6972f302970bc0160eb9ba2ae99c920e711279c4b0549b0ae75205992bf215db

General

Target

2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
Size

77KB
MD5

2c3c240fc01a87d7fa78a4918fe046e0
SHA1

a6f17088c6fdcdf0fdc27aa96cbc51d0c1ef6660
SHA256

6972f302970bc0160eb9ba2ae99c920e711279c4b0549b0ae75205992bf215db
SHA512

8f9e4af29a1f40103ed472a395ddc0963db91cdfe09f1d389646e30f7411c637e94239f449f92cb5f4cdad3f2f89c84090ec15b7e446750c268b42f6d0b564a3
SSDEEP

1536:qJ/J/ab9jsNyEXwjpHQ1E8yvCBlWUXxlO50uus:y/MjsdwjpHn96BQUXxE50ps

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2488-14-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/2488-11-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/2488-8-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/2488-5-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/2488-12-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/2488-13-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/2488-4-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/2488-15-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/2488-16-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/2488-18-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/2488-20-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/2488-22-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/2488-25-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/2488-27-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/2488-29-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2892 set thread context of 2488	2892	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2892	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
2488	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
2488	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
2488	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
2488	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
2488	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
2488	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2892	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
2892	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2488	2892	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe	28
PID 2892 wrote to memory of 2488	2892	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe	28
PID 2892 wrote to memory of 2488	2892	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe	28
PID 2892 wrote to memory of 2488	2892	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe	28
PID 2892 wrote to memory of 2488	2892	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe	28
PID 2892 wrote to memory of 2488	2892	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe	28
PID 2892 wrote to memory of 2488	2892	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe	28
PID 2892 wrote to memory of 2488	2892	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe	28
PID 2892 wrote to memory of 2488	2892	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Users\Admin\AppData\Local\Temp\2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2488-12-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/2488-4-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/2488-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2488-13-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/2488-14-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2488-11-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/2488-8-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/2488-5-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/2488-29-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2488-0-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/2488-3-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/2488-15-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/2488-16-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2488-18-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2488-20-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2488-22-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2488-25-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2488-27-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2892-9-0x0000000000280000-0x0000000000284000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing