cb0168111793bf5b718c09522e98c258a55038ecf801ec1ca81621f77fa0e3dd

General

Target

3aaaa4f6eb0e7f4f2d497f3a2edf1260_JaffaCakes118.exe
Size

338KB
MD5

3aaaa4f6eb0e7f4f2d497f3a2edf1260
SHA1

a6633c2d8f16ef27bb73f3a99caeaffab5e708f6
SHA256

cb0168111793bf5b718c09522e98c258a55038ecf801ec1ca81621f77fa0e3dd
SHA512

159044de7ac6bc856986e390ac2796077d079c0a7950f25c092e1c80ce013a14e8089980b7b15af8ee4b2ab7501e5b6a1688ae5a8f730cd578524aef65767633
SSDEEP

3072:StwizQTj8CSUYf8W3nSjen++Bj88OZS0/Qe2HdOylqwvwKbk0i0iq+:muj8NDF3OR9/Qe2HdJfwKbk0i0iL

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2152	Casino_ext.exe

Executes dropped EXE 4 IoCs

pid	Process
760	casino_extensions.exe
2272	Casino_ext.exe
2444	casino_extensions.exe
2152	Casino_ext.exe

Loads dropped DLL 4 IoCs

pid	Process
2028	casino_extensions.exe
2028	casino_extensions.exe
2280	casino_extensions.exe
2280	casino_extensions.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2272	Casino_ext.exe
2152	Casino_ext.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2156	3aaaa4f6eb0e7f4f2d497f3a2edf1260_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2028	2156	3aaaa4f6eb0e7f4f2d497f3a2edf1260_JaffaCakes118.exe	28
PID 2156 wrote to memory of 2028	2156	3aaaa4f6eb0e7f4f2d497f3a2edf1260_JaffaCakes118.exe	28
PID 2156 wrote to memory of 2028	2156	3aaaa4f6eb0e7f4f2d497f3a2edf1260_JaffaCakes118.exe	28
PID 2156 wrote to memory of 2028	2156	3aaaa4f6eb0e7f4f2d497f3a2edf1260_JaffaCakes118.exe	28
PID 2028 wrote to memory of 760	2028	casino_extensions.exe	29
PID 2028 wrote to memory of 760	2028	casino_extensions.exe	29
PID 2028 wrote to memory of 760	2028	casino_extensions.exe	29
PID 2028 wrote to memory of 760	2028	casino_extensions.exe	29
PID 760 wrote to memory of 2272	760	casino_extensions.exe	30
PID 760 wrote to memory of 2272	760	casino_extensions.exe	30
PID 760 wrote to memory of 2272	760	casino_extensions.exe	30
PID 760 wrote to memory of 2272	760	casino_extensions.exe	30
PID 2272 wrote to memory of 2280	2272	Casino_ext.exe	31
PID 2272 wrote to memory of 2280	2272	Casino_ext.exe	31
PID 2272 wrote to memory of 2280	2272	Casino_ext.exe	31
PID 2272 wrote to memory of 2280	2272	Casino_ext.exe	31
PID 2280 wrote to memory of 2444	2280	casino_extensions.exe	32
PID 2280 wrote to memory of 2444	2280	casino_extensions.exe	32
PID 2280 wrote to memory of 2444	2280	casino_extensions.exe	32
PID 2280 wrote to memory of 2444	2280	casino_extensions.exe	32
PID 2444 wrote to memory of 2152	2444	casino_extensions.exe	33
PID 2444 wrote to memory of 2152	2444	casino_extensions.exe	33
PID 2444 wrote to memory of 2152	2444	casino_extensions.exe	33
PID 2444 wrote to memory of 2152	2444	casino_extensions.exe	33

C:\Users\Admin\AppData\Local\Temp\3aaaa4f6eb0e7f4f2d497f3a2edf1260_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3aaaa4f6eb0e7f4f2d497f3a2edf1260_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
  "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\casino_extensions.exe
    C:\Windows\system32\casino_extensions.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:760
  - - C:\Windows\SysWOW64\Casino_ext.exe
      C:\Windows\SysWOW64\Casino_ext.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2272
    - - C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        5⤵
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2280
      - C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2444
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        7⤵
        Deletes itself
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\casino_extensions.exe

Filesize
346KB

MD5
94138e5a0e138c5229713dc0546ac43b

SHA1
805ffa99816d3cba9b3a71a9812d68bacd72d709

SHA256
9c157ca30a4d9acbc47f93b19747cb95fed6a06b78ab29cdcbe9520362d26083

SHA512
6955ef930a7c2cd783c1a7e434ac0c515850f973e97dc7fda5de049adcba5d1107c34b3f3a296b5aaf0ce3e24ed6e467e998e4322fa05371f88942392ee9b59c

Download Submit
\Windows\SysWOW64\casino_extensions.exe

Filesize
346KB

MD5
6cb0fd0b26f0be21c67815917b25bebb

SHA1
5999a60fe3c1c59f7de1f3071d90473c0fffb5f6

SHA256
e14bfed60cc6ab767502e3b46d001e365c24d24de8af9e9480aeb402453b7795

SHA512
d839555f09ef19089e1f962b08e981c5f21c378b0d78b8167b6591701d3c5de7dd6c883f03876ea77f28aeac53ab4f61e6387a68588f8fca3e4e646ab7bacbe3

Download Submit
memory/760-12-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2156-13-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing