5ad3b7911bc4af42e099d2d7a446a1a16758e945c1819789f23ec9932141d3ed

General

Target

6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
Size

73KB
MD5

6928d09edc772ec62a96d7dd12c4263f
SHA1

4b6834ec56a7216060022484d6652b9018815ff5
SHA256

5ad3b7911bc4af42e099d2d7a446a1a16758e945c1819789f23ec9932141d3ed
SHA512

fb852b73c930007a71550cb860cf6a4cfde14eb87903369d87fc548a64e76218e054d884c09f49e7b6717293e7359aaf73208f202373675b204bc3b1a56736c1
SSDEEP

768:ExvIJcoBGD4f6aihT3i3PQqquU3AztLYuPpZJUmTYbKdINbGka9/FWiUDjZ/vF8r:OgJI4v+3uPquRZJUWc499OTQd

Score

7^/10

upx

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4480-4-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/4480-1-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral2/memory/4480-5-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral2/memory/4480-8-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral2/memory/4480-7-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral2/memory/4480-9-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/4480-11-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/4480-12-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral2/memory/4480-13-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/4480-15-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/4480-18-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/4480-20-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/4480-22-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/4480-24-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe

description	pid	process	target process
PID 1296 set thread context of 4480	1296	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe

pid	process
1296	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
1296	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
4480	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
4480	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
4480	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
4480	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
4480	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
4480	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
4480	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
4480	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
4480	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
4480	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
4480	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
4480	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
4480	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
4480	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe

pid process

1296 6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe

description	pid	process	target process
PID 1296 wrote to memory of 4480	1296	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
PID 1296 wrote to memory of 4480	1296	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
PID 1296 wrote to memory of 4480	1296	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
PID 1296 wrote to memory of 4480	1296	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
PID 1296 wrote to memory of 4480	1296	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
PID 1296 wrote to memory of 4480	1296	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
PID 1296 wrote to memory of 4480	1296	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
PID 1296 wrote to memory of 4480	1296	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
PID 1296 wrote to memory of 4480	1296	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe	6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6928d09edc772ec62a96d7dd12c4263f_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4364,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
1⤵
PID:4140

memory/1296-0-0x0000000000B20000-0x0000000000B24000-memory.dmp

Filesize
16KB

Download
memory/1296-3-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4480-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4480-1-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/4480-5-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/4480-8-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/4480-7-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/4480-9-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4480-11-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4480-12-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/4480-13-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4480-15-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4480-18-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4480-20-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4480-22-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4480-24-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download