9dfe59158f7a38ce9b685241acd76c2ccc46163b51a6f05d204f112e331f4139

General

Target

03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe
Size

78KB
MD5

03c3b68cd9b6cef65e3a63935773569b
SHA1

d384bd9add61883f4f1668bd06b8bf91d50f2db2
SHA256

9dfe59158f7a38ce9b685241acd76c2ccc46163b51a6f05d204f112e331f4139
SHA512

84cad135a5f5000f10fe4f4a00d5f61c1d4bac55652185fa37c013b68ae7c7428688176917d2077c7209111fb08e1f4f88ae24e366bcf2cb2a98583c1becc07a
SSDEEP

1536:vZJnV6Cc49R/dT12MMMMM2MMMMMZ1d3FJ/t:x1V6Cc49R/dMMMMMM2MMMMMZ1Dtt

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe

pid process

2176 03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 21 IoCs

Processes:

03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe

pid	process
2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe
2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe
2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe
2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe
2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe
2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe
2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe
2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe
2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe
2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe
2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe
2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe
2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe
2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe
2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe
2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe
2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe
2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe
2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe
2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe
2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2176 03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe

description	pid	process	target process
PID 2176 wrote to memory of 384	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	wininit.exe
PID 2176 wrote to memory of 384	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	wininit.exe
PID 2176 wrote to memory of 384	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	wininit.exe
PID 2176 wrote to memory of 384	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	wininit.exe
PID 2176 wrote to memory of 384	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	wininit.exe
PID 2176 wrote to memory of 384	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	wininit.exe
PID 2176 wrote to memory of 384	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	wininit.exe
PID 2176 wrote to memory of 392	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	csrss.exe
PID 2176 wrote to memory of 392	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	csrss.exe
PID 2176 wrote to memory of 392	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	csrss.exe
PID 2176 wrote to memory of 392	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	csrss.exe
PID 2176 wrote to memory of 392	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	csrss.exe
PID 2176 wrote to memory of 392	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	csrss.exe
PID 2176 wrote to memory of 392	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	csrss.exe
PID 2176 wrote to memory of 432	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	winlogon.exe
PID 2176 wrote to memory of 432	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	winlogon.exe
PID 2176 wrote to memory of 432	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	winlogon.exe
PID 2176 wrote to memory of 432	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	winlogon.exe
PID 2176 wrote to memory of 432	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	winlogon.exe
PID 2176 wrote to memory of 432	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	winlogon.exe
PID 2176 wrote to memory of 432	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	winlogon.exe
PID 2176 wrote to memory of 476	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	services.exe
PID 2176 wrote to memory of 476	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	services.exe
PID 2176 wrote to memory of 476	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	services.exe
PID 2176 wrote to memory of 476	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	services.exe
PID 2176 wrote to memory of 476	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	services.exe
PID 2176 wrote to memory of 476	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	services.exe
PID 2176 wrote to memory of 476	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	services.exe
PID 2176 wrote to memory of 488	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	lsass.exe
PID 2176 wrote to memory of 488	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	lsass.exe
PID 2176 wrote to memory of 488	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	lsass.exe
PID 2176 wrote to memory of 488	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	lsass.exe
PID 2176 wrote to memory of 488	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	lsass.exe
PID 2176 wrote to memory of 488	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	lsass.exe
PID 2176 wrote to memory of 488	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	lsass.exe
PID 2176 wrote to memory of 496	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	lsm.exe
PID 2176 wrote to memory of 496	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	lsm.exe
PID 2176 wrote to memory of 496	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	lsm.exe
PID 2176 wrote to memory of 496	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	lsm.exe
PID 2176 wrote to memory of 496	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	lsm.exe
PID 2176 wrote to memory of 496	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	lsm.exe
PID 2176 wrote to memory of 496	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	lsm.exe
PID 2176 wrote to memory of 592	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	svchost.exe
PID 2176 wrote to memory of 592	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	svchost.exe
PID 2176 wrote to memory of 592	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	svchost.exe
PID 2176 wrote to memory of 592	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	svchost.exe
PID 2176 wrote to memory of 592	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	svchost.exe
PID 2176 wrote to memory of 592	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	svchost.exe
PID 2176 wrote to memory of 592	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	svchost.exe
PID 2176 wrote to memory of 672	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	svchost.exe
PID 2176 wrote to memory of 672	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	svchost.exe
PID 2176 wrote to memory of 672	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	svchost.exe
PID 2176 wrote to memory of 672	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	svchost.exe
PID 2176 wrote to memory of 672	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	svchost.exe
PID 2176 wrote to memory of 672	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	svchost.exe
PID 2176 wrote to memory of 672	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	svchost.exe
PID 2176 wrote to memory of 752	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	svchost.exe
PID 2176 wrote to memory of 752	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	svchost.exe
PID 2176 wrote to memory of 752	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	svchost.exe
PID 2176 wrote to memory of 752	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	svchost.exe
PID 2176 wrote to memory of 752	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	svchost.exe
PID 2176 wrote to memory of 752	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	svchost.exe
PID 2176 wrote to memory of 752	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	svchost.exe
PID 2176 wrote to memory of 800	2176	03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe	svchost.exe

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
2⤵
PID:476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
3⤵
PID:592

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
4⤵
PID:1736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
3⤵
PID:672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
3⤵
PID:752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
3⤵
PID:800

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
4⤵
PID:1168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
3⤵
PID:844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
3⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
3⤵
PID:1020

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
3⤵
PID:1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
3⤵
PID:1068

C:\Windows\system32\taskhost.exe
"taskhost.exe"
3⤵
PID:1108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
3⤵
PID:1400

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
3⤵
PID:2196

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
2⤵
PID:488

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:496

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192

C:\Users\Admin\AppData\Local\Temp\03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03c3b68cd9b6cef65e3a63935773569b_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2176-0-0x0000000001000000-0x0000000001017000-memory.dmp

Filesize
92KB

Download
memory/2176-2-0x0000000077500000-0x0000000077501000-memory.dmp

Filesize
4KB

Download
memory/2176-1-0x00000000774FF000-0x0000000077500000-memory.dmp

Filesize
4KB

Download
memory/2176-3-0x0000000001000000-0x0000000001017000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing