447d06cfd1ccc02bbd80a48fe13dc9058b8985c25e96399887f0519101ba4d45

General

Target

f5f7d35ec1f68910b1bbe5607aa3aae0_JaffaCakes118.exe
Size

37KB
MD5

f5f7d35ec1f68910b1bbe5607aa3aae0
SHA1

9d7adef2307da1321ba59143333d32db0a76395b
SHA256

447d06cfd1ccc02bbd80a48fe13dc9058b8985c25e96399887f0519101ba4d45
SHA512

42047e8c8c71137d111facfbe41a50755460271560fe4623f0a008dbbabfa378e6397cddc65ec969a6c9f9939a17c4c6e69c2070c4ab137f1bc01b0645f77843
SSDEEP

768:YLTfKKukQrlyKM0iu+dEA+7r2ASpQ9PznHtfqmeX8UUJKxsha5:ylukQrl1iDdNgrwpQ9P9qmCmV

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000a00000002332f-4.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5012	ngfqes.exe

Drops file in System32 directory 23 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe	ngfqes.exe
File created	C:\Windows\SysWOW64\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe	ngfqes.exe
File created	C:\Windows\SysWOW64\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe	ngfqes.exe
File created	C:\Windows\SysWOW64\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe	ngfqes.exe
File created	C:\Windows\SysWOW64\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe	ngfqes.exe
File created	C:\Windows\SysWOW64\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe	ngfqes.exe
File created	C:\Windows\SysWOW64\ngfqes.exe	f5f7d35ec1f68910b1bbe5607aa3aae0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe	ngfqes.exe
File created	C:\Windows\SysWOW64\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe	ngfqes.exe
File created	C:\Windows\SysWOW64\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe	ngfqes.exe
File created	C:\Windows\SysWOW64\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe	ngfqes.exe
File created	C:\Windows\SysWOW64\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe	ngfqes.exe
File created	C:\Windows\SysWOW64\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe	ngfqes.exe
File created	C:\Windows\SysWOW64\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe	ngfqes.exe
File opened for modification	C:\Windows\SysWOW64\ngfqes.exe	f5f7d35ec1f68910b1bbe5607aa3aae0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ngfqes.exe\ngfqes.exe\ngfqes.exe	ngfqes.exe
File created	C:\Windows\SysWOW64\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe	ngfqes.exe
File created	C:\Windows\SysWOW64\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe	ngfqes.exe
File created	C:\Windows\SysWOW64\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe	ngfqes.exe
File created	C:\Windows\SysWOW64\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe	ngfqes.exe
File created	C:\Windows\SysWOW64\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe\ngfqes.exe	ngfqes.exe
File created	C:\Windows\SysWOW64\ngfqes.exe	ngfqes.exe
File created	C:\Windows\SysWOW64\ngfqes.exe\ngfqes.exe	ngfqes.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1968	f5f7d35ec1f68910b1bbe5607aa3aae0_JaffaCakes118.exe
1968	f5f7d35ec1f68910b1bbe5607aa3aae0_JaffaCakes118.exe
5012	ngfqes.exe
5012	ngfqes.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 5012	1968	f5f7d35ec1f68910b1bbe5607aa3aae0_JaffaCakes118.exe	86
PID 1968 wrote to memory of 5012	1968	f5f7d35ec1f68910b1bbe5607aa3aae0_JaffaCakes118.exe	86
PID 1968 wrote to memory of 5012	1968	f5f7d35ec1f68910b1bbe5607aa3aae0_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\f5f7d35ec1f68910b1bbe5607aa3aae0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5f7d35ec1f68910b1bbe5607aa3aae0_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\ngfqes.exe
  C:\Windows\system32\ngfqes.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:5012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ngfqes.exe

Filesize
37KB

MD5
f5f7d35ec1f68910b1bbe5607aa3aae0

SHA1
9d7adef2307da1321ba59143333d32db0a76395b

SHA256
447d06cfd1ccc02bbd80a48fe13dc9058b8985c25e96399887f0519101ba4d45

SHA512
42047e8c8c71137d111facfbe41a50755460271560fe4623f0a008dbbabfa378e6397cddc65ec969a6c9f9939a17c4c6e69c2070c4ab137f1bc01b0645f77843

Download Submit
memory/1968-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1968-5-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/5012-6-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing