Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
26-06-2024 18:43
General
-
Target
1304e64e621f0b294ba3f5f0e0d73104_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
1304e64e621f0b294ba3f5f0e0d73104
-
SHA1
4591af4dd8c9168694e6950660a13cad8475ed13
-
SHA256
ec688f1bd6009052e85d82ebf431cb352bb52e6577e879a0d558d5c8819c84e7
-
SHA512
9707e40bd917c65bb05d8d61e1f45a9bcfd763031fb6bacfa55739e54e7f6d25f655a6b133f25793f4328be5f8f80d347cfeab62229a5ac02d301550ba95c71c
-
SSDEEP
12288:3ADP+oKGIcHxyT1CbKOPGvbfmRqxUYnSAjSze0Qb4WpknSAjSze0jb4W/:QDP+oZIcHxW1CtPSbfakSUo7QySUo7j
Score
7/10
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 3 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1304e64e621f0b294ba3f5f0e0d73104_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1304e64e621f0b294ba3f5f0e0d73104_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1492-0-0x0000000000850000-0x000000000096A000-memory.dmpFilesize
1.1MB
-
memory/1492-1-0x0000000000D10000-0x0000000000DB2000-memory.dmpFilesize
648KB
-
memory/1492-2-0x0000000005040000-0x00000000050E2000-memory.dmpFilesize
648KB
-
memory/1492-3-0x0000000000C90000-0x0000000000CBE000-memory.dmpFilesize
184KB
-
memory/1492-4-0x00000000050F0000-0x0000000005130000-memory.dmpFilesize
256KB
-
memory/1492-5-0x00000000050F0000-0x0000000005130000-memory.dmpFilesize
256KB