cdcaec719dfd70d7db6df0df1b014f247ffa6c10c0ec7a48fc22e55d75325143

General

Target

8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
Size

1.1MB
MD5

8fe8b78a1d42dd84dd5b7e928374fe95
SHA1

b5cc403f1068e016be85ab7c5ae36edd521c1171
SHA256

cdcaec719dfd70d7db6df0df1b014f247ffa6c10c0ec7a48fc22e55d75325143
SHA512

77cfe3f3bc8af921ba49f2984488d1b4a2523b1d3892d0c6b79b65632a1b10d86a56584b17797701165a0e187015f5cbc96b6f32665e0efed6c8510d5cd724b7
SSDEEP

24576:e78kPGeRwHMqH3XZk9SuvO2DZRE/ayis3jj3L8EL3sQa8:K8YRwHnH3XZksUzDaTjPRTsQa8

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000d00000001231c-5.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2616	restartok8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2616	restartok8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
2616	restartok8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2616	2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe	28
PID 2704 wrote to memory of 2616	2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe	28
PID 2704 wrote to memory of 2616	2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe	28
PID 2704 wrote to memory of 2616	2704	8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Users\Admin\AppData\Local\Temp\restartok8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\restartok8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe" ad
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\restartok8fe8b78a1d42dd84dd5b7e928374fe95_JaffaCakes118.exe

Filesize
1.1MB

MD5
8fe8b78a1d42dd84dd5b7e928374fe95

SHA1
b5cc403f1068e016be85ab7c5ae36edd521c1171

SHA256
cdcaec719dfd70d7db6df0df1b014f247ffa6c10c0ec7a48fc22e55d75325143

SHA512
77cfe3f3bc8af921ba49f2984488d1b4a2523b1d3892d0c6b79b65632a1b10d86a56584b17797701165a0e187015f5cbc96b6f32665e0efed6c8510d5cd724b7

Download Submit
memory/2616-12-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2616-40-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2616-38-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2616-10-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2616-36-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2616-21-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2616-32-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2616-30-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2616-15-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2616-28-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2616-17-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2616-19-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2616-24-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2704-13-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2704-31-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2704-20-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2704-27-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2704-16-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2704-29-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2704-14-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2704-23-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2704-0-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2704-35-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2704-11-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2704-37-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2704-9-0x0000000005920000-0x0000000005CD9000-memory.dmp

Filesize
3.7MB

Download
memory/2704-39-0x0000000000400000-0x00000000007B9000-memory.dmp

Filesize
3.7MB

Download
memory/2704-1-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing