesize
7.7MB
-
memory/1316-7-0x00000000753B0000-0x0000000075B60000-memory.dmpFilesize
7.7MB