90a6b384e8e790e293834a4133d8caec236dcd46b31e6e9915e15bce04d7ae1b

General

Target

4af0d6d7753c077d95522825a29cd54b_JaffaCakes118.exe
Size

6.3MB
MD5

4af0d6d7753c077d95522825a29cd54b
SHA1

61aa04997d126a2c7b54802ba0b8c29a8d3998b5
SHA256

90a6b384e8e790e293834a4133d8caec236dcd46b31e6e9915e15bce04d7ae1b
SHA512

b5764f7b60a53083bc98635e884cee6895b1d47cbaf0c48c2c3a3972d6af6dcea2f012cb1c5877c6d873c9c6bc4398b21bc270c6ea1d1d7f2b9876f256a0f922
SSDEEP

98304:+zeoDRJ/WoD1rHJMMMMMMMMMMMMMMMMMMp2MMMMMMMMMMMMMMMMMMX/nlpsuaZXr:Se0JvoOH9Ngk

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2388 set thread context of 2420	2388	4af0d6d7753c077d95522825a29cd54b_JaffaCakes118.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	4af0d6d7753c077d95522825a29cd54b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2420	4af0d6d7753c077d95522825a29cd54b_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2420	4af0d6d7753c077d95522825a29cd54b_JaffaCakes118.exe
2420	4af0d6d7753c077d95522825a29cd54b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2420	2388	4af0d6d7753c077d95522825a29cd54b_JaffaCakes118.exe	28
PID 2388 wrote to memory of 2420	2388	4af0d6d7753c077d95522825a29cd54b_JaffaCakes118.exe	28
PID 2388 wrote to memory of 2420	2388	4af0d6d7753c077d95522825a29cd54b_JaffaCakes118.exe	28
PID 2388 wrote to memory of 2420	2388	4af0d6d7753c077d95522825a29cd54b_JaffaCakes118.exe	28
PID 2388 wrote to memory of 2420	2388	4af0d6d7753c077d95522825a29cd54b_JaffaCakes118.exe	28
PID 2388 wrote to memory of 2420	2388	4af0d6d7753c077d95522825a29cd54b_JaffaCakes118.exe	28
PID 2388 wrote to memory of 2420	2388	4af0d6d7753c077d95522825a29cd54b_JaffaCakes118.exe	28
PID 2388 wrote to memory of 2420	2388	4af0d6d7753c077d95522825a29cd54b_JaffaCakes118.exe	28
PID 2388 wrote to memory of 2420	2388	4af0d6d7753c077d95522825a29cd54b_JaffaCakes118.exe	28
PID 2388 wrote to memory of 2420	2388	4af0d6d7753c077d95522825a29cd54b_JaffaCakes118.exe	28
PID 2388 wrote to memory of 2420	2388	4af0d6d7753c077d95522825a29cd54b_JaffaCakes118.exe	28
PID 2388 wrote to memory of 2420	2388	4af0d6d7753c077d95522825a29cd54b_JaffaCakes118.exe	28
PID 2388 wrote to memory of 2420	2388	4af0d6d7753c077d95522825a29cd54b_JaffaCakes118.exe	28
PID 2388 wrote to memory of 2420	2388	4af0d6d7753c077d95522825a29cd54b_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\4af0d6d7753c077d95522825a29cd54b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4af0d6d7753c077d95522825a29cd54b_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\Temp\4af0d6d7753c077d95522825a29cd54b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\4af0d6d7753c077d95522825a29cd54b_JaffaCakes118.exe" ""
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2388-25-0x0000000000400000-0x00000000009DE000-memory.dmp

Filesize
5.9MB

Download
memory/2388-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2420-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2420-17-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/2420-13-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/2420-24-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/2420-23-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/2420-1-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/2420-21-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/2420-26-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/2420-10-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/2420-3-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/2420-15-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/2420-11-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/2420-7-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/2420-5-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/2420-22-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/2420-27-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/2420-28-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/2420-41-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download

Analysis

Sharing