68bb910965e8cb69b2e757bdc5818db79426d79db3bcb33e8873060353fbbb4c

General

Target

75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
Size

554KB
MD5

75fe564730b0314934765a57b4b0f293
SHA1

1b087ca7247f7edc9699ff9a654b03185f035a32
SHA256

68bb910965e8cb69b2e757bdc5818db79426d79db3bcb33e8873060353fbbb4c
SHA512

430c2c1a16fa781ce122303fce46b082bd0a25e5ebda95a19afb6fdea14aff4e77eff91c63e9a16e7b206be7c711bd2a7fb34810fd7a6e278a3752909a701232
SSDEEP

12288:EzrE5jpAL/eFKgeiPyYUCoJlVdPX54TKrz:orENpsBLZYbexlz

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe

pid	process
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2868 75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868

C:\Users\Admin\AppData\Local\Temp\75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2⤵
PID:1800

C:\Users\Admin\AppData\Local\Temp\75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2⤵
PID:888

C:\Users\Admin\AppData\Local\Temp\75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2⤵
PID:2360

C:\Users\Admin\AppData\Local\Temp\75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2⤵
PID:2032

C:\Users\Admin\AppData\Local\Temp\75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2⤵
PID:1652

C:\Users\Admin\AppData\Local\Temp\75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2⤵
PID:1692

C:\Users\Admin\AppData\Local\Temp\75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2⤵
PID:2192

C:\Users\Admin\AppData\Local\Temp\75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2⤵
PID:1628

C:\Users\Admin\AppData\Local\Temp\75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2⤵
PID:2184

C:\Users\Admin\AppData\Local\Temp\75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
2⤵
PID:1716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2868-0-0x00000000745BE000-0x00000000745BF000-memory.dmp

Filesize
4KB

Download
memory/2868-1-0x00000000003A0000-0x0000000000430000-memory.dmp

Filesize
576KB

Download
memory/2868-2-0x0000000000530000-0x0000000000576000-memory.dmp

Filesize
280KB

Download
memory/2868-3-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download
memory/2868-4-0x0000000000690000-0x00000000006D4000-memory.dmp

Filesize
272KB

Download
memory/2868-5-0x00000000745BE000-0x00000000745BF000-memory.dmp

Filesize
4KB

Download
memory/2868-6-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download
memory/2868-7-0x0000000002380000-0x00000000023BC000-memory.dmp

Filesize
240KB

Download
memory/2868-8-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 2868 wrote to memory of 1800	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 1800	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 1800	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 1800	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 888	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 888	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 888	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 888	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 2360	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 2360	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 2360	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 2360	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 2032	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 2032	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 2032	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 2032	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 1652	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 1652	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 1652	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 1652	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 1692	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 1692	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 1692	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 1692	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 2192	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 2192	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 2192	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 2192	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 1628	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 1628	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 1628	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 1628	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 2184	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 2184	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 2184	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 2184	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 1716	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 1716	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 1716	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe
PID 2868 wrote to memory of 1716	2868	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe	75fe564730b0314934765a57b4b0f293_JaffaCakes118.exe

Analysis

Sharing