1ceaaba2d2392e97d4036c1358e6cd358f80a2bf22fd1947a93883052f57c52f

General

Target

e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe
Size

43KB
MD5

e2b1aa94857484432bbbd026aabfbada
SHA1

f1b44338c4ceec82767f0463fc062294eb715487
SHA256

1ceaaba2d2392e97d4036c1358e6cd358f80a2bf22fd1947a93883052f57c52f
SHA512

22c1b0a4e4dc10e1bb3b57369de059ac44d1ff1732552c63f6c71ab211ca41b34ba7b75fa6063a4905c35c068a5c655125083358136051831f96ad912fcc9f70
SSDEEP

768:vuRSNLCnC3qK6Bnz9WdnSSuJH4ZYRPpHOxsiUnJAyxz2Zkzee:vu69spSM4oJ8Uuyl2Zkz1

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2168 set thread context of 2100	2168	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2100	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe
2100	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2100	2168	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	28
PID 2168 wrote to memory of 2100	2168	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	28
PID 2168 wrote to memory of 2100	2168	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	28
PID 2168 wrote to memory of 2100	2168	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	28
PID 2168 wrote to memory of 2100	2168	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	28
PID 2168 wrote to memory of 2100	2168	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	28
PID 2168 wrote to memory of 2100	2168	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	28
PID 2168 wrote to memory of 2100	2168	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	28
PID 2100 wrote to memory of 1396	2100	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	21
PID 2100 wrote to memory of 1396	2100	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	21
PID 2100 wrote to memory of 1396	2100	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	21
PID 2100 wrote to memory of 1396	2100	e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1396
- C:\Users\Admin\AppData\Local\Temp\e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Users\Admin\AppData\Local\Temp\e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e2b1aa94857484432bbbd026aabfbada_JaffaCakes118.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2100-8880-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2100-8899-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2100-8898-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2100-8883-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2100-8882-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2168-40-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-46-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-18-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-24-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-22-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-28-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-26-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-32-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-30-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-36-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-34-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-0-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-38-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-20-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-44-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-48-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-50-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-52-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-54-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-56-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-62-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-60-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-58-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-14-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-16-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-4-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-6-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2168-2-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads