2ea1b409e3d1ad15c00c530f2b8e80ab58b116fe259b70882df8613a1cba9ca1

General

Target

3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
Size

532KB
MD5

3cfe56e2909d9f61a0c4c2445c6f009a
SHA1

966650bdb4960b649aa7aaf3e3f9cbe80dc88321
SHA256

2ea1b409e3d1ad15c00c530f2b8e80ab58b116fe259b70882df8613a1cba9ca1
SHA512

b94b673fd340e9557479d05475a175881cddac4a1a7f03e285f76d93e2b7a44b3d4d6b5a51c4b8ccaf4aa683052ee623a0891faf0c35c195b7de054406e3e8bd
SSDEEP

12288:yzU1rExJeAkH8+/S8zNrRSBZQpFBm4gNvV:yzU1rExoQ8S8RABZeml

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe

pid	process
3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 3048 3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048

C:\Users\Admin\AppData\Local\Temp\3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe"
2⤵
PID:2668

C:\Users\Admin\AppData\Local\Temp\3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe"
2⤵
PID:1056

C:\Users\Admin\AppData\Local\Temp\3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe"
2⤵
PID:2880

C:\Users\Admin\AppData\Local\Temp\3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe"
2⤵
PID:2496

C:\Users\Admin\AppData\Local\Temp\3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe"
2⤵
PID:2288

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3048-3-0x0000000001EE0000-0x0000000001EEA000-memory.dmp

Filesize
40KB

Download
memory/3048-2-0x0000000004E80000-0x0000000004EC0000-memory.dmp

Filesize
256KB

Download
memory/3048-1-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/3048-0-0x00000000003F0000-0x000000000047A000-memory.dmp

Filesize
552KB

Download
memory/3048-4-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/3048-5-0x0000000004E80000-0x0000000004EC0000-memory.dmp

Filesize
256KB

Download
memory/3048-6-0x0000000004820000-0x000000000486A000-memory.dmp

Filesize
296KB

Download
memory/3048-7-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 3048 wrote to memory of 2668	3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
PID 3048 wrote to memory of 2668	3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
PID 3048 wrote to memory of 2668	3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
PID 3048 wrote to memory of 2668	3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
PID 3048 wrote to memory of 1056	3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
PID 3048 wrote to memory of 1056	3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
PID 3048 wrote to memory of 1056	3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
PID 3048 wrote to memory of 1056	3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
PID 3048 wrote to memory of 2880	3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
PID 3048 wrote to memory of 2880	3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
PID 3048 wrote to memory of 2880	3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
PID 3048 wrote to memory of 2880	3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
PID 3048 wrote to memory of 2496	3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
PID 3048 wrote to memory of 2496	3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
PID 3048 wrote to memory of 2496	3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
PID 3048 wrote to memory of 2496	3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
PID 3048 wrote to memory of 2288	3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
PID 3048 wrote to memory of 2288	3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
PID 3048 wrote to memory of 2288	3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe
PID 3048 wrote to memory of 2288	3048	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe	3cfe56e2909d9f61a0c4c2445c6f009a_JaffaCakes118.exe

Analysis

Sharing