7b61bbc7e4e85ea2281df46a2a682fa75e9b28def507e2513b80e490fae06822

General

Target

fcf8a57d881578d60095850a22687599_JaffaCakes118.exe
Size

815KB
MD5

fcf8a57d881578d60095850a22687599
SHA1

e7b29bada6d1635b0850c7e4300e6f6eabab7016
SHA256

7b61bbc7e4e85ea2281df46a2a682fa75e9b28def507e2513b80e490fae06822
SHA512

2281793e97b60780b19f5b746bbc1cd1fd283964d561115c9d658305d249d0c2244cc96b5a5e93bde88eb7ffa6f8ba1abec538ab2ef6aab4f9f7e7c5ccf569e0
SSDEEP

24576:J3RaxViKvQy+WwS+SReZvuU8/LC15wvnPdsqQ4l:JMxXIy+iTRIuUELCgvhj

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

fcf8a57d881578d60095850a22687599_JaffaCakes118.tmp

pid process

4008 fcf8a57d881578d60095850a22687599_JaffaCakes118.tmp

Loads dropped DLL 4 IoCs

Processes:

fcf8a57d881578d60095850a22687599_JaffaCakes118.tmp

pid	process
4008	fcf8a57d881578d60095850a22687599_JaffaCakes118.tmp
4008	fcf8a57d881578d60095850a22687599_JaffaCakes118.tmp
4008	fcf8a57d881578d60095850a22687599_JaffaCakes118.tmp
4008	fcf8a57d881578d60095850a22687599_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fcf8a57d881578d60095850a22687599_JaffaCakes118.exe

description	pid	process	target process
PID 2916 wrote to memory of 4008	2916	fcf8a57d881578d60095850a22687599_JaffaCakes118.exe	fcf8a57d881578d60095850a22687599_JaffaCakes118.tmp
PID 2916 wrote to memory of 4008	2916	fcf8a57d881578d60095850a22687599_JaffaCakes118.exe	fcf8a57d881578d60095850a22687599_JaffaCakes118.tmp
PID 2916 wrote to memory of 4008	2916	fcf8a57d881578d60095850a22687599_JaffaCakes118.exe	fcf8a57d881578d60095850a22687599_JaffaCakes118.tmp

C:\Users\Admin\AppData\Local\Temp\fcf8a57d881578d60095850a22687599_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fcf8a57d881578d60095850a22687599_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2916

C:\Users\Admin\AppData\Local\Temp\is-I4EF0.tmp\fcf8a57d881578d60095850a22687599_JaffaCakes118.tmp
"C:\Users\Admin\AppData\Local\Temp\is-I4EF0.tmp\fcf8a57d881578d60095850a22687599_JaffaCakes118.tmp" /SL5="$A0060,571876,54272,C:\Users\Admin\AppData\Local\Temp\fcf8a57d881578d60095850a22687599_JaffaCakes118.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-C9QTJ.tmp\is7z.dll
Filesize
279KB

MD5
f55a7e9cc5754e67f81ae412cb376748

SHA1
5002435060dce7f3d53012f87a62c81ada955ede

SHA256
08c06dc4d4b62988ddb523d3a72a47dbb1dea331fccbbd93f24d74fd619eb4dd

SHA512
d2fa1a1489af079832d6173285dcee6aea620619042d705883346c69ffc8ad6709d1268c3a0394ed08d07c2cfcdcfc1653e2abcc9743a1bfd656b58187a4e4f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C9QTJ.tmp\itdownload.dll
Filesize
200KB

MD5
d82a429efd885ca0f324dd92afb6b7b8

SHA1
86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

SHA256
b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

SHA512
5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-I4EF0.tmp\fcf8a57d881578d60095850a22687599_JaffaCakes118.tmp
Filesize
696KB

MD5
8aa8c628f7b7b7f3e96eff00557bd0bf

SHA1
9af9cf61707cbba7bf0d7cbed94e8db91aff8bd6

SHA256
14d4fa3ea6c3fbf6e9d284de717e73a1ebb5e77f3d5c8c98808e40ade359ea9d

SHA512
5e0a4765873684fce159af81310e37b6918c923ccede0c4de0bd1e2e221425109131830cff02e3f910f15b0401ee3b4ae68700b6d29a5e8466f6d4ee1dcd6eeb

Download Submit
memory/2916-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2916-49-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2916-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4008-38-0x0000000003EC0000-0x0000000003EC1000-memory.dmp

Filesize
4KB

Download
memory/4008-41-0x0000000003F00000-0x0000000003F01000-memory.dmp

Filesize
4KB

Download
memory/4008-26-0x0000000003BE0000-0x0000000003C94000-memory.dmp

Filesize
720KB

Download
memory/4008-32-0x0000000003E20000-0x0000000003E21000-memory.dmp

Filesize
4KB

Download
memory/4008-31-0x0000000003E10000-0x0000000003E11000-memory.dmp

Filesize
4KB

Download
memory/4008-33-0x0000000003E50000-0x0000000003E51000-memory.dmp

Filesize
4KB

Download
memory/4008-34-0x0000000003E70000-0x0000000003E71000-memory.dmp

Filesize
4KB

Download
memory/4008-35-0x0000000003E80000-0x0000000003E81000-memory.dmp

Filesize
4KB

Download
memory/4008-36-0x0000000003E90000-0x0000000003E91000-memory.dmp

Filesize
4KB

Download
memory/4008-37-0x0000000003EB0000-0x0000000003EB1000-memory.dmp

Filesize
4KB

Download
memory/4008-17-0x0000000003A60000-0x0000000003A9C000-memory.dmp

Filesize
240KB

Download
memory/4008-39-0x0000000003EE0000-0x0000000003EE1000-memory.dmp

Filesize
4KB

Download
memory/4008-40-0x0000000003EF0000-0x0000000003EF1000-memory.dmp

Filesize
4KB

Download
memory/4008-27-0x00000000023E0000-0x00000000023E2000-memory.dmp

Filesize
8KB

Download
memory/4008-42-0x0000000003F20000-0x0000000003F21000-memory.dmp

Filesize
4KB

Download
memory/4008-45-0x0000000003E60000-0x0000000003E61000-memory.dmp

Filesize
4KB

Download
memory/4008-44-0x0000000003E40000-0x0000000003E41000-memory.dmp

Filesize
4KB

Download
memory/4008-43-0x0000000003E30000-0x0000000003E31000-memory.dmp

Filesize
4KB

Download
memory/4008-46-0x0000000003EA0000-0x0000000003EA1000-memory.dmp

Filesize
4KB

Download
memory/4008-47-0x0000000003ED0000-0x0000000003ED1000-memory.dmp

Filesize
4KB

Download
memory/4008-48-0x0000000003F10000-0x0000000003F11000-memory.dmp

Filesize
4KB

Download
memory/4008-10-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/4008-50-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/4008-51-0x0000000003A60000-0x0000000003A9C000-memory.dmp

Filesize
240KB

Download
memory/4008-53-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/4008-60-0x0000000003A60000-0x0000000003A9C000-memory.dmp

Filesize
240KB

Download
memory/4008-61-0x0000000003BE0000-0x0000000003C94000-memory.dmp

Filesize
720KB

Download

Analysis

Sharing