accb399db6dbdcadd7022d05a258993119e3abeed04394921ae0aa14b2b468bf

General

Target

35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
Size

472KB
MD5

35d38360b8f7bfe5ecc9dd3b5c1eabec
SHA1

c0d74936f84101199acf01a9e5951478f2cf91ba
SHA256

accb399db6dbdcadd7022d05a258993119e3abeed04394921ae0aa14b2b468bf
SHA512

2a3a851a4090936a15c9d9cbe391afd82906ff66ec913daeead0d56098429b5ed76e0aa7d6cda845de3130c417681fd09154c4a9c9907237a934f8036aac532b
SSDEEP

6144:YKAGqv0MkNUfrQVSSpn9FXDi57PXF0jB5IX3R7FGb7:YK3qUArQVSUWMB52RpGP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1452 2504 WerFault.exe 35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe

pid	pid_target	process	target process
1452	2504	WerFault.exe	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe

pid	process
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe

pid process

2504 35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
2504 35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe

description	pid	process	target process
PID 2504 wrote to memory of 3412	2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
PID 2504 wrote to memory of 3412	2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
PID 2504 wrote to memory of 3412	2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
PID 2504 wrote to memory of 992	2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
PID 2504 wrote to memory of 992	2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
PID 2504 wrote to memory of 992	2504	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe	35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2504

C:\Users\Admin\AppData\Local\Temp\35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe"
2⤵
PID:3412

C:\Users\Admin\AppData\Local\Temp\35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118.exe"
2⤵
PID:992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 328
2⤵
- Program crash
PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2504 -ip 2504
1⤵
PID:1656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2504-10-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-9-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-18-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-17-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-16-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-15-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-14-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-13-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-12-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-11-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-36-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-8-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-7-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-6-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-34-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-35-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-21-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-41-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-40-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-39-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-38-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-37-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-33-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-32-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-31-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-30-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-29-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-28-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-27-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-26-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-25-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-24-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-23-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-22-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-20-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-19-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-5-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-4-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-3-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-2-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-1-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2504-0-0x0000000000F30000-0x0000000000F36000-memory.dmp

Filesize
24KB

Download

Resubmissions

Analysis

Sharing