9d8bb8d5342c8a9ac846ff3b8584d2d374ba575f0a18b61d43ca00ff0b02cfeb

General

Target

a3c497b7184d71ca5b2d9d6907341d54_JaffaCakes118.exe
Size

68KB
MD5

a3c497b7184d71ca5b2d9d6907341d54
SHA1

a0d2babc444b5a1e9853b7597f4eb238aae987cb
SHA256

9d8bb8d5342c8a9ac846ff3b8584d2d374ba575f0a18b61d43ca00ff0b02cfeb
SHA512

f43b2691f0b27b93bf06b30946b091585b0b352e59f330b0bab248e958abece307ad0dcb733f3825c17fa5ff9db3bc44d5a8ab4ea286d6c552c64b354b365eba
SSDEEP

1536:lUHuE2VpZz8O+LpzOaYO8FsxaqWk6P86HBbXj:lUHuE27Zz3wzOaV86aqqP8QB7j

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2072-11-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/2072-9-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/2072-15-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2072-6-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/2072-13-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/2072-5-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/2072-14-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/2072-12-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/2072-16-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2072-18-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2072-19-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2072-20-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2072-21-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2072-22-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2072-24-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2072-26-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2072-27-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2072-28-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2072-29-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1548 set thread context of 2072	1548	a3c497b7184d71ca5b2d9d6907341d54_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1548	a3c497b7184d71ca5b2d9d6907341d54_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1548	a3c497b7184d71ca5b2d9d6907341d54_JaffaCakes118.exe
1548	a3c497b7184d71ca5b2d9d6907341d54_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2072	1548	a3c497b7184d71ca5b2d9d6907341d54_JaffaCakes118.exe	28
PID 1548 wrote to memory of 2072	1548	a3c497b7184d71ca5b2d9d6907341d54_JaffaCakes118.exe	28
PID 1548 wrote to memory of 2072	1548	a3c497b7184d71ca5b2d9d6907341d54_JaffaCakes118.exe	28
PID 1548 wrote to memory of 2072	1548	a3c497b7184d71ca5b2d9d6907341d54_JaffaCakes118.exe	28
PID 1548 wrote to memory of 2072	1548	a3c497b7184d71ca5b2d9d6907341d54_JaffaCakes118.exe	28
PID 1548 wrote to memory of 2072	1548	a3c497b7184d71ca5b2d9d6907341d54_JaffaCakes118.exe	28
PID 1548 wrote to memory of 2072	1548	a3c497b7184d71ca5b2d9d6907341d54_JaffaCakes118.exe	28
PID 1548 wrote to memory of 2072	1548	a3c497b7184d71ca5b2d9d6907341d54_JaffaCakes118.exe	28
PID 1548 wrote to memory of 2072	1548	a3c497b7184d71ca5b2d9d6907341d54_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\a3c497b7184d71ca5b2d9d6907341d54_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3c497b7184d71ca5b2d9d6907341d54_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Users\Admin\AppData\Local\Temp\a3c497b7184d71ca5b2d9d6907341d54_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\a3c497b7184d71ca5b2d9d6907341d54_JaffaCakes118.exe
  2⤵
  PID:2072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-1-0x0000000000290000-0x0000000000294000-memory.dmp

Filesize
16KB

Download
memory/2072-0-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/2072-11-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2072-9-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2072-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2072-6-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2072-13-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2072-5-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2072-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2072-4-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2072-14-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2072-12-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2072-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2072-18-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2072-19-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2072-20-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2072-21-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2072-22-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2072-24-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2072-26-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2072-27-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2072-28-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2072-29-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing