7f46ecc361859d53ab9e251332f0f8b7180fc8b5adb3e20173ade248351cb8a3

General

Target

63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.exe
Size

4.4MB
MD5

63aeacb35276fe3cef142dd6648515d7
SHA1

7b1810390f2c1f29478629badda1bcae73ac946c
SHA256

7f46ecc361859d53ab9e251332f0f8b7180fc8b5adb3e20173ade248351cb8a3
SHA512

161c204e3b964f7d13ef95d4996b6e74489c215c07986faf241af035cf901547148f5172d177f0dc40b41431dc40195767341ba244beb7ab5ab1feada9ac0285
SSDEEP

98304:NumtqV/bmRA+cEL3HxrjYVd7BSEVxev2wDJeXQGVcyAuadPZ:smAlmRAoRrjY/xVwGVczndB

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp

pid process

1456 63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp
Loads dropped DLL 3 IoCs

Processes:

63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmpRunDll32.exeRunDll32.exe

pid process

1456 63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp
2624 RunDll32.exe
228 RunDll32.exe

pid	process
1456	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp

pid	process
1456	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp
2624	RunDll32.exe
228	RunDll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

RunDll32.exeRunDll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.exe63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp

description	pid	process	target process
PID 2896 wrote to memory of 1456	2896	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.exe	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp
PID 2896 wrote to memory of 1456	2896	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.exe	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp
PID 2896 wrote to memory of 1456	2896	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.exe	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp
PID 1456 wrote to memory of 2624	1456	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp	RunDll32.exe
PID 1456 wrote to memory of 2624	1456	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp	RunDll32.exe
PID 1456 wrote to memory of 2624	1456	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp	RunDll32.exe
PID 1456 wrote to memory of 228	1456	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp	RunDll32.exe
PID 1456 wrote to memory of 228	1456	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp	RunDll32.exe
PID 1456 wrote to memory of 228	1456	63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp	RunDll32.exe

C:\Users\Admin\AppData\Local\Temp\63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Users\Admin\AppData\Local\Temp\is-E9U6N.tmp\63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-E9U6N.tmp\63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp" /SL5="$401EE,4391114,54272,C:\Users\Admin\AppData\Local\Temp\63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\SysWOW64\RunDll32.exe
    RunDll32.exe "C:\Users\Admin\AppData\Local\Temp\is-11K3E.tmp\OCSetupHlp.dll",_OCPID990OpenCandy2@16 1456,80D316BEABAE45288A3177ECCF34A86B,8F51ADCC8AE64618A437F732A3C6B15D,2E186452FAB54F12A2EE08DF258FE5AD
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2624
- - C:\Windows\SysWOW64\RunDll32.exe
    RunDll32.exe "C:\Users\Admin\AppData\Local\Temp\is-11K3E.tmp\OCSetupHlp.dll",_OCPID990OpenCandy2@16 1456,6B72F630595B40788546FD513E3B9E94,671E4B42D27445A29ACB74690C2A193A,2E186452FAB54F12A2EE08DF258FE5AD
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:228

C:\Users\Admin\AppData\Local\Temp\is-11K3E.tmp\OCSetupHlp.dll

Filesize
848KB

MD5
c4b2cc9449fcb66bf56a91b1bc43627f

SHA1
88eeb25b1c01af48186576b0b568db9d8cedb52b

SHA256
5bd5ed6122707728e1c5bc763679ba7261f550209d5ebf1fc3025533612e7e4a

SHA512
d6ba21ffa17bdc2e64805dfdbc9c44cba9f5f6e50a86b51a1e7b5afcaa9f72e36128048b96837065169c41759a54b41dffc569d6503cb474a100ea4eaec68a86

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-E9U6N.tmp\63aeacb35276fe3cef142dd6648515d7_JaffaCakes118.tmp

Filesize
687KB

MD5
c49b0148cb58b886f60cb32eb5e81439

SHA1
9c64093d08c5ea02a3622f2b616546d3c67a2360

SHA256
fc13f965789a342dba0784492c2e2797ab92bdeaa6532e125b04be81675c0810

SHA512
70968fa616ff38b39e9b266c38f99e4b25a749d5f84706c3302e2e218cfcf9b18cc8bd2017d630ed27fc7e291a748477f23bb9d447745654d06ca58845ea918b

Download Submit
memory/1456-11-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1456-22-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2624-19-0x0000000000F10000-0x0000000000F11000-memory.dmp

Filesize
4KB

Download
memory/2624-25-0x0000000000F10000-0x0000000000F11000-memory.dmp

Filesize
4KB

Download
memory/2896-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2896-3-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2896-21-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download