55fb3139ab6d06aa457772d58042355bfdaef42ec1d3e9395ba2be54b3b55f6e

General

Target

491c1ffbb6f56572746ea4430acd429c_JaffaCakes118.exe
Size

98KB
MD5

491c1ffbb6f56572746ea4430acd429c
SHA1

54cc16fee549edcb7d49d5366cb4a40a81821c83
SHA256

55fb3139ab6d06aa457772d58042355bfdaef42ec1d3e9395ba2be54b3b55f6e
SHA512

31477e99c44e5ff65baed5babee9624a10b862aa9cc3ff5f082473fba495be51c6d2b650715a535e9a9b904a9c96d6ce9a42531b4b568f71c07709664b4c2dba
SSDEEP

1536:s9WIjqMT9hvwXH2rYrGBK6QQpDj4c6ZkehlLaHk8l/apBLWR2mSjF:4WCqMphvO2rYrGI6a9PaE8l3R2/F

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1880-6-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/1880-7-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/1880-16-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/1880-15-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/1880-12-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/1880-13-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/1880-17-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/1880-19-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/1880-20-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/1880-23-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1724 set thread context of 1880	1724	491c1ffbb6f56572746ea4430acd429c_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1724	491c1ffbb6f56572746ea4430acd429c_JaffaCakes118.exe
1880	491c1ffbb6f56572746ea4430acd429c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1724	491c1ffbb6f56572746ea4430acd429c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1880	1724	491c1ffbb6f56572746ea4430acd429c_JaffaCakes118.exe	28
PID 1724 wrote to memory of 1880	1724	491c1ffbb6f56572746ea4430acd429c_JaffaCakes118.exe	28
PID 1724 wrote to memory of 1880	1724	491c1ffbb6f56572746ea4430acd429c_JaffaCakes118.exe	28
PID 1724 wrote to memory of 1880	1724	491c1ffbb6f56572746ea4430acd429c_JaffaCakes118.exe	28
PID 1724 wrote to memory of 1880	1724	491c1ffbb6f56572746ea4430acd429c_JaffaCakes118.exe	28
PID 1724 wrote to memory of 1880	1724	491c1ffbb6f56572746ea4430acd429c_JaffaCakes118.exe	28
PID 1724 wrote to memory of 1880	1724	491c1ffbb6f56572746ea4430acd429c_JaffaCakes118.exe	28
PID 1724 wrote to memory of 1880	1724	491c1ffbb6f56572746ea4430acd429c_JaffaCakes118.exe	28
PID 1724 wrote to memory of 1880	1724	491c1ffbb6f56572746ea4430acd429c_JaffaCakes118.exe	28
PID 1880 wrote to memory of 1368	1880	491c1ffbb6f56572746ea4430acd429c_JaffaCakes118.exe	21
PID 1880 wrote to memory of 1368	1880	491c1ffbb6f56572746ea4430acd429c_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1368
- C:\Users\Admin\AppData\Local\Temp\491c1ffbb6f56572746ea4430acd429c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\491c1ffbb6f56572746ea4430acd429c_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Users\Admin\AppData\Local\Temp\491c1ffbb6f56572746ea4430acd429c_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\491c1ffbb6f56572746ea4430acd429c_JaffaCakes118.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-22-0x0000000008E00000-0x0000000009201000-memory.dmp

Filesize
4.0MB

Download
memory/1368-21-0x0000000008E00000-0x0000000009201000-memory.dmp

Filesize
4.0MB

Download
memory/1724-14-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1724-3-0x0000000000200000-0x0000000000204000-memory.dmp

Filesize
16KB

Download
memory/1880-15-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1880-13-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/1880-16-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/1880-18-0x0000000000407000-0x0000000000409000-memory.dmp

Filesize
8KB

Download
memory/1880-0-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/1880-7-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/1880-12-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/1880-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1880-17-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/1880-19-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/1880-20-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1880-6-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/1880-2-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/1880-23-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing