3f6eddf63e8e09988a1ca46ed6497e8efc7bed35c1098525427b5ab67e6e09d1

General

Target

f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
Size

223KB
MD5

f3858fba9f17e014f305d1caaa7cb250
SHA1

b2ce2feb2ab7f40740ad9886ae4cc95a16568a2b
SHA256

3f6eddf63e8e09988a1ca46ed6497e8efc7bed35c1098525427b5ab67e6e09d1
SHA512

eaff4fc56d29ac55c63a116c6e85d5b84c21342b40a256dcb647767742794de23f47d6098355997fbd7e12cd926c13d75c0d32abd4f1549aba3f32e7487fc64b
SSDEEP

3072:blN9RkkkkkkTLqDX3E6ValN9RkkkkkkTLqDX3E6VNCyeDe:5dkkkkkkuJMdkkkkkkuJz

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2580-0-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2580-1-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/files/0x000c00000002342f-6.dat	upx
behavioral2/memory/2580-21-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2580-22-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2580-23-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2580-24-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2580-25-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2580-26-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2580-27-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2580-28-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2580-29-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2580-30-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2580-31-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2580-32-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2580-33-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\win32dc\Half-Life 2 + cheat.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2 + cdfix.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File created	C:\Windows\win32dc\DAoC_cheat.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\DAoC_cheat.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Doom 3(fix).exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File created	C:\Windows\win32dc\Half-Life 2 + cdfix.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File created	C:\Windows\win32dc\Quake3_codes.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File created	C:\Windows\win32dc\UT2004 + fix.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2 + cheat.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File created	C:\Windows\win32dc\Doom 3(fix).exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File created	C:\Windows\win32dc\Doom 3_hack.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File created	C:\Windows\win32dc\DAoC_serial.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\UT2004 + fix.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Doom 3_hack.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\DAoC_serial.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File created	C:\Windows\win32dc\Doom 3 + patch.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Quake3_codes.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File created	C:\Windows\win32dc\Doom 3_trainer.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Doom 3_trainer.exe	f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
PID:2580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win32dc\Doom 3_trainer.exe

Filesize
223KB

MD5
4042dc999118fb0604bfcf95cb3c186d

SHA1
ca3f1f169b44a2e26cbdef29b28f5ba1b060d224

SHA256
0070cf9a21cb90953a039329fab1c1ea99e9a93fd137a1bcff67625adbf68cd1

SHA512
315bd4663196084e0ef3c7aafde54ead72ffeb5e3c81451fc2504dfb472798f1672e13d6427090f9d5a2e8d532853264e2e52c2df530a4a9f253850336e7561d

Download Submit
memory/2580-26-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2580-27-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2580-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2580-22-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2580-23-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2580-24-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2580-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2580-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2580-25-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2580-28-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2580-29-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2580-30-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2580-31-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2580-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2580-33-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads