4beabc6db31f59fbbba995513f8518498b3ddd7a2bb869397b57ed1f0f98828b

General

Target

f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe
Size

694KB
MD5

f5f6146b9517c2c878aef2fb406816fc
SHA1

851f52ded8e836fb07669da104e6e4a1936bef44
SHA256

4beabc6db31f59fbbba995513f8518498b3ddd7a2bb869397b57ed1f0f98828b
SHA512

faee7265a183bc5f196b5cb19e3bfbabf54c2edfaed0a1e2b718c243ab4c4af26874026e598cd7a666d27d8dfc7151c25a54f9d59325dde1807d6ff1d35f6d15
SSDEEP

12288:CajfGRq/OFwiLcwejwRsLvpA23rMiK/lGRgOUqmq9kR6lhKXNZffDAw9Fa3MTHp:mWBiHe0Rsd53nK/cRgOnmq9g6aFfDAve

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2004 set thread context of 2036	2004	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe	28
PID 2004 set thread context of 0	2004	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2004	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2036	2004	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe	28
PID 2004 wrote to memory of 2036	2004	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe	28
PID 2004 wrote to memory of 2036	2004	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe	28
PID 2004 wrote to memory of 2036	2004	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe	28
PID 2004 wrote to memory of 2036	2004	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe	28
PID 2004 wrote to memory of 2036	2004	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe	28
PID 2004 wrote to memory of 2036	2004	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe	28
PID 2004 wrote to memory of 2036	2004	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe	28
PID 2004 wrote to memory of 0	2004	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe
PID 2004 wrote to memory of 0	2004	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe
PID 2004 wrote to memory of 0	2004	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe
PID 2004 wrote to memory of 0	2004	f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Users\Admin\AppData\Local\Temp\f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f5f6146b9517c2c878aef2fb406816fc_JaffaCakes118.exe"
  2⤵
  PID:2036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2004-20-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2004-21-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2004-2-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/2004-8-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2004-7-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2004-6-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/2004-5-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/2004-4-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2004-3-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2004-9-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2004-10-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2004-12-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2004-14-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2004-15-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2004-17-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2004-19-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2004-1-0x0000000000350000-0x00000000003B0000-memory.dmp

Filesize
384KB

Download
memory/2004-37-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2004-0-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/2004-23-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2004-24-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2004-28-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2004-32-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2004-31-0x0000000000350000-0x00000000003B0000-memory.dmp

Filesize
384KB

Download
memory/2004-16-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2004-30-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2004-29-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/2004-18-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2004-25-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2036-27-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2036-33-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2036-36-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2036-22-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads