2f17dfd1b70efe94613cd6de26dca61c5895d9a1599969eb29f99e4fdf0f254a

General

Target

184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe
Size

215KB
MD5

184a2926a7db6439a62b3ff7df611c73
SHA1

82e6053ec7f59468ac492945e6d751a516f46a55
SHA256

2f17dfd1b70efe94613cd6de26dca61c5895d9a1599969eb29f99e4fdf0f254a
SHA512

3a8a7cd92c3cad9e87ee93bcb934b0c136b1f8ed840da213dbd595b2966479e2ede00671d17e8026b93f5fc94bd19ebdf821f05687e67ca2ac1d526ed8b328e6
SSDEEP

3072:Z/qgZneZRdqxBBZtwW96HM0XnpvTyQvGn+nCuhTr8npE3dvvq9aGNLlcyBC95tYx:JqgoRI3z4TyQOI5JgpcvqNplc/9si4

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3780 set thread context of 3168	3780	184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe	85

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3168	184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe
3168	184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe
3168	184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe
3168	184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3780	184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 3168	3780	184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe	85
PID 3780 wrote to memory of 3168	3780	184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe	85
PID 3780 wrote to memory of 3168	3780	184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe	85
PID 3780 wrote to memory of 3168	3780	184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe	85
PID 3780 wrote to memory of 3168	3780	184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe	85
PID 3780 wrote to memory of 3168	3780	184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe	85
PID 3780 wrote to memory of 3168	3780	184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe	85
PID 3168 wrote to memory of 3480	3168	184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe	56
PID 3168 wrote to memory of 3480	3168	184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe	56
PID 3168 wrote to memory of 3480	3168	184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe	56
PID 3168 wrote to memory of 3480	3168	184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3480
- C:\Users\Admin\AppData\Local\Temp\184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Users\Admin\AppData\Local\Temp\184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\184a2926a7db6439a62b3ff7df611c73_JaffaCakes118.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3168-26-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3168-35-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3168-28-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3168-27-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3480-31-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3780-9-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/3780-5-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/3780-16-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/3780-15-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/3780-14-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/3780-13-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/3780-12-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/3780-11-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/3780-10-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/3780-0-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3780-8-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/3780-7-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/3780-6-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/3780-17-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/3780-25-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/3780-24-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/3780-23-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/3780-22-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/3780-21-0x00000000020F0000-0x00000000020F1000-memory.dmp

Filesize
4KB

Download
memory/3780-18-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/3780-19-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/3780-1-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/3780-30-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3780-3-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/3780-2-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing