97a0eac447c303f55ce2cc2e7e9bcafa41be1876f874b4f93bdf5c170acdc57b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 05:37

Target

832e8ce5057c9a621999bc8471355ce5_JaffaCakes118.exe
Size

1.0MB
MD5

832e8ce5057c9a621999bc8471355ce5
SHA1

46c1c58cc6f046dbbfb2d1640361e4ee90725f24
SHA256

97a0eac447c303f55ce2cc2e7e9bcafa41be1876f874b4f93bdf5c170acdc57b
SHA512

9b2b86d18623d64be62dbf381e13571baca3276cb9b974bfb197d6a1ba5c5ceaf83fef8a9720765ff47375a78429e012bbd4ef3a6d4fabcbe2669b27ac453b1b
SSDEEP

6144:aD3qBF7/iLCUgqklanGqVbAmW9fu31DMVeu758BrgyH3lpdvCjq+ikhfShWKBBk0:t/iLCUgqCtqZAmWObCKgyXl3yiOqFrY

Score

7^/10

agilenet

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

Processes:

resource	yara_rule
behavioral1/memory/2240-3-0x0000000000280000-0x0000000000292000-memory.dmp	agile_net

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
NTFS ADS 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Users\Admin\AppData\Local\Temp\832e8ce5057c9a621999bc8471355ce5_JaffaCakes118.exe:Zone.Identifier cmd.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

832e8ce5057c9a621999bc8471355ce5_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2240 832e8ce5057c9a621999bc8471355ce5_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\832e8ce5057c9a621999bc8471355ce5_JaffaCakes118.exe:Zone.Identifier	cmd.exe

description	pid	process
Token: SeDebugPrivilege	2240	832e8ce5057c9a621999bc8471355ce5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

832e8ce5057c9a621999bc8471355ce5_JaffaCakes118.exe

description	pid	process	target process
PID 2240 wrote to memory of 2584	2240	832e8ce5057c9a621999bc8471355ce5_JaffaCakes118.exe	cmd.exe
PID 2240 wrote to memory of 2584	2240	832e8ce5057c9a621999bc8471355ce5_JaffaCakes118.exe	cmd.exe
PID 2240 wrote to memory of 2584	2240	832e8ce5057c9a621999bc8471355ce5_JaffaCakes118.exe	cmd.exe
PID 2240 wrote to memory of 2584	2240	832e8ce5057c9a621999bc8471355ce5_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\832e8ce5057c9a621999bc8471355ce5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\832e8ce5057c9a621999bc8471355ce5_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\832e8ce5057c9a621999bc8471355ce5_JaffaCakes118.exe:Zone.Identifier"
  2⤵
  - NTFS ADS
  PID:2584

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2240-0-0x000000007416E000-0x000000007416F000-memory.dmp

Filesize
4KB

Download
memory/2240-1-0x0000000000A30000-0x0000000000B3E000-memory.dmp

Filesize
1.1MB

Download
memory/2240-2-0x0000000074160000-0x000000007484E000-memory.dmp

Filesize
6.9MB

Download
memory/2240-3-0x0000000000280000-0x0000000000292000-memory.dmp

Filesize
72KB

Download
memory/2240-4-0x000000007416E000-0x000000007416F000-memory.dmp

Filesize
4KB

Download
memory/2240-5-0x0000000074160000-0x000000007484E000-memory.dmp

Filesize
6.9MB

Download