fa1051a34dee642b69e5aefdcd245c29ae0fc54a6b23b133f9243d2a488fe5f0

General

Target

14740e9144e0d27ee3fa5228e468bb92_JaffaCakes118.exe
Size

1.5MB
MD5

14740e9144e0d27ee3fa5228e468bb92
SHA1

4e85d1a3b51361431a048e802392474eb11b351d
SHA256

fa1051a34dee642b69e5aefdcd245c29ae0fc54a6b23b133f9243d2a488fe5f0
SHA512

783df825a28d6d7e75943e8800ad5fd04d76bfc825ecfda05032c214446743424132dbed748ba2dc6d7d40068e80abfefea7e57f3100ac1e54e3676142ba3646
SSDEEP

24576:HgPoG55fFUh8sgDo7dRjLJDbSsR88XyQCpx+eU9uxrkL72XVWN5tfqFhFY7:HgPj5FUh8NDAdZLssrXydKNAkP2A7khO

Score

7^/10

themida

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2528	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2748	G_Server2.03.exe

Themida packer 26 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1808-5-0x0000000000400000-0x0000000000718000-memory.dmp	themida
behavioral1/memory/1808-6-0x0000000000400000-0x0000000000718000-memory.dmp	themida
behavioral1/files/0x000b000000012280-7.dat	themida
behavioral1/memory/2748-8-0x0000000000400000-0x0000000000718000-memory.dmp	themida
behavioral1/memory/2748-9-0x0000000000400000-0x0000000000718000-memory.dmp	themida
behavioral1/memory/2748-10-0x0000000000400000-0x0000000000718000-memory.dmp	themida
behavioral1/memory/2748-11-0x0000000000400000-0x0000000000718000-memory.dmp	themida
behavioral1/memory/2748-14-0x0000000000400000-0x0000000000718000-memory.dmp	themida
behavioral1/memory/2748-13-0x0000000000400000-0x0000000000718000-memory.dmp	themida
behavioral1/memory/1808-22-0x0000000000400000-0x0000000000718000-memory.dmp	themida
behavioral1/memory/2748-24-0x0000000000400000-0x0000000000718000-memory.dmp	themida
behavioral1/memory/2748-25-0x0000000000400000-0x0000000000718000-memory.dmp	themida
behavioral1/memory/2748-26-0x0000000000400000-0x0000000000718000-memory.dmp	themida
behavioral1/memory/2748-27-0x0000000000400000-0x0000000000718000-memory.dmp	themida
behavioral1/memory/2748-28-0x0000000000400000-0x0000000000718000-memory.dmp	themida
behavioral1/memory/2748-29-0x0000000000400000-0x0000000000718000-memory.dmp	themida
behavioral1/memory/2748-30-0x0000000000400000-0x0000000000718000-memory.dmp	themida
behavioral1/memory/2748-31-0x0000000000400000-0x0000000000718000-memory.dmp	themida
behavioral1/memory/2748-32-0x0000000000400000-0x0000000000718000-memory.dmp	themida
behavioral1/memory/2748-33-0x0000000000400000-0x0000000000718000-memory.dmp	themida
behavioral1/memory/2748-34-0x0000000000400000-0x0000000000718000-memory.dmp	themida
behavioral1/memory/2748-35-0x0000000000400000-0x0000000000718000-memory.dmp	themida
behavioral1/memory/2748-36-0x0000000000400000-0x0000000000718000-memory.dmp	themida
behavioral1/memory/2748-37-0x0000000000400000-0x0000000000718000-memory.dmp	themida
behavioral1/memory/2748-38-0x0000000000400000-0x0000000000718000-memory.dmp	themida
behavioral1/memory/2748-39-0x0000000000400000-0x0000000000718000-memory.dmp	themida

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\G_Server2.03.exe	14740e9144e0d27ee3fa5228e468bb92_JaffaCakes118.exe
File created	C:\Windows\DELME.BAT	14740e9144e0d27ee3fa5228e468bb92_JaffaCakes118.exe
File created	C:\Windows\G_Server2.03.exe	14740e9144e0d27ee3fa5228e468bb92_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1808	14740e9144e0d27ee3fa5228e468bb92_JaffaCakes118.exe
2748	G_Server2.03.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1808	14740e9144e0d27ee3fa5228e468bb92_JaffaCakes118.exe
Token: SeDebugPrivilege	2748	G_Server2.03.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2748	G_Server2.03.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2696	2748	G_Server2.03.exe	29
PID 2748 wrote to memory of 2696	2748	G_Server2.03.exe	29
PID 2748 wrote to memory of 2696	2748	G_Server2.03.exe	29
PID 2748 wrote to memory of 2696	2748	G_Server2.03.exe	29
PID 1808 wrote to memory of 2528	1808	14740e9144e0d27ee3fa5228e468bb92_JaffaCakes118.exe	30
PID 1808 wrote to memory of 2528	1808	14740e9144e0d27ee3fa5228e468bb92_JaffaCakes118.exe	30
PID 1808 wrote to memory of 2528	1808	14740e9144e0d27ee3fa5228e468bb92_JaffaCakes118.exe	30
PID 1808 wrote to memory of 2528	1808	14740e9144e0d27ee3fa5228e468bb92_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\14740e9144e0d27ee3fa5228e468bb92_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\14740e9144e0d27ee3fa5228e468bb92_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\DELME.BAT
  2⤵
  - Deletes itself
  PID:2528

C:\Windows\G_Server2.03.exe
C:\Windows\G_Server2.03.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\DELME.BAT

Filesize
218B

MD5
35126443dff7f4b8a844e6fbe105e024

SHA1
38a1d5ee635a87b7cc55df0532a319232c4b2d2d

SHA256
1e2155b8506bef191278724c7cc2041af8553bf3113a24ce3012430093079730

SHA512
ffabea3b9aa70c68bb3e1489cdfc46601f22fc52f62615b9462e95965ddc3c373d7f9f7cc8f48e56f732e58bf4c8e499f5f4d28be74ae4fd2de6a9065ed2c70a

Download Submit
C:\Windows\G_Server2.03.exe

Filesize
1.5MB

MD5
14740e9144e0d27ee3fa5228e468bb92

SHA1
4e85d1a3b51361431a048e802392474eb11b351d

SHA256
fa1051a34dee642b69e5aefdcd245c29ae0fc54a6b23b133f9243d2a488fe5f0

SHA512
783df825a28d6d7e75943e8800ad5fd04d76bfc825ecfda05032c214446743424132dbed748ba2dc6d7d40068e80abfefea7e57f3100ac1e54e3676142ba3646

Download Submit
memory/1808-0-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1808-2-0x0000000000401000-0x000000000045A000-memory.dmp

Filesize
356KB

Download
memory/1808-5-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download
memory/1808-6-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download
memory/1808-1-0x0000000001FC0000-0x000000000209F000-memory.dmp

Filesize
892KB

Download
memory/1808-22-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download
memory/2748-24-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download
memory/2748-29-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download
memory/2748-14-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download
memory/2748-13-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download
memory/2748-10-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download
memory/2748-9-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download
memory/2748-8-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download
memory/2748-25-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download
memory/2748-26-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download
memory/2748-27-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download
memory/2748-28-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download
memory/2748-11-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download
memory/2748-30-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download
memory/2748-31-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download
memory/2748-32-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download
memory/2748-33-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download
memory/2748-34-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download
memory/2748-35-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download
memory/2748-36-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download
memory/2748-37-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download
memory/2748-38-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download
memory/2748-39-0x0000000000400000-0x0000000000718000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing