635eb4e1771275f8e76ecbea800495c2cfe4cd888f5d0118d3e0b4f5d629898b

General

Target

9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe
Size

799KB
MD5

9ff9576a8de660d3d0e00849e4c1420e
SHA1

cd7bf7e3ab9d574aac00cd7dad84e9e35107fa41
SHA256

635eb4e1771275f8e76ecbea800495c2cfe4cd888f5d0118d3e0b4f5d629898b
SHA512

5e796e033db228b472cf110b83fc03377a0a34ea4e532224e4da1537558f7a49330a3e29c9f4c86385e862d44c28c57a40c907582dc92502bcb3d5dd17dd30c1
SSDEEP

24576:+EN973phvt8tmUdkw1x3b1hUTSnIFVyAVq:+EN973PvEL2w37UTSIT1

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2428-0-0x00000000008A0000-0x0000000000A17000-memory.dmp	upx
behavioral1/memory/2588-2-0x00000000008A0000-0x0000000000A17000-memory.dmp	upx
behavioral1/memory/2412-4-0x00000000008A0000-0x0000000000A17000-memory.dmp	upx
behavioral1/memory/2428-5-0x00000000008A0000-0x0000000000A17000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2428-5-0x00000000008A0000-0x0000000000A17000-memory.dmp	autoit_exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe
2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe
2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe
2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe
2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2588	2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe	28
PID 2428 wrote to memory of 2588	2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe	28
PID 2428 wrote to memory of 2588	2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe	28
PID 2428 wrote to memory of 2588	2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe	28
PID 2428 wrote to memory of 2056	2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe	29
PID 2428 wrote to memory of 2056	2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe	29
PID 2428 wrote to memory of 2056	2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe	29
PID 2428 wrote to memory of 2056	2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe	29
PID 2428 wrote to memory of 2468	2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe	30
PID 2428 wrote to memory of 2468	2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe	30
PID 2428 wrote to memory of 2468	2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe	30
PID 2428 wrote to memory of 2468	2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe	30
PID 2428 wrote to memory of 1728	2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe	31
PID 2428 wrote to memory of 1728	2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe	31
PID 2428 wrote to memory of 1728	2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe	31
PID 2428 wrote to memory of 1728	2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe	31
PID 2428 wrote to memory of 2444	2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe	32
PID 2428 wrote to memory of 2444	2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe	32
PID 2428 wrote to memory of 2444	2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe	32
PID 2428 wrote to memory of 2444	2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe	32
PID 2428 wrote to memory of 2412	2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe	33
PID 2428 wrote to memory of 2412	2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe	33
PID 2428 wrote to memory of 2412	2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe	33
PID 2428 wrote to memory of 2412	2428	9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Users\Admin\AppData\Local\Temp\9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe"
  2⤵
  PID:2588
- C:\Users\Admin\AppData\Local\Temp\9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe"
  2⤵
  PID:2056
- C:\Users\Admin\AppData\Local\Temp\9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe"
  2⤵
  PID:2468
- C:\Users\Admin\AppData\Local\Temp\9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe"
  2⤵
  PID:1728
- C:\Users\Admin\AppData\Local\Temp\9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe"
  2⤵
  PID:2444
- C:\Users\Admin\AppData\Local\Temp\9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\9ff9576a8de660d3d0e00849e4c1420e_JaffaCakes118.exe"
  2⤵
  PID:2412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2412-4-0x00000000008A0000-0x0000000000A17000-memory.dmp

Filesize
1.5MB

Download
memory/2428-0-0x00000000008A0000-0x0000000000A17000-memory.dmp

Filesize
1.5MB

Download
memory/2428-1-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2428-3-0x0000000002C40000-0x0000000002DB7000-memory.dmp

Filesize
1.5MB

Download
memory/2428-5-0x00000000008A0000-0x0000000000A17000-memory.dmp

Filesize
1.5MB

Download
memory/2588-2-0x00000000008A0000-0x0000000000A17000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing