Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
03-06-2024 03:07
General
-
Target
90586adc594f5538f77435e0eed7416b_JaffaCakes118.exe
-
Size
741KB
-
MD5
90586adc594f5538f77435e0eed7416b
-
SHA1
747101e81f44e4e8deefbc890d72ac5675870fd0
-
SHA256
4e817e42923d89ab7b1e019b2eea134bd151dfe75c8304c821694d94bc1d9f9e
-
SHA512
6eaf208b000945c88c346a38547ce82f27cd94ec1a8a07f617550bbd6bdd127e5fa4cbb17a5ad71fc7418210244a048da70dc04f31126d5ed7e4409813b4ada9
-
SSDEEP
12288:0FYRxseoQDTZBCabOAomhzB6XReRbZy2j7F3X6s7USMPjpMpXh:0+O6Tv3pXrNZ71HNIXLeZh
Score
7/10
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\90586adc594f5538f77435e0eed7416b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\90586adc594f5538f77435e0eed7416b_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2148-0-0x0000000073F8E000-0x0000000073F8F000-memory.dmpFilesize
4KB
-
memory/2148-1-0x0000000000E50000-0x0000000000F14000-memory.dmpFilesize
784KB
-
memory/2148-2-0x0000000006ED0000-0x0000000007008000-memory.dmpFilesize
1.2MB
-
memory/2148-4-0x0000000073F80000-0x000000007466E000-memory.dmpFilesize
6.9MB
-
memory/2148-3-0x00000000002D0000-0x00000000002F8000-memory.dmpFilesize
160KB
-
memory/2148-5-0x0000000073F80000-0x000000007466E000-memory.dmpFilesize
6.9MB