5af20242a71fcf818933371a01e1881276b4454d8a32b0250cd491796716a396

General

Target

5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
Size

474KB
MD5

5745cf6f1e7c4baa569c3660bff915b3
SHA1

1e6ac100fbc24b0fe3216341cf3dc6b518982a74
SHA256

5af20242a71fcf818933371a01e1881276b4454d8a32b0250cd491796716a396
SHA512

8879d69a36b4ad81020e5aab5bc85172171f5f273fcb08385a75ec1426766529b680d0f9b0eba1b567f513ceb1f57e67b29f5a8aa22848e71708809a205e7f66
SSDEEP

6144:cEYewRh3hRDJoiEOGG1c0H3OsLoiBaOSIhJM4lIg5m3Mj2PRk5Adw8lRM:cEYXnDJoi9cCeyogau8k9jSRkwjM

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe

description	pid	process	target process
PID 2428 set thread context of 492	2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2328 492 WerFault.exe 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe

pid	pid_target	process	target process
2328	492	WerFault.exe	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe

pid	process
2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2428 5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe"
  2⤵
  PID:2192
- C:\Users\Admin\AppData\Local\Temp\5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 492 -s 292
    3⤵
    - Program crash
    PID:2328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/492-2-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/492-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/492-13-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/492-11-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/492-8-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/492-7-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/492-6-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/492-4-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/492-5-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2428-0-0x0000000074492000-0x0000000074494000-memory.dmp

Filesize
8KB

Download

description	pid	process	target process
PID 2428 wrote to memory of 2192	2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe	cmd.exe
PID 2428 wrote to memory of 2192	2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe	cmd.exe
PID 2428 wrote to memory of 2192	2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe	cmd.exe
PID 2428 wrote to memory of 2192	2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe	cmd.exe
PID 2428 wrote to memory of 492	2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
PID 2428 wrote to memory of 492	2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
PID 2428 wrote to memory of 492	2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
PID 2428 wrote to memory of 492	2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
PID 2428 wrote to memory of 492	2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
PID 2428 wrote to memory of 492	2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
PID 2428 wrote to memory of 492	2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
PID 2428 wrote to memory of 492	2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
PID 2428 wrote to memory of 492	2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
PID 2428 wrote to memory of 492	2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
PID 2428 wrote to memory of 492	2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
PID 2428 wrote to memory of 492	2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
PID 2428 wrote to memory of 492	2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
PID 2428 wrote to memory of 492	2428	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe
PID 492 wrote to memory of 2328	492	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe	WerFault.exe
PID 492 wrote to memory of 2328	492	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe	WerFault.exe
PID 492 wrote to memory of 2328	492	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe	WerFault.exe
PID 492 wrote to memory of 2328	492	5745cf6f1e7c4baa569c3660bff915b3_JaffaCakes118.exe	WerFault.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads