Analysis
-
max time kernel
135s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
03-06-2024 03:07
General
-
Target
90586adc594f5538f77435e0eed7416b_JaffaCakes118.exe
-
Size
741KB
-
MD5
90586adc594f5538f77435e0eed7416b
-
SHA1
747101e81f44e4e8deefbc890d72ac5675870fd0
-
SHA256
4e817e42923d89ab7b1e019b2eea134bd151dfe75c8304c821694d94bc1d9f9e
-
SHA512
6eaf208b000945c88c346a38547ce82f27cd94ec1a8a07f617550bbd6bdd127e5fa4cbb17a5ad71fc7418210244a048da70dc04f31126d5ed7e4409813b4ada9
-
SSDEEP
12288:0FYRxseoQDTZBCabOAomhzB6XReRbZy2j7F3X6s7USMPjpMpXh:0+O6Tv3pXrNZ71HNIXLeZh
Score
7/10
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\90586adc594f5538f77435e0eed7416b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\90586adc594f5538f77435e0eed7416b_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4820-0-0x000000007463E000-0x000000007463F000-memory.dmpFilesize
4KB
-
memory/4820-1-0x0000000000820000-0x00000000008E4000-memory.dmpFilesize
784KB
-
memory/4820-2-0x0000000007720000-0x0000000007858000-memory.dmpFilesize
1.2MB
-
memory/4820-3-0x0000000007860000-0x0000000007888000-memory.dmpFilesize
160KB
-
memory/4820-4-0x0000000074630000-0x0000000074DE0000-memory.dmpFilesize
7.7MB
-
memory/4820-5-0x0000000007E40000-0x00000000083E4000-memory.dmpFilesize
5.6MB
-
memory/4820-6-0x0000000007970000-0x0000000007A02000-memory.dmpFilesize
584KB
-
memory/4820-8-0x0000000074630000-0x0000000074DE0000-memory.dmpFilesize
7.7MB