3f6eddf63e8e09988a1ca46ed6497e8efc7bed35c1098525427b5ab67e6e09d1

General

Target

f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
Size

223KB
MD5

f3858fba9f17e014f305d1caaa7cb250
SHA1

b2ce2feb2ab7f40740ad9886ae4cc95a16568a2b
SHA256

3f6eddf63e8e09988a1ca46ed6497e8efc7bed35c1098525427b5ab67e6e09d1
SHA512

eaff4fc56d29ac55c63a116c6e85d5b84c21342b40a256dcb647767742794de23f47d6098355997fbd7e12cd926c13d75c0d32abd4f1549aba3f32e7487fc64b
SSDEEP

3072:blN9RkkkkkkTLqDX3E6ValN9RkkkkkkTLqDX3E6VNCyeDe:5dkkkkkkuJMdkkkkkkuJz

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1632-0-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/1632-1-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/files/0x0031000000014454-6.dat	upx
behavioral1/memory/1632-18-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/1632-19-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/1632-20-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/1632-21-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/1632-22-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/1632-23-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/1632-24-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/1632-25-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/1632-26-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/1632-27-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/1632-28-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/1632-29-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/1632-30-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win32dc\FlatOut_cheat.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File created	C:\Windows\win32dc\DAoC + codes.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\BattleField 1942 nocd.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Silent Hill 4_serial.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Quake3 crack.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2 patch.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File created	C:\Windows\win32dc\BattleField 1942 nocd.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File created	C:\Windows\win32dc\Silent Hill 4_serial.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File created	C:\Windows\win32dc\FlatOut_cheat.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File created	C:\Windows\win32dc\Quake3 crack.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File created	C:\Windows\win32dc\Silent Hill 4_hack.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File created	C:\Windows\win32dc\Half-Life 2 codes.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\DAoC + codes.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File created	C:\Windows\win32dc\Half-Life 2 patch.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File created	C:\Windows\win32dc\BattleField 1942(cheat).exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File created	C:\Windows\win32dc\UT2004 + codes.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
PID:1632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win32dc\Silent Hill 4_serial.exe

Filesize
224KB

MD5
1ed0206e9d5c5a63cac8b033bdebd7ec

SHA1
67a0640e2163585dc1b1e914f5effe1cd4199814

SHA256
4b86753021d3ba26c4b427c240160255f1b7c71f78a885a80328717940906d48

SHA512
4baf6d2ef91280e1b5cebcbd16b94b9d7615cb76a2fe506b6e890b238ddd31bf61bfe6d400857dc02fba40accecca05e84f4011608ab63751062059783bf9c7d

Download Submit
memory/1632-23-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1632-26-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1632-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1632-19-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1632-20-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1632-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1632-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1632-24-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1632-22-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1632-25-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1632-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1632-27-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1632-28-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1632-29-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1632-30-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads