7e2d2db6465335ce53b2ed000babcac693eb1f772c7a97c0d2200f357f7dee7d

General

Target

b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe
Size

80KB
MD5

b2aea7d24aa0788d0632a6b3b26bbdc4
SHA1

85cc06bb60d076ce5c3a6ee766879657d056fd4a
SHA256

7e2d2db6465335ce53b2ed000babcac693eb1f772c7a97c0d2200f357f7dee7d
SHA512

ce5879fca5c8fc8125a8bad1b6398177fd4bc065f09e24fe8ab7263648562cfb68eabd80f6d879a919df90e0d399178de581153a11db63bb95abf4c941e5ec2f
SSDEEP

1536:932J389hC+aMRFZOhYU5y7/jSy6WWSOwUSs+blu2knJIGjE4E:9mqTC+aQFZDU5y7WyxISs+bHkns4E

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3616-4-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3616-3-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/3616-0-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/3616-7-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/3616-6-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/3616-8-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3616-9-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3616-10-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral2/memory/3616-11-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3616-12-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3616-13-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3616-14-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3616-15-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3616-16-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3616-17-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3616-18-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3616-19-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3616-21-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3616-22-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 740 set thread context of 3616	740	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
740	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe
740	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
740	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe
740	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 3616	740	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe	84
PID 740 wrote to memory of 3616	740	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe	84
PID 740 wrote to memory of 3616	740	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe	84
PID 740 wrote to memory of 3616	740	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe	84
PID 740 wrote to memory of 3616	740	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe	84
PID 740 wrote to memory of 3616	740	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe	84
PID 740 wrote to memory of 3616	740	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe	84
PID 740 wrote to memory of 3616	740	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe	84
PID 740 wrote to memory of 3616	740	b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:740
- C:\Users\Admin\AppData\Local\Temp\b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b2aea7d24aa0788d0632a6b3b26bbdc4_JaffaCakes118.exe"
  2⤵
  PID:3616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/740-1-0x00000000022D0000-0x00000000022D4000-memory.dmp

Filesize
16KB

Download
memory/3616-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3616-3-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/3616-0-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/3616-7-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/3616-6-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/3616-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3616-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3616-10-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/3616-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3616-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3616-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3616-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3616-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3616-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3616-17-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3616-18-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3616-19-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3616-21-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3616-22-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing