21444fa1542a6a55870631a04e3644c7fac13b37a9e84ff312e9b6e2fb5dd563

General

Target

1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe
Size

520KB
MD5

1963d19b82e6676bcb02cbb30b351342
SHA1

3f3009b34c616f840c7d5f60265b30ecf5800a2a
SHA256

21444fa1542a6a55870631a04e3644c7fac13b37a9e84ff312e9b6e2fb5dd563
SHA512

11ce73c0e064ebc587de5cc11272d608662788f595253eed737f29fb197b999b06b0371ea38bb47bbf2c2be0fe0d276b6de45187383286d9fe6fcce4ec0742be
SSDEEP

12288:PGQQXaEU1rJwsQaimOF/0FQC6/hnjLJyDnxjYPx:PGQcU1rCdmOeT6/hnjyxj6

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2120 set thread context of 3548	2120	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe	81
PID 3548 set thread context of 3936	3548	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4352	2120	WerFault.exe	80

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2120	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe
3548	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 3548	2120	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe	81
PID 2120 wrote to memory of 3548	2120	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe	81
PID 2120 wrote to memory of 3548	2120	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe	81
PID 2120 wrote to memory of 3548	2120	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe	81
PID 2120 wrote to memory of 3548	2120	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe	81
PID 2120 wrote to memory of 3548	2120	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe	81
PID 2120 wrote to memory of 3548	2120	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe	81
PID 2120 wrote to memory of 3548	2120	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe	81
PID 2120 wrote to memory of 3548	2120	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe	81
PID 2120 wrote to memory of 3548	2120	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe	81
PID 2120 wrote to memory of 3548	2120	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe	81
PID 2120 wrote to memory of 3548	2120	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe	81
PID 2120 wrote to memory of 3548	2120	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe	81
PID 2120 wrote to memory of 3548	2120	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe	81
PID 2120 wrote to memory of 3548	2120	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe	81
PID 3548 wrote to memory of 3936	3548	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe	84
PID 3548 wrote to memory of 3936	3548	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe	84
PID 3548 wrote to memory of 3936	3548	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe	84
PID 3548 wrote to memory of 3936	3548	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe	84
PID 3548 wrote to memory of 3936	3548	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe	84
PID 3548 wrote to memory of 3936	3548	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe	84
PID 3548 wrote to memory of 3936	3548	1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Users\Admin\AppData\Local\Temp\1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Users\Admin\AppData\Local\Temp\1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1963d19b82e6676bcb02cbb30b351342_JaffaCakes118.exe"
    3⤵
    PID:3936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 484
  2⤵
  - Program crash
  PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2120 -ip 2120
1⤵
PID:3360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3548-11-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3548-20-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3548-2-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3548-10-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3548-18-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3548-21-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3548-25-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3548-17-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3548-32-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3548-28-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3548-24-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3548-22-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3548-6-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3548-5-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3548-8-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3548-14-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3548-15-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3548-13-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3548-12-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3548-9-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3548-7-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3936-27-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3936-29-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3936-26-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3936-33-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads