1736d604d6c8a14948ebe5386727ca3de215e1163904eac094b39769b8faea64

General

Target

25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
Size

850KB
MD5

25fef2629b1a28be76522da59a85506f
SHA1

e1c6b2ac497f253cb03aa69505111532b4241a38
SHA256

1736d604d6c8a14948ebe5386727ca3de215e1163904eac094b39769b8faea64
SHA512

8656b9393d45dda010013825238b8254404b89316511b66877f78ad5b61008cb4d50e48e749cb646ada5891299b85dd7342336b4024e034865cfa07d47e08617
SSDEEP

12288:j6qvGvd8EgWCKXtWxWT56LbdJ0Ua0c1xHVkPyjRIBTK+jUOq6fgJg0Ges/5rBY6:hvGvd8HK9hwLbdJp6/kIo7f

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe

pid	process
2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2988 25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988

C:\Users\Admin\AppData\Local\Temp\25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe"
2⤵
PID:2484

C:\Users\Admin\AppData\Local\Temp\25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe"
2⤵
PID:2520

C:\Users\Admin\AppData\Local\Temp\25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe"
2⤵
PID:2480

C:\Users\Admin\AppData\Local\Temp\25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe"
2⤵
PID:2576

C:\Users\Admin\AppData\Local\Temp\25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe"
2⤵
PID:2592

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2988-1-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2988-0-0x0000000000290000-0x000000000036C000-memory.dmp

Filesize
880KB

Download
memory/2988-2-0x0000000000410000-0x0000000000416000-memory.dmp

Filesize
24KB

Download
memory/2988-3-0x0000000004260000-0x00000000042A0000-memory.dmp

Filesize
256KB

Download
memory/2988-4-0x0000000000440000-0x000000000044A000-memory.dmp

Filesize
40KB

Download
memory/2988-5-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 2988 wrote to memory of 2484	2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
PID 2988 wrote to memory of 2484	2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
PID 2988 wrote to memory of 2484	2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
PID 2988 wrote to memory of 2484	2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
PID 2988 wrote to memory of 2520	2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
PID 2988 wrote to memory of 2520	2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
PID 2988 wrote to memory of 2520	2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
PID 2988 wrote to memory of 2520	2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
PID 2988 wrote to memory of 2480	2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
PID 2988 wrote to memory of 2480	2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
PID 2988 wrote to memory of 2480	2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
PID 2988 wrote to memory of 2480	2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
PID 2988 wrote to memory of 2576	2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
PID 2988 wrote to memory of 2576	2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
PID 2988 wrote to memory of 2576	2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
PID 2988 wrote to memory of 2576	2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
PID 2988 wrote to memory of 2592	2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
PID 2988 wrote to memory of 2592	2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
PID 2988 wrote to memory of 2592	2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe
PID 2988 wrote to memory of 2592	2988	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe	25fef2629b1a28be76522da59a85506f_JaffaCakes118.exe

Analysis

Sharing