984406c0310d6af570a57ab8fe1f76f073baa5879c1431859d6006a8c3e8c91b

General

Target

20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe
Size

303KB
MD5

20c39cab80fac40a7db9a24f31ae76a4
SHA1

b07b022544b17e9f619867d2319a0500575a179b
SHA256

984406c0310d6af570a57ab8fe1f76f073baa5879c1431859d6006a8c3e8c91b
SHA512

4d22803c17919f506403779672f246996b01eff122ced3d83bcb134e0e0b2c7ed0eaa53fa4331702a7ab497568b70b0d75d80833c5aeae8bb3ffe97e68e66214
SSDEEP

6144:gYoYkXCmIJghOVs+sF60T0trwGPtylLuSAcY1swGY6mLxwUxaNHmbRJ0eJmMlQvL:fEP1p+sF6e0J1jjcY1swOmGOaVmbRuu4

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5112-0-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5112-3-0x0000000000400000-0x00000000004CD000-memory.dmp	upx

Modifies registry class 20 IoCs

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5112	20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe
5112	20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4284,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:8
1⤵
PID:3576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5112-0-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/5112-1-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Filesize
4KB

Download
memory/5112-3-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/5112-5-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Filesize
4KB

Download

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\ProgID	20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\ProgID\ = "20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.eBookNSHandler"	20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D173E10A-001D-4318-9822-8C97A8418482}\LocalServer32	20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D173E10A-001D-4318-9822-8C97A8418482}\ProgID	20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\ = "eBookNSHandler"	20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.eBookNSHandler	20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.ExternalNSHandler	20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.ExternalNSHandler\Clsid	20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.ExternalNSHandler\Clsid\ = "{D173E10A-001D-4318-9822-8C97A8418482}"	20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\LocalServer32	20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.eBookNSHandler\Clsid	20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D173E10A-001D-4318-9822-8C97A8418482}	20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}	20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe"	20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.eBookNSHandler\ = "eBookNSHandler"	20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.eBookNSHandler\Clsid\ = "{9C453F21-396D-11D5-9734-70E252C10127}"	20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D173E10A-001D-4318-9822-8C97A8418482}\ = "ExternalNSHandler"	20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D173E10A-001D-4318-9822-8C97A8418482}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe"	20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.ExternalNSHandler\ = "ExternalNSHandler"	20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D173E10A-001D-4318-9822-8C97A8418482}\ProgID\ = "20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.ExternalNSHandler"	20c39cab80fac40a7db9a24f31ae76a4_JaffaCakes118.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads