3b3c717f0b6121d8862f4bb0408bd2a225b42829c790d9054b642597bc690f9c

General

Target

042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe
Size

152KB
MD5

042d64c412ec167fbdefabc6432d0859
SHA1

36c3ecfc7bda59bf71f7a3163addb65b10ca86d8
SHA256

3b3c717f0b6121d8862f4bb0408bd2a225b42829c790d9054b642597bc690f9c
SHA512

bd4593927b2e97df66b70c7b64866d34b3c868959b057cc0e90a99a07ce2442d7b52d817ce060d6a1274af0b3901f91eb3add00c2c710cd5a72c152e462b3954
SSDEEP

1536:e6myQm5x9jSp42U/35fK6q+vMoGMaK9aWLwbOB0QQiz:zn3Wy2w5fK6tvFt9aW+Ozfz

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe

description	pid	process	target process
PID 1888 set thread context of 1200	1888	042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe	042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3308 3008 WerFault.exe winver.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

winver.exe

pid process

3008 winver.exe
3008 winver.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Explorer.EXE

description pid process

Token: SeShutdownPrivilege 3456 Explorer.EXE
Token: SeCreatePagefilePrivilege 3456 Explorer.EXE
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

winver.exeExplorer.EXE

pid process

3008 winver.exe
3456 Explorer.EXE
3456 Explorer.EXE
3456 Explorer.EXE
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

Explorer.EXE

pid process

3456 Explorer.EXE
3456 Explorer.EXE
3456 Explorer.EXE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe

pid process

1888 042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3456 Explorer.EXE

pid	pid_target	process	target process
3308	3008	WerFault.exe	winver.exe

pid	process
3008	winver.exe
3008	winver.exe

description	pid	process
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE

pid	process
1888	042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe

pid	process
3456	Explorer.EXE

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exewinver.exe

description	pid	process	target process
PID 1888 wrote to memory of 1200	1888	042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe	042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe
PID 1888 wrote to memory of 1200	1888	042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe	042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe
PID 1888 wrote to memory of 1200	1888	042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe	042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe
PID 1888 wrote to memory of 1200	1888	042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe	042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe
PID 1888 wrote to memory of 1200	1888	042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe	042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe
PID 1888 wrote to memory of 1200	1888	042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe	042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe
PID 1888 wrote to memory of 1200	1888	042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe	042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe
PID 1200 wrote to memory of 3008	1200	042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe	winver.exe
PID 1200 wrote to memory of 3008	1200	042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe	winver.exe
PID 1200 wrote to memory of 3008	1200	042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe	winver.exe
PID 1200 wrote to memory of 3008	1200	042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe	winver.exe
PID 3008 wrote to memory of 3456	3008	winver.exe	Explorer.EXE
PID 3008 wrote to memory of 2532	3008	winver.exe	sihost.exe

C:\Users\Admin\AppData\Local\Temp\042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\042d64c412ec167fbdefabc6432d0859_JaffaCakes118.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 584
5⤵
- Program crash
PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3008 -ip 3008
1⤵
PID:5104

memory/1200-2-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1200-16-0x0000000000680000-0x0000000001080000-memory.dmp

Filesize
10.0MB

Download
memory/1200-7-0x0000000000680000-0x0000000001080000-memory.dmp

Filesize
10.0MB

Download
memory/2532-20-0x00007FFF99FF0000-0x00007FFF99FF1000-memory.dmp

Filesize
4KB

Download
memory/2532-15-0x0000000000230000-0x0000000000237000-memory.dmp

Filesize
28KB

Download
memory/3008-9-0x0000000076FB2000-0x0000000076FB3000-memory.dmp

Filesize
4KB

Download
memory/3008-8-0x0000000000DF0000-0x0000000000DF7000-memory.dmp

Filesize
28KB

Download
memory/3008-11-0x0000000000C20000-0x0000000000C32000-memory.dmp

Filesize
72KB

Download
memory/3008-4-0x0000000000DF0000-0x0000000000DF7000-memory.dmp

Filesize
28KB

Download
memory/3008-17-0x0000000000DF0000-0x0000000000DF7000-memory.dmp

Filesize
28KB

Download
memory/3456-10-0x00007FFF99E6D000-0x00007FFF99E6E000-memory.dmp

Filesize
4KB

Download
memory/3456-3-0x0000000002B30000-0x0000000002B37000-memory.dmp

Filesize
28KB

Download
memory/3456-6-0x0000000002B30000-0x0000000002B37000-memory.dmp

Filesize
28KB

Download
memory/3456-21-0x00007FFF99FE0000-0x00007FFF99FE1000-memory.dmp

Filesize
4KB

Download