71cd66ce3f802e5c36f7dfaea6d8368975043ceaddf2418bdf02bc041621996a

General

Target

a37728f7e73ab0eb804db1dbcafe7a39_JaffaCakes118.exe
Size

89KB
MD5

a37728f7e73ab0eb804db1dbcafe7a39
SHA1

ffaa23befcb74c659344a8dd4c93ea03e936f440
SHA256

71cd66ce3f802e5c36f7dfaea6d8368975043ceaddf2418bdf02bc041621996a
SHA512

eafc4865868ff235f053354a1cff2751a4105463e80366b2c4b1baed1a7a78af62af72245099282449cc3441be8c0e85e6d15d77e7dca98c8dff280c3362e604
SSDEEP

1536:IbPEJEPu7Tves4SCjUBCMlYmAskNPmJ4R21I59RHxNnt:IbPEb/4xjUA/mAskNI4R21uRHxr

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2772-11-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/2772-8-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/2772-18-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/2772-15-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/2772-5-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/2772-16-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/2772-14-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/2772-13-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral1/memory/2772-21-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/2772-23-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/2772-25-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/2772-27-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/2772-30-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/2772-32-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2084 set thread context of 2772	2084	a37728f7e73ab0eb804db1dbcafe7a39_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2084	a37728f7e73ab0eb804db1dbcafe7a39_JaffaCakes118.exe
2772	a37728f7e73ab0eb804db1dbcafe7a39_JaffaCakes118.exe
2772	a37728f7e73ab0eb804db1dbcafe7a39_JaffaCakes118.exe
2772	a37728f7e73ab0eb804db1dbcafe7a39_JaffaCakes118.exe
2772	a37728f7e73ab0eb804db1dbcafe7a39_JaffaCakes118.exe
2772	a37728f7e73ab0eb804db1dbcafe7a39_JaffaCakes118.exe
2772	a37728f7e73ab0eb804db1dbcafe7a39_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2084	a37728f7e73ab0eb804db1dbcafe7a39_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2772	2084	a37728f7e73ab0eb804db1dbcafe7a39_JaffaCakes118.exe	28
PID 2084 wrote to memory of 2772	2084	a37728f7e73ab0eb804db1dbcafe7a39_JaffaCakes118.exe	28
PID 2084 wrote to memory of 2772	2084	a37728f7e73ab0eb804db1dbcafe7a39_JaffaCakes118.exe	28
PID 2084 wrote to memory of 2772	2084	a37728f7e73ab0eb804db1dbcafe7a39_JaffaCakes118.exe	28
PID 2084 wrote to memory of 2772	2084	a37728f7e73ab0eb804db1dbcafe7a39_JaffaCakes118.exe	28
PID 2084 wrote to memory of 2772	2084	a37728f7e73ab0eb804db1dbcafe7a39_JaffaCakes118.exe	28
PID 2084 wrote to memory of 2772	2084	a37728f7e73ab0eb804db1dbcafe7a39_JaffaCakes118.exe	28
PID 2084 wrote to memory of 2772	2084	a37728f7e73ab0eb804db1dbcafe7a39_JaffaCakes118.exe	28
PID 2084 wrote to memory of 2772	2084	a37728f7e73ab0eb804db1dbcafe7a39_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\a37728f7e73ab0eb804db1dbcafe7a39_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a37728f7e73ab0eb804db1dbcafe7a39_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\a37728f7e73ab0eb804db1dbcafe7a39_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a37728f7e73ab0eb804db1dbcafe7a39_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2084-3-0x00000000002F0000-0x00000000002F4000-memory.dmp

Filesize
16KB

Download
memory/2772-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2772-14-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/2772-11-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/2772-8-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/2772-18-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2772-17-0x0000000000407000-0x0000000000409000-memory.dmp

Filesize
8KB

Download
memory/2772-15-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/2772-0-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/2772-2-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/2772-5-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/2772-16-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/2772-13-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/2772-21-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2772-23-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2772-25-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2772-27-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2772-30-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2772-32-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing