7f46ecc361859d53ab9e251332f0f8b7180fc8b5adb3e20173ade248351cb8a3

General

Target

63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.exe
Size

4.4MB
MD5

63aeacb35276fe3cef142dd6648515d7
SHA1

7b1810390f2c1f29478629badda1bcae73ac946c
SHA256

7f46ecc361859d53ab9e251332f0f8b7180fc8b5adb3e20173ade248351cb8a3
SHA512

161c204e3b964f7d13ef95d4996b6e74489c215c07986faf241af035cf901547148f5172d177f0dc40b41431dc40195767341ba244beb7ab5ab1feada9ac0285
SSDEEP

98304:NumtqV/bmRA+cEL3HxrjYVd7BSEVxev2wDJeXQGVcyAuadPZ:smAlmRAoRrjY/xVwGVczndB

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp

pid process

500 63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp

pid	process
500	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp

Loads dropped DLL 8 IoCs

Processes:

63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.exe63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmpRunDll32.exeRunDll32.exe

pid	process
2232	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.exe
500	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp
500	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp
500	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp
2560	RunDll32.exe
2560	RunDll32.exe
2572	RunDll32.exe
2572	RunDll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

RunDll32.exeRunDll32.exe

pid	process
2560	RunDll32.exe
2560	RunDll32.exe
2572	RunDll32.exe
2572	RunDll32.exe
2560	RunDll32.exe
2560	RunDll32.exe
2572	RunDll32.exe
2572	RunDll32.exe
2560	RunDll32.exe
2560	RunDll32.exe
2572	RunDll32.exe
2572	RunDll32.exe
2560	RunDll32.exe
2560	RunDll32.exe
2572	RunDll32.exe
2572	RunDll32.exe
2560	RunDll32.exe
2560	RunDll32.exe
2572	RunDll32.exe
2572	RunDll32.exe
2560	RunDll32.exe
2560	RunDll32.exe
2572	RunDll32.exe
2572	RunDll32.exe
2560	RunDll32.exe
2560	RunDll32.exe
2572	RunDll32.exe
2572	RunDll32.exe
2560	RunDll32.exe
2560	RunDll32.exe
2572	RunDll32.exe
2572	RunDll32.exe
2560	RunDll32.exe
2560	RunDll32.exe
2572	RunDll32.exe
2572	RunDll32.exe
2560	RunDll32.exe
2560	RunDll32.exe
2572	RunDll32.exe
2572	RunDll32.exe
2560	RunDll32.exe
2560	RunDll32.exe
2572	RunDll32.exe
2572	RunDll32.exe
2560	RunDll32.exe
2560	RunDll32.exe
2572	RunDll32.exe
2572	RunDll32.exe
2560	RunDll32.exe
2560	RunDll32.exe
2572	RunDll32.exe
2572	RunDll32.exe
2560	RunDll32.exe
2560	RunDll32.exe
2572	RunDll32.exe
2572	RunDll32.exe
2560	RunDll32.exe
2560	RunDll32.exe
2572	RunDll32.exe
2572	RunDll32.exe
2560	RunDll32.exe
2560	RunDll32.exe
2572	RunDll32.exe
2572	RunDll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp

pid process

500 63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp

pid	process
500	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.exe63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp

description	pid	process	target process
PID 2232 wrote to memory of 500	2232	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.exe	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp
PID 2232 wrote to memory of 500	2232	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.exe	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp
PID 2232 wrote to memory of 500	2232	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.exe	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp
PID 2232 wrote to memory of 500	2232	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.exe	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp
PID 2232 wrote to memory of 500	2232	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.exe	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp
PID 2232 wrote to memory of 500	2232	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.exe	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp
PID 2232 wrote to memory of 500	2232	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.exe	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp
PID 500 wrote to memory of 2560	500	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp	RunDll32.exe
PID 500 wrote to memory of 2560	500	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp	RunDll32.exe
PID 500 wrote to memory of 2560	500	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp	RunDll32.exe
PID 500 wrote to memory of 2560	500	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp	RunDll32.exe
PID 500 wrote to memory of 2560	500	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp	RunDll32.exe
PID 500 wrote to memory of 2560	500	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp	RunDll32.exe
PID 500 wrote to memory of 2560	500	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp	RunDll32.exe
PID 500 wrote to memory of 2572	500	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp	RunDll32.exe
PID 500 wrote to memory of 2572	500	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp	RunDll32.exe
PID 500 wrote to memory of 2572	500	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp	RunDll32.exe
PID 500 wrote to memory of 2572	500	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp	RunDll32.exe
PID 500 wrote to memory of 2572	500	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp	RunDll32.exe
PID 500 wrote to memory of 2572	500	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp	RunDll32.exe
PID 500 wrote to memory of 2572	500	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp	RunDll32.exe

C:\Users\Admin\AppData\Local\Temp\63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\is-HAAVF.tmp\63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-HAAVF.tmp\63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp" /SL5="$400F4,4391114,54272,C:\Users\Admin\AppData\Local\Temp\63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:500
- - C:\Windows\SysWOW64\RunDll32.exe
    RunDll32.exe "C:\Users\Admin\AppData\Local\Temp\is-QOA1R.tmp\OCSetupHlp.dll",_OCPID990OpenCandy2@16 500,C7EAD0ACDE8F40F3BB5544D3A1BB6741,2D811F86C12C409B8F5100B84A40A4EC,B37CB390C1514D5A9DF920035C1A2E58
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2560
- - C:\Windows\SysWOW64\RunDll32.exe
    RunDll32.exe "C:\Users\Admin\AppData\Local\Temp\is-QOA1R.tmp\OCSetupHlp.dll",_OCPID990OpenCandy2@16 500,09FE777EE29D449AAA4B65A0E3C74380,5AB7700262964EC2B76ABF59C0C3D810,B37CB390C1514D5A9DF920035C1A2E58
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-HAAVF.tmp\63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp

Filesize
687KB

MD5
c49b0148cb58b886f60cb32eb5e81439

SHA1
9c64093d08c5ea02a3622f2b616546d3c67a2360

SHA256
fc13f965789a342dba0784492c2e2797ab92bdeaa6532e125b04be81675c0810

SHA512
70968fa616ff38b39e9b266c38f99e4b25a749d5f84706c3302e2e218cfcf9b18cc8bd2017d630ed27fc7e291a748477f23bb9d447745654d06ca58845ea918b

Download Submit
\Users\Admin\AppData\Local\Temp\is-QOA1R.tmp\OCSetupHlp.dll

Filesize
848KB

MD5
c4b2cc9449fcb66bf56a91b1bc43627f

SHA1
88eeb25b1c01af48186576b0b568db9d8cedb52b

SHA256
5bd5ed6122707728e1c5bc763679ba7261f550209d5ebf1fc3025533612e7e4a

SHA512
d6ba21ffa17bdc2e64805dfdbc9c44cba9f5f6e50a86b51a1e7b5afcaa9f72e36128048b96837065169c41759a54b41dffc569d6503cb474a100ea4eaec68a86

Download Submit
\Users\Admin\AppData\Local\Temp\is-QOA1R.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/500-14-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/500-26-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2232-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2232-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2232-25-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads