1f060ed4f026137c3d684c132fb462d7a38d3098af0f319771f8f43cb4f6ed2f

General

Target

1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe
Size

145KB
MD5

1599046094fe2eeaf7933f49456e466b
SHA1

7a5d1d7d34a074df3870171efb75f55c7bf2127f
SHA256

1f060ed4f026137c3d684c132fb462d7a38d3098af0f319771f8f43cb4f6ed2f
SHA512

d0e25fc5f7baa8bf9545b61f2d4d231b612ad8c098b9c0fd8689ca3a68a17c25a2878b254b4e3535aa1bb7786eb9114e08406ed7b2950593a26fa7f964bc97ec
SSDEEP

3072:qGwm//Oqx8O6tFYB3dOnaLR3HP+uCLEwT5GOZoLRXyg5IBJ/:qGw20O6tFXnSR32REwVWL0V5

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1640 set thread context of 1172	1640	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	28
PID 1172 set thread context of 2640	1172	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	29

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1640	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe
1172	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1172	1640	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	28
PID 1640 wrote to memory of 1172	1640	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	28
PID 1640 wrote to memory of 1172	1640	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	28
PID 1640 wrote to memory of 1172	1640	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	28
PID 1640 wrote to memory of 1172	1640	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	28
PID 1640 wrote to memory of 1172	1640	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	28
PID 1640 wrote to memory of 1172	1640	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	28
PID 1640 wrote to memory of 1172	1640	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	28
PID 1640 wrote to memory of 1172	1640	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	28
PID 1640 wrote to memory of 1172	1640	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	28
PID 1640 wrote to memory of 1172	1640	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	28
PID 1172 wrote to memory of 2640	1172	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	29
PID 1172 wrote to memory of 2640	1172	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	29
PID 1172 wrote to memory of 2640	1172	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	29
PID 1172 wrote to memory of 2640	1172	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	29
PID 1172 wrote to memory of 2640	1172	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	29
PID 1172 wrote to memory of 2640	1172	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	29
PID 1172 wrote to memory of 2640	1172	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	29
PID 1172 wrote to memory of 2640	1172	1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Users\Admin\AppData\Local\Temp\1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\1599046094fe2eeaf7933f49456e466b_JaffaCakes118.exe
    3⤵
    PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1172-15-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1172-43-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1172-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1172-17-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1172-7-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1172-21-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1172-23-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1172-9-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1172-27-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1172-13-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1172-39-0x0000000000420000-0x00000000004FF000-memory.dmp

Filesize
892KB

Download
memory/1172-11-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1640-1-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1640-25-0x0000000000370000-0x00000000003BF000-memory.dmp

Filesize
316KB

Download
memory/1640-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1640-26-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1640-2-0x0000000000430000-0x0000000000431000-memory.dmp

Filesize
4KB

Download
memory/1640-3-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1640-4-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2640-30-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/2640-34-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/2640-38-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/2640-32-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/2640-40-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads