a3fc7582c0a09e1b3f2b82a9a2941c12cb076c84cbfe811b2445de5bb4cc19b7

General

Target

fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
Size

296KB
MD5

fc22a53283a698ce6223d08254f7579e
SHA1

bd71da45daa316e78145fdffcb579229cefa0ae9
SHA256

a3fc7582c0a09e1b3f2b82a9a2941c12cb076c84cbfe811b2445de5bb4cc19b7
SHA512

9874f45e81db376a7e4d744a42a05699dfb34e5fc8a427110456dcdfe1374bd5f6dd4e4a28bb545a3041bb66cd8e275f7a96fdc81c5b7033a1da84dd0469856a
SSDEEP

6144:SijqqnucE1vRPeQnVW5GJZ2tNYLj8MfsoFaupxH/+MBTU0Y:SijfFE7PegVzYKj86soFaupJWP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

Processes:

fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exefc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe

description	pid	process	target process
PID 3400 set thread context of 4228	3400	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 4228 set thread context of 3708	4228	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe

Modifies registry class 3 IoCs

Processes:

fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exefc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe

pid process

3400 fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
4228 fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe

pid	process
3400	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
4228	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exefc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3400

C:\Users\Admin\AppData\Local\Temp\fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228

C:\Users\Admin\AppData\Local\Temp\fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
3⤵
PID:3708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3400-24-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/3400-38-0x0000000002E80000-0x0000000002E81000-memory.dmp

Filesize
4KB

Download
memory/3400-3-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/3400-4-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/3400-5-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/3400-6-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/3400-7-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/3400-8-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/3400-9-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/3400-11-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/3400-10-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/3400-12-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/3400-14-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/3400-15-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/3400-16-0x00000000022A0000-0x00000000022B0000-memory.dmp

Filesize
64KB

Download
memory/3400-17-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/3400-0-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/3400-19-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/3400-20-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3400-21-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/3400-22-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/3400-23-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/3400-27-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

Filesize
4KB

Download
memory/3400-26-0x0000000002C90000-0x0000000002C91000-memory.dmp

Filesize
4KB

Download
memory/3400-18-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/3400-28-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

Filesize
4KB

Download
memory/3400-25-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/3400-30-0x0000000002E10000-0x0000000002E11000-memory.dmp

Filesize
4KB

Download
memory/3400-40-0x0000000002E70000-0x0000000002E71000-memory.dmp

Filesize
4KB

Download
memory/3400-31-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/3400-39-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/3400-33-0x0000000002E30000-0x0000000002E31000-memory.dmp

Filesize
4KB

Download
memory/3400-35-0x0000000002E20000-0x0000000002E21000-memory.dmp

Filesize
4KB

Download
memory/3400-37-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/3400-1-0x0000000002380000-0x000000000238C000-memory.dmp

Filesize
48KB

Download
memory/3708-44-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3708-47-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/3708-46-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3708-50-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3708-51-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/3708-53-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/4228-34-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4228-29-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4228-36-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4228-42-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4228-48-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

description	pid	process	target process
PID 3400 wrote to memory of 4228	3400	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 3400 wrote to memory of 4228	3400	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 3400 wrote to memory of 4228	3400	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 3400 wrote to memory of 4228	3400	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 3400 wrote to memory of 4228	3400	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 3400 wrote to memory of 4228	3400	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 3400 wrote to memory of 4228	3400	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 3400 wrote to memory of 4228	3400	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 4228 wrote to memory of 3708	4228	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 4228 wrote to memory of 3708	4228	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 4228 wrote to memory of 3708	4228	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 4228 wrote to memory of 3708	4228	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 4228 wrote to memory of 3708	4228	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 4228 wrote to memory of 3708	4228	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 4228 wrote to memory of 3708	4228	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads