3c063412ae9ca49bd87c198dcfdad8ba765d4e858121ba334d9a4cea1b3dbdc4

General

Target

2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
Size

67KB
MD5

2af4d1c02df88c54986362e7c267887a
SHA1

3b857ccb7b09a7b5f1c63a662b84df80f8ddd82d
SHA256

3c063412ae9ca49bd87c198dcfdad8ba765d4e858121ba334d9a4cea1b3dbdc4
SHA512

8f283a7c787e1f172cc9ee1db55fc3bc9d5c973f801aee50017101049f39453b80a9239674d2530eda2afe16ccd79db3114d72fcec94bb604d53f1630be8a2d7
SSDEEP

1536:6lM3UCxVlATYP8M4BmLHY3QZZXoVgfhjQ1jxXAfexr:l3UCxETc8M4BmsA/4VwjQGi

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1276 set thread context of 1728	1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1728	1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe	28
PID 1276 wrote to memory of 1728	1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe	28
PID 1276 wrote to memory of 1728	1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe	28
PID 1276 wrote to memory of 1728	1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe	28
PID 1276 wrote to memory of 1728	1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe	28
PID 1276 wrote to memory of 1728	1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe	28
PID 1276 wrote to memory of 1728	1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe	28
PID 1276 wrote to memory of 1728	1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe	28
PID 1276 wrote to memory of 1728	1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe	28
PID 1276 wrote to memory of 1728	1276	2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Users\Admin\AppData\Local\Temp\2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2af4d1c02df88c54986362e7c267887a_JaffaCakes118.exe"
  2⤵
  PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1276-0-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download
memory/1276-2-0x0000000000160000-0x000000000017F000-memory.dmp

Filesize
124KB

Download
memory/1276-3-0x0000000000660000-0x000000000078D000-memory.dmp

Filesize
1.2MB

Download
memory/1276-4-0x0000000000AD0000-0x0000000000BD9000-memory.dmp

Filesize
1.0MB

Download
memory/1276-1-0x00000000004E0000-0x000000000057F000-memory.dmp

Filesize
636KB

Download
memory/1276-5-0x00000000008F0000-0x0000000000907000-memory.dmp

Filesize
92KB

Download
memory/1728-9-0x0000000000420000-0x00000000004BF000-memory.dmp

Filesize
636KB

Download
memory/1728-12-0x0000000000810000-0x0000000000881000-memory.dmp

Filesize
452KB

Download
memory/1728-11-0x00000000006E0000-0x000000000080D000-memory.dmp

Filesize
1.2MB

Download
memory/1728-10-0x0000000000380000-0x000000000039F000-memory.dmp

Filesize
124KB

Download
memory/1728-8-0x00000000002B0000-0x0000000000379000-memory.dmp

Filesize
804KB

Download
memory/1728-7-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1728-17-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1728-16-0x0000000003BD0000-0x0000000003BE7000-memory.dmp

Filesize
92KB

Download
memory/1728-15-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1728-14-0x0000000002140000-0x0000000002249000-memory.dmp

Filesize
1.0MB

Download
memory/1728-13-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads