e171ce5be2a6e71879cbb28bc17a8e126a24c337cf12df618d9758be4c639a20

General

Target

3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe
Size

1.6MB
MD5

3707242f769e33f3e7f8c2b1e1652264
SHA1

54343df95d5535f5f5b43639d160d1d9c01847b6
SHA256

e171ce5be2a6e71879cbb28bc17a8e126a24c337cf12df618d9758be4c639a20
SHA512

4975879955925a54d566a6bdec03d55f1c87a173aac5772a0d85eb1c73185db1f15e0c8df7b87bc8867646dfe591a042431dce492b7d214061bbaefbd05b9ee1
SSDEEP

24576:BTRUglhhRkHF2roxCcmocwHx9iIOHixnVMtwYNSZGL:vUgZCkroJ3cMuRCxn

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe

description	pid	process	target process
PID 1716 set thread context of 2600	1716	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe

pid process

1716 3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 1716 3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe

pid	process
1716	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1716	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe

description	pid	process	target process
PID 1716 wrote to memory of 2548	1716	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe
PID 1716 wrote to memory of 2548	1716	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe
PID 1716 wrote to memory of 2548	1716	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe
PID 1716 wrote to memory of 2548	1716	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe
PID 1716 wrote to memory of 2600	1716	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe
PID 1716 wrote to memory of 2600	1716	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe
PID 1716 wrote to memory of 2600	1716	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe
PID 1716 wrote to memory of 2600	1716	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe
PID 1716 wrote to memory of 2600	1716	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe
PID 1716 wrote to memory of 2600	1716	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe
PID 1716 wrote to memory of 2600	1716	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe
PID 1716 wrote to memory of 2600	1716	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe
PID 1716 wrote to memory of 2600	1716	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe	3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716

C:\Users\Admin\AppData\Local\Temp\3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe
"{path}"
2⤵
PID:2548

C:\Users\Admin\AppData\Local\Temp\3707242f769e33f3e7f8c2b1e1652264_JaffaCakes118.exe
"{path}"
2⤵
PID:2600

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1716-20-0x0000000074B90000-0x000000007527E000-memory.dmp

Filesize
6.9MB

Download
memory/1716-4-0x0000000074B90000-0x000000007527E000-memory.dmp

Filesize
6.9MB

Download
memory/1716-0-0x0000000000B20000-0x0000000000CC2000-memory.dmp

Filesize
1.6MB

Download
memory/1716-3-0x0000000000340000-0x0000000000354000-memory.dmp

Filesize
80KB

Download
memory/1716-1-0x0000000074B90000-0x000000007527E000-memory.dmp

Filesize
6.9MB

Download
memory/1716-5-0x00000000049C0000-0x0000000004A00000-memory.dmp

Filesize
256KB

Download
memory/1716-6-0x0000000005FE0000-0x00000000060FE000-memory.dmp

Filesize
1.1MB

Download
memory/1716-7-0x0000000005570000-0x0000000005668000-memory.dmp

Filesize
992KB

Download
memory/1716-2-0x00000000049C0000-0x0000000004A00000-memory.dmp

Filesize
256KB

Download
memory/2600-10-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/2600-8-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/2600-12-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/2600-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2600-17-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/2600-19-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/2600-13-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/2600-22-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/2600-23-0x00000000744A0000-0x0000000074B8E000-memory.dmp

Filesize
6.9MB

Download
memory/2600-24-0x0000000004EA0000-0x0000000004EE0000-memory.dmp

Filesize
256KB

Download
memory/2600-25-0x0000000000620000-0x000000000062A000-memory.dmp

Filesize
40KB

Download
memory/2600-26-0x00000000744A0000-0x0000000074B8E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing