884051874b4ba6a28d2a50586da27bb841dde9ce3c770cc7a3bd239a36f17c54

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 11:22

Target

78fc807a0d0b41a65654733c4b7203c9_JaffaCakes118.exe
Size

1.2MB
MD5

78fc807a0d0b41a65654733c4b7203c9
SHA1

ee9a0f2a0cce28e33336c4987ac31992fbef6751
SHA256

884051874b4ba6a28d2a50586da27bb841dde9ce3c770cc7a3bd239a36f17c54
SHA512

d13348c5bc061dd29ed74335b087c2a932481f38064ec000b39eaee8a9b61c43b6be8bc439515646dc2c99f02a2a7571f8f1f178874e3cd830b4907a851d3843
SSDEEP

12288:RgahAN4aebneohnpATnGKfsJDyfgrcA0V387bt4Z/bX8MkQBt8fA:m2ainjhpQk1LwhUbt4VX8XQBt8I

Score

7^/10

agilenet

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

Processes:

resource	yara_rule
behavioral1/memory/2276-2-0x0000000000360000-0x000000000038C000-memory.dmp	agile_net

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2608	2276	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

78fc807a0d0b41a65654733c4b7203c9_JaffaCakes118.exe

description	pid	Process
Token: SeDebugPrivilege	2276	78fc807a0d0b41a65654733c4b7203c9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

78fc807a0d0b41a65654733c4b7203c9_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2276 wrote to memory of 2608	2276	78fc807a0d0b41a65654733c4b7203c9_JaffaCakes118.exe	28
PID 2276 wrote to memory of 2608	2276	78fc807a0d0b41a65654733c4b7203c9_JaffaCakes118.exe	28
PID 2276 wrote to memory of 2608	2276	78fc807a0d0b41a65654733c4b7203c9_JaffaCakes118.exe	28
PID 2276 wrote to memory of 2608	2276	78fc807a0d0b41a65654733c4b7203c9_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\78fc807a0d0b41a65654733c4b7203c9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\78fc807a0d0b41a65654733c4b7203c9_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 696
  2⤵
  - Program crash
  PID:2608

memory/2276-0-0x0000000073F8E000-0x0000000073F8F000-memory.dmp

Filesize
4KB

Download
memory/2276-1-0x0000000000C80000-0x0000000000DBC000-memory.dmp

Filesize
1.2MB

Download
memory/2276-2-0x0000000000360000-0x000000000038C000-memory.dmp

Filesize
176KB

Download
memory/2276-3-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download
memory/2276-4-0x0000000073F8E000-0x0000000073F8F000-memory.dmp

Filesize
4KB

Download
memory/2276-5-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download