a47718c57ed25e5c30f0ea7c68952d6aae4ec1f4f0e889d7edae01228334cd14

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 06:01

Target

b7189c8229baecede904e58eff8438c7_JaffaCakes118.exe
Size

420KB
MD5

b7189c8229baecede904e58eff8438c7
SHA1

e3637bd5028b35dddd27fc1f836076cd4ba3eb61
SHA256

a47718c57ed25e5c30f0ea7c68952d6aae4ec1f4f0e889d7edae01228334cd14
SHA512

15587ae65ac51b87ada349b2a4acd8333ac61687cfda1de9846630a3123154a7621398b1d8bbeff511e19b4c0d9b3180010059383c61bf0109388585cdc824f5
SSDEEP

12288:q6/vbcscYE/kaI6mdVHq+dTQT/cHcFZcmD:qGArYEMaI6mdVHRycHgcm

Score

7^/10

Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
agilenet

Processes:

resource yara_rule

behavioral1/memory/2252-7-0x00000000004D0000-0x00000000004DA000-memory.dmp agile_net
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2660 2252 WerFault.exe b7189c8229baecede904e58eff8438c7_JaffaCakes118.exe

resource	yara_rule
behavioral1/memory/2252-7-0x00000000004D0000-0x00000000004DA000-memory.dmp	agile_net

pid	pid_target	process	target process
2660	2252	WerFault.exe	b7189c8229baecede904e58eff8438c7_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

b7189c8229baecede904e58eff8438c7_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2252	b7189c8229baecede904e58eff8438c7_JaffaCakes118.exe
Token: 33	2252	b7189c8229baecede904e58eff8438c7_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2252	b7189c8229baecede904e58eff8438c7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b7189c8229baecede904e58eff8438c7_JaffaCakes118.exe

description	pid	process	target process
PID 2252 wrote to memory of 2660	2252	b7189c8229baecede904e58eff8438c7_JaffaCakes118.exe	WerFault.exe
PID 2252 wrote to memory of 2660	2252	b7189c8229baecede904e58eff8438c7_JaffaCakes118.exe	WerFault.exe
PID 2252 wrote to memory of 2660	2252	b7189c8229baecede904e58eff8438c7_JaffaCakes118.exe	WerFault.exe
PID 2252 wrote to memory of 2660	2252	b7189c8229baecede904e58eff8438c7_JaffaCakes118.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 596
2⤵
- Program crash
PID:2660

memory/2252-0-0x0000000074B3E000-0x0000000074B3F000-memory.dmp

Filesize
4KB

Download
memory/2252-1-0x0000000001360000-0x00000000013D2000-memory.dmp

Filesize
456KB

Download
memory/2252-2-0x0000000000380000-0x00000000003B8000-memory.dmp

Filesize
224KB

Download
memory/2252-3-0x0000000000510000-0x0000000000540000-memory.dmp

Filesize
192KB

Download
memory/2252-4-0x0000000074B30000-0x000000007521E000-memory.dmp

Filesize
6.9MB

Download
memory/2252-5-0x0000000000540000-0x000000000054E000-memory.dmp

Filesize
56KB

Download
memory/2252-6-0x00000000005D0000-0x00000000005D8000-memory.dmp

Filesize
32KB

Download
memory/2252-7-0x00000000004D0000-0x00000000004DA000-memory.dmp

Filesize
40KB

Download
memory/2252-8-0x0000000074B3E000-0x0000000074B3F000-memory.dmp

Filesize
4KB

Download
memory/2252-9-0x0000000074B30000-0x000000007521E000-memory.dmp

Filesize
6.9MB

Download