bc6a63b07a18d95278dee0e0d77c1e91d4a80bfca9732f030ce069894f610b14

General

Target

a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe
Size

920KB
MD5

a7f29df168c669851c1979dbc41c95b2
SHA1

46d9da6397c063544cdd8dc9b9f8a65142aefa40
SHA256

bc6a63b07a18d95278dee0e0d77c1e91d4a80bfca9732f030ce069894f610b14
SHA512

79c92ba1352bff8f8f705b325a91196c867d45939ecf2bafac386c192637990d8a212d52b31bfb249794c28c1d1bee0c663ba827983b2fbb803271ca3446d0c6
SSDEEP

12288:avF4/h43r4Qmwl5i5bpKSAoBVWeJAJ9OtRsQuRXBS5w6jLCMkDjUW4cg083trAuS:dQTlYpk0xAyRbw3D

Score

9^/10

rezer0

Malware Config

Signatures

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/2448-4-0x00000000081B0000-0x0000000008260000-memory.dmp	rezer0

Deletes itself 1 IoCs

Processes:

powershell.exe

pid process

1616 powershell.exe

pid	process
1616	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe

description	pid	process	target process
PID 2448 set thread context of 2712	2448	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1616 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2712 a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe
Token: SeDebugPrivilege 1616 powershell.exe

pid	process
1616	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2712	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe
Token: SeDebugPrivilege	1616	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exea7f29df168c669851c1979dbc41c95b2_JaffaCakes118.execmd.exe

description	pid	process	target process
PID 2448 wrote to memory of 2712	2448	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe
PID 2448 wrote to memory of 2712	2448	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe
PID 2448 wrote to memory of 2712	2448	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe
PID 2448 wrote to memory of 2712	2448	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe
PID 2448 wrote to memory of 2712	2448	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe
PID 2448 wrote to memory of 2712	2448	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe
PID 2448 wrote to memory of 2712	2448	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe
PID 2448 wrote to memory of 2712	2448	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe
PID 2448 wrote to memory of 2712	2448	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe
PID 2712 wrote to memory of 828	2712	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe	cmd.exe
PID 2712 wrote to memory of 828	2712	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe	cmd.exe
PID 2712 wrote to memory of 828	2712	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe	cmd.exe
PID 2712 wrote to memory of 828	2712	a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe	cmd.exe
PID 828 wrote to memory of 1616	828	cmd.exe	powershell.exe
PID 828 wrote to memory of 1616	828	cmd.exe	powershell.exe
PID 828 wrote to memory of 1616	828	cmd.exe	powershell.exe
PID 828 wrote to memory of 1616	828	cmd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2448

C:\Users\Admin\AppData\Local\Temp\a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe
"{path}"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712

C:\Windows\SysWOW64\cmd.exe
"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe' & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:828

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\a7f29df168c669851c1979dbc41c95b2_JaffaCakes118.exe'
4⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1616

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2448-0-0x000000007478E000-0x000000007478F000-memory.dmp

Filesize
4KB

Download
memory/2448-1-0x0000000000870000-0x000000000095C000-memory.dmp

Filesize
944KB

Download
memory/2448-2-0x0000000074780000-0x0000000074E6E000-memory.dmp

Filesize
6.9MB

Download
memory/2448-3-0x0000000000630000-0x0000000000638000-memory.dmp

Filesize
32KB

Download
memory/2448-4-0x00000000081B0000-0x0000000008260000-memory.dmp

Filesize
704KB

Download
memory/2448-5-0x000000007478E000-0x000000007478F000-memory.dmp

Filesize
4KB

Download
memory/2448-6-0x0000000074780000-0x0000000074E6E000-memory.dmp

Filesize
6.9MB

Download
memory/2448-51-0x0000000074780000-0x0000000074E6E000-memory.dmp

Filesize
6.9MB

Download
memory/2712-64-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-52-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-21-0x0000000074780000-0x0000000074E6E000-memory.dmp

Filesize
6.9MB

Download
memory/2712-20-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-15-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2712-11-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-9-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-41-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-62-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-72-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-70-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-68-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-66-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-12-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-60-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-58-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-56-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-54-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-17-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-8-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-49-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-45-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-43-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-39-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-37-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-35-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-33-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-31-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-29-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-27-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-25-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-23-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-47-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2712-531-0x0000000074780000-0x0000000074E6E000-memory.dmp

Filesize
6.9MB

Download
memory/2712-532-0x0000000074780000-0x0000000074E6E000-memory.dmp

Filesize
6.9MB

Download
memory/2712-533-0x0000000074780000-0x0000000074E6E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads