0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4

General

Target

7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
Size

112KB
MD5

7623aee5db5091f7be1128afd257e749
SHA1

3c62076897cac52c4d3a5ed5c8df02e0a3ac34e1
SHA256

0eb082c5268f5d6def009abef86510350b58e20c43882c246529860477d64cc4
SHA512

bcd9a83285523f65c200b9f0e39f8341afca7c4c3bd528ccc948d8b2a0789e4c384eb60c003b45d295bbd45b4733edadd5096e3478b5462345e9fa8b627401ce
SSDEEP

1536:/45WwBVPNhtM5n8CGHUB9kncTdyVvEEEB21WVSumo5RsGQHY36uxQ/CPBF55:Q5JdyEHu9knEcE3BgqStwQHYquxQyBt

Score

8^/10

upx

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\protocol	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1676-3-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1676-5-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1676-7-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1676-8-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1676-9-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1676-10-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1676-12-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1676-13-0x0000000000400000-0x000000000047B000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3192 set thread context of 1676	3192	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe	92

Program crash 1 IoCs

pid	pid_target	Process	procid_target
988	1676	WerFault.exe	92

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1676	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 1676	3192	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe	92
PID 3192 wrote to memory of 1676	3192	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe	92
PID 3192 wrote to memory of 1676	3192	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe	92
PID 3192 wrote to memory of 1676	3192	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe	92
PID 3192 wrote to memory of 1676	3192	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe	92
PID 3192 wrote to memory of 1676	3192	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe	92
PID 3192 wrote to memory of 1676	3192	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe	92
PID 3192 wrote to memory of 1676	3192	7623aee5db5091f7be1128afd257e749_JaffaCakes118.exe	92

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1676 -ip 1676
1⤵
PID:1520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:3112

memory/1676-3-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1676-5-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1676-7-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1676-8-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1676-9-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1676-10-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1676-12-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1676-13-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3192-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/3192-2-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/3192-6-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download