d74bf61fcd9a1ea2743d24f4c418606c1d294fecfb5ed4c9634facf974dee7b1

General

Target

f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
Size

577KB
MD5

f064fe9a93ece8f472cbf5a748978cd3
SHA1

c151625873763bcfd6e8f1bd70ffd3839a444fb8
SHA256

d74bf61fcd9a1ea2743d24f4c418606c1d294fecfb5ed4c9634facf974dee7b1
SHA512

1dd2f407f112dccba95ab41d93a327bdde2cbca3f4c1e4748f8d15656d70dbb6c1a8a00d26043d44e2369dd3bda5287ecb64db68adcfc2c3363c2dc830e6338a
SSDEEP

12288:0ERs+eAn1O8Ukr1YT8025XVN/xL/DltrPP53XzM5yHLhFSS3cK:1yZAziV21VNc

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe

pid	process
2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2760 f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760

C:\Users\Admin\AppData\Local\Temp\f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
"{path}"
2⤵
PID:2640

C:\Users\Admin\AppData\Local\Temp\f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
"{path}"
2⤵
PID:2420

C:\Users\Admin\AppData\Local\Temp\f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
"{path}"
2⤵
PID:2540

C:\Users\Admin\AppData\Local\Temp\f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
"{path}"
2⤵
PID:2868

C:\Users\Admin\AppData\Local\Temp\f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
"{path}"
2⤵
PID:2564

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2760-0-0x0000000000110000-0x00000000001A6000-memory.dmp

Filesize
600KB

Download
memory/2760-1-0x0000000074DB0000-0x000000007549E000-memory.dmp

Filesize
6.9MB

Download
memory/2760-2-0x0000000004830000-0x0000000004870000-memory.dmp

Filesize
256KB

Download
memory/2760-3-0x00000000003D0000-0x00000000003D8000-memory.dmp

Filesize
32KB

Download
memory/2760-4-0x0000000074DB0000-0x000000007549E000-memory.dmp

Filesize
6.9MB

Download
memory/2760-5-0x0000000004830000-0x0000000004870000-memory.dmp

Filesize
256KB

Download
memory/2760-6-0x0000000005DF0000-0x0000000005E5C000-memory.dmp

Filesize
432KB

Download
memory/2760-7-0x00000000005D0000-0x00000000005F2000-memory.dmp

Filesize
136KB

Download
memory/2760-8-0x0000000074DB0000-0x000000007549E000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 2760 wrote to memory of 2640	2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
PID 2760 wrote to memory of 2640	2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
PID 2760 wrote to memory of 2640	2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
PID 2760 wrote to memory of 2640	2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
PID 2760 wrote to memory of 2420	2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
PID 2760 wrote to memory of 2420	2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
PID 2760 wrote to memory of 2420	2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
PID 2760 wrote to memory of 2420	2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
PID 2760 wrote to memory of 2540	2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
PID 2760 wrote to memory of 2540	2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
PID 2760 wrote to memory of 2540	2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
PID 2760 wrote to memory of 2540	2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
PID 2760 wrote to memory of 2868	2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
PID 2760 wrote to memory of 2868	2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
PID 2760 wrote to memory of 2868	2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
PID 2760 wrote to memory of 2868	2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
PID 2760 wrote to memory of 2564	2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
PID 2760 wrote to memory of 2564	2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
PID 2760 wrote to memory of 2564	2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe
PID 2760 wrote to memory of 2564	2760	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe	f064fe9a93ece8f472cbf5a748978cd3_JaffaCakes118.exe

Analysis

Sharing