5443606f6d585d7247fdec8d5da8f135ddb972620317afb165f438bee8fce585

General

Target

bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
Size

275KB
MD5

bdb0ac3ae6972612fe7904201d7b203a
SHA1

c24e76179a10e6eff5f5b8fd7d9f524d439be804
SHA256

5443606f6d585d7247fdec8d5da8f135ddb972620317afb165f438bee8fce585
SHA512

461016259404f5dfc83e693e7cc8df2871e4f666f42aa5f759e53b20b19f6551a221fbd69d037e01c35217832aa1337d6a98be81197d3ad31e92505b3117ef14
SSDEEP

3072:blN9RkkkkkkTLJ0Y6LFWOlN9RkkkkkkTLJ0Y6LFWemqTpxO2wrPKt48j1HdI:5dkkkkkkZ6ZxdkkkkkkZ6ZNVcliu8jDI

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4900-0-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/4900-1-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/files/0x00070000000231ed-6.dat	upx
behavioral2/memory/4900-18-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/4900-19-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/4900-20-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/4900-21-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/4900-22-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/4900-23-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/4900-24-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/4900-25-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/4900-26-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/4900-27-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/4900-28-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/4900-29-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/4900-30-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\win32dc\Silent Hill 4_trainer.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File created	C:\Windows\win32dc\Silent Hill 4_fix.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\BattleField 1942 + fix.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File created	C:\Windows\win32dc\UT2004_codes.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Quake3 cheat.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File created	C:\Windows\win32dc\Half-Life 2_crack.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2_crack.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File created	C:\Windows\win32dc\Doom 3(trainer).exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Doom 3(trainer).exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\UT2004_codes.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Counter-Strike cheat.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File created	C:\Windows\win32dc\BattleField 1942 + fix.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File created	C:\Windows\win32dc\Doom 3 + codes.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File created	C:\Windows\win32dc\Quake3 cheat.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File created	C:\Windows\win32dc\Counter-Strike cheat.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File created	C:\Windows\win32dc\Counter-Strike_cdfix.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Counter-Strike_cdfix.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
PID:4900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win32dc\Half-Life 2_crack.exe

Filesize
278KB

MD5
ba3aaf1c79f2c062b31e8741d96e4f67

SHA1
4d87d5874aa84aa2a6a21be6c408c2a9f9de52ad

SHA256
133e2dd69fb2b15a671d1f7edc0f3b7b67f906924481d2f848f1f941165ea0a3

SHA512
cf6662561f5dedc2ae432967904cb5dd9e1502a315d5da53bc13d45f9729328316f156f01e4b8c08fcffd6f1e2e5da6424cb31e7c7b90423ebcaf07dbb229284

Download Submit
memory/4900-23-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4900-26-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4900-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4900-19-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4900-20-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4900-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4900-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4900-24-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4900-22-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4900-25-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4900-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4900-27-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4900-28-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4900-29-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4900-30-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads