d911ad1528f02f8d80735b04dcc7629d4811d7b32e9c9d2fd007a9b6b341ee91

General

Target

3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
Size

67KB
MD5

3e16f819b1ba02f54c0eb5d369cc5418
SHA1

13c8d748e34230a91643a2c0a9be94aa27cff826
SHA256

d911ad1528f02f8d80735b04dcc7629d4811d7b32e9c9d2fd007a9b6b341ee91
SHA512

df8c829e930f9780c232896440553030476cc96a9cb8027e96a8ae9d82ba73130419f173bad0604400610c96f73e4c084a1eb3aef220524bdf467b0febd573e8
SSDEEP

1536:6lM3UCxVlATYPRM4BmL62ehmWAM1RremQpjnzCXHdfsKqk:l3UCxETcRM4Bm4rjKNpjzALqk

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2888 set thread context of 1720	2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 1720	2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe	28
PID 2888 wrote to memory of 1720	2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe	28
PID 2888 wrote to memory of 1720	2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe	28
PID 2888 wrote to memory of 1720	2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe	28
PID 2888 wrote to memory of 1720	2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe	28
PID 2888 wrote to memory of 1720	2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe	28
PID 2888 wrote to memory of 1720	2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe	28
PID 2888 wrote to memory of 1720	2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe	28
PID 2888 wrote to memory of 1720	2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe	28
PID 2888 wrote to memory of 1720	2888	3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Local\Temp\3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3e16f819b1ba02f54c0eb5d369cc5418_JaffaCakes118.exe"
  2⤵
  PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-8-0x0000000000420000-0x00000000004E9000-memory.dmp

Filesize
804KB

Download
memory/1720-13-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1720-16-0x0000000003BD0000-0x0000000003BE7000-memory.dmp

Filesize
92KB

Download
memory/1720-19-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1720-6-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1720-9-0x00000000004F0000-0x000000000058F000-memory.dmp

Filesize
636KB

Download
memory/1720-12-0x00000000007A0000-0x0000000000811000-memory.dmp

Filesize
452KB

Download
memory/1720-14-0x0000000002140000-0x0000000002249000-memory.dmp

Filesize
1.0MB

Download
memory/1720-10-0x00000000003C0000-0x00000000003DF000-memory.dmp

Filesize
124KB

Download
memory/1720-11-0x0000000000670000-0x000000000079D000-memory.dmp

Filesize
1.2MB

Download
memory/1720-15-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2888-1-0x00000000004E0000-0x000000000057F000-memory.dmp

Filesize
636KB

Download
memory/2888-2-0x00000000001D0000-0x00000000001EF000-memory.dmp

Filesize
124KB

Download
memory/2888-4-0x0000000000A60000-0x0000000000B69000-memory.dmp

Filesize
1.0MB

Download
memory/2888-5-0x0000000002130000-0x0000000002147000-memory.dmp

Filesize
92KB

Download
memory/2888-3-0x0000000000660000-0x000000000078D000-memory.dmp

Filesize
1.2MB

Download
memory/2888-0-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads