9d254fffd67484a75f0ae733b8bdaa8dace00994f7364935d75d64e1095b1a4d

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_9d254fffd67484a75f0ae733b8bdaa8dace00994f7364935d75d64e1095b1a4d.exe
Size

815.4MB
MD5

59aff648e8cdd4301081ba6564028cae
SHA1

192f4b340bc664083ce43e781121782a5c35ab7b
SHA256

9d254fffd67484a75f0ae733b8bdaa8dace00994f7364935d75d64e1095b1a4d
SHA512

f5c930b119c799cf91181b0657010690fedd8b130f97a186d880e03925d1224de490894a7e3229966cf0169efab07cbdabed79e2e6f74f0953483a8d99cfa789
SSDEEP

98304:ySIerLt7RdlV2WqlSOoixzj+9DXeZcl70uQkKQyr3/Msj:ySIM9XV2FlSXSX+9KZkzKQu/Msj

Score

7^/10

Malware Config

Signatures

.NET Reactor proctector 35 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/2616-1-0x0000000000920000-0x0000000000F26000-memory.dmp	net_reactor
behavioral1/memory/2616-4-0x00000000024C0000-0x000000000254E000-memory.dmp	net_reactor
behavioral1/memory/2616-5-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-6-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-26-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-62-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-8-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-68-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-66-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-64-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-60-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-58-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-56-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-54-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-52-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-50-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-48-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-46-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-44-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-42-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-40-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-38-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-36-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-34-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-32-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-30-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-28-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-24-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-22-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-20-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-18-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-16-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-14-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-12-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor
behavioral1/memory/2616-10-0x00000000024C0000-0x0000000002548000-memory.dmp	net_reactor

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2616	JaffaCakes118_9d254fffd67484a75f0ae733b8bdaa8dace00994f7364935d75d64e1095b1a4d.exe
2616	JaffaCakes118_9d254fffd67484a75f0ae733b8bdaa8dace00994f7364935d75d64e1095b1a4d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2616	JaffaCakes118_9d254fffd67484a75f0ae733b8bdaa8dace00994f7364935d75d64e1095b1a4d.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2456	2616	JaffaCakes118_9d254fffd67484a75f0ae733b8bdaa8dace00994f7364935d75d64e1095b1a4d.exe	30
PID 2616 wrote to memory of 2456	2616	JaffaCakes118_9d254fffd67484a75f0ae733b8bdaa8dace00994f7364935d75d64e1095b1a4d.exe	30
PID 2616 wrote to memory of 2456	2616	JaffaCakes118_9d254fffd67484a75f0ae733b8bdaa8dace00994f7364935d75d64e1095b1a4d.exe	30
PID 2616 wrote to memory of 2456	2616	JaffaCakes118_9d254fffd67484a75f0ae733b8bdaa8dace00994f7364935d75d64e1095b1a4d.exe	30
PID 2616 wrote to memory of 2456	2616	JaffaCakes118_9d254fffd67484a75f0ae733b8bdaa8dace00994f7364935d75d64e1095b1a4d.exe	30
PID 2616 wrote to memory of 2456	2616	JaffaCakes118_9d254fffd67484a75f0ae733b8bdaa8dace00994f7364935d75d64e1095b1a4d.exe	30
PID 2616 wrote to memory of 2456	2616	JaffaCakes118_9d254fffd67484a75f0ae733b8bdaa8dace00994f7364935d75d64e1095b1a4d.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9d254fffd67484a75f0ae733b8bdaa8dace00994f7364935d75d64e1095b1a4d.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9d254fffd67484a75f0ae733b8bdaa8dace00994f7364935d75d64e1095b1a4d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe"
  2⤵
  PID:2456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2616-0-0x000007FEF5B73000-0x000007FEF5B74000-memory.dmp

Filesize
4KB

Download
memory/2616-1-0x0000000000920000-0x0000000000F26000-memory.dmp

Filesize
6.0MB

Download
memory/2616-2-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download
memory/2616-3-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download
memory/2616-4-0x00000000024C0000-0x000000000254E000-memory.dmp

Filesize
568KB

Download
memory/2616-5-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-6-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-26-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-62-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-8-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-68-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-66-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-64-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-60-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-58-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-56-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-54-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-52-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-50-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-48-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-46-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-44-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-42-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-40-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-38-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-36-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-34-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-32-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-30-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-28-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-24-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-22-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-20-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-18-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-16-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-14-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-12-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-10-0x00000000024C0000-0x0000000002548000-memory.dmp

Filesize
544KB

Download
memory/2616-1469-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download
memory/2616-1470-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download