52e562f150b5cad40866ba2cf3487ca08369cc2896693b5fac9ff8e2be1a7148

General

Target

fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe
Size

515KB
MD5

fc2afd7c0e96ebf56d1bd0f5e939c830
SHA1

f3193aeaf3b09e986074102d31086d2ab5318d6f
SHA256

52e562f150b5cad40866ba2cf3487ca08369cc2896693b5fac9ff8e2be1a7148
SHA512

0cc2fe6422bb36256a1f3dd0cd740120c673b0ca2fcdea56fe9b303089dbc9324dc72ba1488abe503770f69ab1fd041833d35a752b14a367a234fa1fc15b4ff0
SSDEEP

6144:L7m+RKkro+H8+ThEB9kT1pfIT6oG8Qp1YR0jlmV972EYuKNUg24TyQOI5Jgpcvql:LZROE7PASc2jy7SNUmT0Iw5pcEh3gw

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe

description pid process

PID 4356 set thread context of 0 4356 fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe

description	pid	process
PID 4356 set thread context of 0	4356	fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe

Modifies registry class 3 IoCs

Processes:

fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe

pid process

4356 fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe

pid	process
4356	fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe

description	pid	process
PID 4356 wrote to memory of 0	4356	fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe
PID 4356 wrote to memory of 0	4356	fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe
PID 4356 wrote to memory of 0	4356	fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe
PID 4356 wrote to memory of 0	4356	fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4356-0-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/4356-1-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/4356-2-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/4356-3-0x00000000022B0000-0x00000000022C0000-memory.dmp

Filesize
64KB

Download
memory/4356-4-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/4356-5-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/4356-6-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/4356-7-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/4356-8-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/4356-9-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/4356-10-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/4356-11-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/4356-13-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/4356-12-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/4356-15-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/4356-16-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/4356-14-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/4356-17-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/4356-18-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/4356-20-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/4356-19-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/4356-21-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/4356-22-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/4356-23-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/4356-25-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download
memory/4356-27-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/4356-29-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/4356-28-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/4356-31-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/4356-30-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/4356-32-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/4356-34-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/4356-33-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/4356-35-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/4356-37-0x0000000003080000-0x0000000003081000-memory.dmp

Filesize
4KB

Download
memory/4356-36-0x0000000004B70000-0x0000000004B71000-memory.dmp

Filesize
4KB

Download
memory/4356-38-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download
memory/4356-39-0x0000000004B80000-0x0000000004B81000-memory.dmp

Filesize
4KB

Download
memory/4356-40-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

Filesize
4KB

Download
memory/4356-42-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Filesize
4KB

Download
memory/4356-41-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Filesize
4KB

Download
memory/4356-44-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/4356-43-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Filesize
4KB

Download
memory/4356-45-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/4356-46-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/4356-47-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing