17197c9e103636ab7e6c0615e4b0143c0579d52a4a9f0b0f77dd6d91dca4fa9e

General

Target

26c1c05472608fc132a6de9b2f036f0f_JaffaCakes118.exe
Size

72KB
MD5

26c1c05472608fc132a6de9b2f036f0f
SHA1

c803dbacea063ba7e190df719d71d0d956c68dbc
SHA256

17197c9e103636ab7e6c0615e4b0143c0579d52a4a9f0b0f77dd6d91dca4fa9e
SHA512

6d9f45c90498249422b2a99ed419cdb129cddf225586f68bf42e9d85a1ca7e9a45c288cfcb485a3554b03aa2f5138cd011e9f937d4d548b1209c68aea984f836
SSDEEP

768:bO5MoPND/5Ge2oU8RsodAJLr6gMiibj6Pt29oeHvXE6oMwwrmt9Xd17jV6M:v4j6odAp6gMiGDoOE6Kbt9PnV

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4068	oavawqs.exe
1272	oavawqs.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\oavawqs.exe	26c1c05472608fc132a6de9b2f036f0f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\oavawqs.exe	26c1c05472608fc132a6de9b2f036f0f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oavawqs.exe	oavawqs.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3616 set thread context of 4908	3616	26c1c05472608fc132a6de9b2f036f0f_JaffaCakes118.exe	85
PID 4068 set thread context of 1272	4068	oavawqs.exe	87
PID 1272 set thread context of 652	1272	oavawqs.exe	88
PID 4908 set thread context of 2868	4908	26c1c05472608fc132a6de9b2f036f0f_JaffaCakes118.exe	89

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 4908	3616	26c1c05472608fc132a6de9b2f036f0f_JaffaCakes118.exe	85
PID 3616 wrote to memory of 4908	3616	26c1c05472608fc132a6de9b2f036f0f_JaffaCakes118.exe	85
PID 3616 wrote to memory of 4908	3616	26c1c05472608fc132a6de9b2f036f0f_JaffaCakes118.exe	85
PID 3616 wrote to memory of 4908	3616	26c1c05472608fc132a6de9b2f036f0f_JaffaCakes118.exe	85
PID 3616 wrote to memory of 4908	3616	26c1c05472608fc132a6de9b2f036f0f_JaffaCakes118.exe	85
PID 3616 wrote to memory of 4908	3616	26c1c05472608fc132a6de9b2f036f0f_JaffaCakes118.exe	85
PID 3616 wrote to memory of 4908	3616	26c1c05472608fc132a6de9b2f036f0f_JaffaCakes118.exe	85
PID 3616 wrote to memory of 4908	3616	26c1c05472608fc132a6de9b2f036f0f_JaffaCakes118.exe	85
PID 3616 wrote to memory of 4908	3616	26c1c05472608fc132a6de9b2f036f0f_JaffaCakes118.exe	85
PID 4068 wrote to memory of 1272	4068	oavawqs.exe	87
PID 4068 wrote to memory of 1272	4068	oavawqs.exe	87
PID 4068 wrote to memory of 1272	4068	oavawqs.exe	87
PID 4068 wrote to memory of 1272	4068	oavawqs.exe	87
PID 4068 wrote to memory of 1272	4068	oavawqs.exe	87
PID 4068 wrote to memory of 1272	4068	oavawqs.exe	87
PID 4068 wrote to memory of 1272	4068	oavawqs.exe	87
PID 4068 wrote to memory of 1272	4068	oavawqs.exe	87
PID 4068 wrote to memory of 1272	4068	oavawqs.exe	87
PID 1272 wrote to memory of 652	1272	oavawqs.exe	88
PID 1272 wrote to memory of 652	1272	oavawqs.exe	88
PID 1272 wrote to memory of 652	1272	oavawqs.exe	88
PID 1272 wrote to memory of 652	1272	oavawqs.exe	88
PID 4908 wrote to memory of 2868	4908	26c1c05472608fc132a6de9b2f036f0f_JaffaCakes118.exe	89
PID 4908 wrote to memory of 2868	4908	26c1c05472608fc132a6de9b2f036f0f_JaffaCakes118.exe	89
PID 4908 wrote to memory of 2868	4908	26c1c05472608fc132a6de9b2f036f0f_JaffaCakes118.exe	89
PID 4908 wrote to memory of 2868	4908	26c1c05472608fc132a6de9b2f036f0f_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\26c1c05472608fc132a6de9b2f036f0f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\26c1c05472608fc132a6de9b2f036f0f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Users\Admin\AppData\Local\Temp\26c1c05472608fc132a6de9b2f036f0f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\26c1c05472608fc132a6de9b2f036f0f_JaffaCakes118.exe
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2868

C:\Windows\SysWOW64\oavawqs.exe
C:\Windows\SysWOW64\oavawqs.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\SysWOW64\oavawqs.exe
  C:\Windows\SysWOW64\oavawqs.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\oavawqs.exe

Filesize
72KB

MD5
26c1c05472608fc132a6de9b2f036f0f

SHA1
c803dbacea063ba7e190df719d71d0d956c68dbc

SHA256
17197c9e103636ab7e6c0615e4b0143c0579d52a4a9f0b0f77dd6d91dca4fa9e

SHA512
6d9f45c90498249422b2a99ed419cdb129cddf225586f68bf42e9d85a1ca7e9a45c288cfcb485a3554b03aa2f5138cd011e9f937d4d548b1209c68aea984f836

Download Submit
memory/652-18-0x0000000000280000-0x0000000000284000-memory.dmp

Filesize
16KB

Download
memory/652-17-0x0000000000280000-0x0000000000284000-memory.dmp

Filesize
16KB

Download
memory/652-26-0x0000000000280000-0x0000000000284000-memory.dmp

Filesize
16KB

Download
memory/652-19-0x0000000000280000-0x0000000000284000-memory.dmp

Filesize
16KB

Download
memory/652-15-0x0000000000280000-0x0000000000284000-memory.dmp

Filesize
16KB

Download
memory/1272-13-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1272-12-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1272-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2868-14-0x0000000000ED0000-0x0000000000ED4000-memory.dmp

Filesize
16KB

Download
memory/2868-25-0x0000000000ED0000-0x0000000000ED4000-memory.dmp

Filesize
16KB

Download
memory/4908-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4908-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4908-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4908-2-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads