7e2d2db6465335ce53b2ed000babcac693eb1f772c7a97c0d2200f357f7dee7d

General

Target

b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe
Size

80KB
MD5

b2aea7d24aa0788d0632a6b3b26bbdc4
SHA1

85cc06bb60d076ce5c3a6ee766879657d056fd4a
SHA256

7e2d2db6465335ce53b2ed000babcac693eb1f772c7a97c0d2200f357f7dee7d
SHA512

ce5879fca5c8fc8125a8bad1b6398177fd4bc065f09e24fe8ab7263648562cfb68eabd80f6d879a919df90e0d399178de581153a11db63bb95abf4c941e5ec2f
SSDEEP

1536:932J389hC+aMRFZOhYU5y7/jSy6WWSOwUSs+blu2knJIGjE4E:9mqTC+aQFZDU5y7WyxISs+bHkns4E

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2820-14-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/2820-13-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/2820-12-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/2820-16-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2820-6-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/2820-11-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/2820-7-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/2820-17-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/2820-18-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2820-20-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2820-21-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2820-22-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2820-23-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2820-24-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2820-25-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2820-26-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2820-27-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2820-29-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2820-30-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2820-31-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1944 set thread context of 2820	1944	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1944	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1944	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe
1944	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2820	1944	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe	28
PID 1944 wrote to memory of 2820	1944	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe	28
PID 1944 wrote to memory of 2820	1944	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe	28
PID 1944 wrote to memory of 2820	1944	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe	28
PID 1944 wrote to memory of 2820	1944	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe	28
PID 1944 wrote to memory of 2820	1944	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe	28
PID 1944 wrote to memory of 2820	1944	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe	28
PID 1944 wrote to memory of 2820	1944	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe	28
PID 1944 wrote to memory of 2820	1944	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Local\Temp\b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe"
  2⤵
  PID:2820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-1-0x00000000003F0000-0x00000000003F4000-memory.dmp

Filesize
16KB

Download
memory/2820-0-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/2820-4-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2820-14-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2820-13-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2820-12-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2820-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2820-15-0x0000000000406000-0x0000000000408000-memory.dmp

Filesize
8KB

Download
memory/2820-6-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2820-11-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2820-7-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2820-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2820-17-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2820-18-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2820-20-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2820-21-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2820-22-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2820-23-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2820-24-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2820-25-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2820-26-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2820-27-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2820-29-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2820-30-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2820-31-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing