77ada8345e7bd235de0c3660ce802f3b8105da41e16b6cdadd2274d53f42df7a

General

Target

fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
Size

847KB
MD5

fc0a293c2c8c94e0d335ff5012a194f0
SHA1

9e63213e36590df2d146fdea7b21902136b27b73
SHA256

77ada8345e7bd235de0c3660ce802f3b8105da41e16b6cdadd2274d53f42df7a
SHA512

23f02d4fac22e22c53aa7f73f77d299fdbfd6238b202221cb13b5f909eae66f92ac0e9c4855b35e76f8de1112dd68a63ba113ab435b63c38c71484a42710520c
SSDEEP

24576:k2kBiad50iXd37pf4HVchOe1lFQb/CoI18:IBi8FI1cFvQb

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe

pid	process
2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2172 fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172

C:\Users\Admin\AppData\Local\Temp\fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe"
2⤵
PID:2632

C:\Users\Admin\AppData\Local\Temp\fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe"
2⤵
PID:2656

C:\Users\Admin\AppData\Local\Temp\fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe"
2⤵
PID:2660

C:\Users\Admin\AppData\Local\Temp\fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe"
2⤵
PID:2868

C:\Users\Admin\AppData\Local\Temp\fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe"
2⤵
PID:2584

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2172-1-0x0000000074D50000-0x000000007543E000-memory.dmp

Filesize
6.9MB

Download
memory/2172-0-0x0000000000250000-0x000000000032A000-memory.dmp

Filesize
872KB

Download
memory/2172-2-0x00000000043C0000-0x0000000004400000-memory.dmp

Filesize
256KB

Download
memory/2172-3-0x00000000005E0000-0x00000000005EA000-memory.dmp

Filesize
40KB

Download
memory/2172-4-0x0000000074D50000-0x000000007543E000-memory.dmp

Filesize
6.9MB

Download
memory/2172-5-0x00000000043C0000-0x0000000004400000-memory.dmp

Filesize
256KB

Download
memory/2172-6-0x0000000007C80000-0x0000000007D48000-memory.dmp

Filesize
800KB

Download
memory/2172-7-0x0000000074D50000-0x000000007543E000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 2172 wrote to memory of 2632	2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
PID 2172 wrote to memory of 2632	2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
PID 2172 wrote to memory of 2632	2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
PID 2172 wrote to memory of 2632	2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
PID 2172 wrote to memory of 2656	2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
PID 2172 wrote to memory of 2656	2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
PID 2172 wrote to memory of 2656	2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
PID 2172 wrote to memory of 2656	2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
PID 2172 wrote to memory of 2660	2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
PID 2172 wrote to memory of 2660	2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
PID 2172 wrote to memory of 2660	2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
PID 2172 wrote to memory of 2660	2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
PID 2172 wrote to memory of 2868	2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
PID 2172 wrote to memory of 2868	2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
PID 2172 wrote to memory of 2868	2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
PID 2172 wrote to memory of 2868	2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
PID 2172 wrote to memory of 2584	2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
PID 2172 wrote to memory of 2584	2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
PID 2172 wrote to memory of 2584	2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe
PID 2172 wrote to memory of 2584	2172	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe	fc0a293c2c8c94e0d335ff5012a194f0_JaffaCakes118.exe

Analysis

Sharing