90a42a20c582414eb90a16e92de4f187c64ea19fc1abec02ed3682c768884e2b

General

Target

0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe
Size

832KB
MD5

0f6d85fd65a144703da644edb5f5d00b
SHA1

86b3ebe16c5befbd5b82edd8b60b558dfc7485bf
SHA256

90a42a20c582414eb90a16e92de4f187c64ea19fc1abec02ed3682c768884e2b
SHA512

a08fdf32627082df260c642bbaae639290ab9f50aebffc0cd5c14460c4c3fc0886946e82d2a0ec1f0baad2dcacfd2d0870f3c63c8a28a5d1735514c9e8e63677
SSDEEP

24576:CTYYICLZr8xPBZ5jJuVm8WCBJ/As2gZTSR6a:CEY7lrWXxJuVPFBC83a

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/856-4-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral2/memory/856-6-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral2/memory/856-7-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral2/memory/856-18-0x0000000000400000-0x0000000000427000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3364 set thread context of 856	3364	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe	91
PID 856 set thread context of 620	856	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe	92

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
620	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe
620	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe
620	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe
620	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3364	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe
856	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 856	3364	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe	91
PID 3364 wrote to memory of 856	3364	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe	91
PID 3364 wrote to memory of 856	3364	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe	91
PID 3364 wrote to memory of 856	3364	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe	91
PID 3364 wrote to memory of 856	3364	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe	91
PID 3364 wrote to memory of 856	3364	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe	91
PID 3364 wrote to memory of 856	3364	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe	91
PID 3364 wrote to memory of 856	3364	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe	91
PID 856 wrote to memory of 620	856	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe	92
PID 856 wrote to memory of 620	856	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe	92
PID 856 wrote to memory of 620	856	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe	92
PID 856 wrote to memory of 620	856	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe	92
PID 856 wrote to memory of 620	856	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe	92
PID 856 wrote to memory of 620	856	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe	92
PID 856 wrote to memory of 620	856	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe	92
PID 620 wrote to memory of 3332	620	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe	56
PID 620 wrote to memory of 3332	620	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe	56
PID 620 wrote to memory of 3332	620	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe	56
PID 620 wrote to memory of 3332	620	0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3332
- C:\Users\Admin\AppData\Local\Temp\0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Users\Admin\AppData\Local\Temp\0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:856
  - - C:\Users\Admin\AppData\Local\Temp\0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\0f6d85fd65a144703da644edb5f5d00b_JaffaCakes118.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3920 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:4708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/620-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/620-14-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/620-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/620-11-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/856-6-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/856-7-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/856-4-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/856-18-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/856-16-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/3332-22-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3332-23-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3364-0-0x0000000000400000-0x00000000005BE000-memory.dmp

Filesize
1.7MB

Download
memory/3364-2-0x0000000000400000-0x00000000005BE000-memory.dmp

Filesize
1.7MB

Download
memory/3364-15-0x0000000000400000-0x00000000005BE000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing