fb7cc6596333947037fbc5ea540acc002ee93d622392fbbfcd5504a145c47853

General

Target

298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe
Size

156KB
MD5

298e58ca40b026bffcaeb872f8ea9c9e
SHA1

a7f016d869ecb8b5cb4e7b4f08f8c024a06e5213
SHA256

fb7cc6596333947037fbc5ea540acc002ee93d622392fbbfcd5504a145c47853
SHA512

2e586f6669073887bd2c987b7647f51fe397b299db4c058d16a4cf7a5754223b6e7a911c9c04877a2df338fe11436b1c87f5dad9aa18555dec87e130727c0401
SSDEEP

3072:NOnaemr+5v+vd3fqFHmDFRSCzzC7i/2pZnh6YJr41ZIpU9x0q:NOap+EvxqFHmxRVz6g2p1h6YJscz

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1848-1-0x0000000000400000-0x0000000000494000-memory.dmp	upx
behavioral1/memory/1848-28-0x0000000000400000-0x0000000000494000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe
1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe
Token: SeDebugPrivilege	1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 1184	1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe	21
PID 1848 wrote to memory of 368	1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe	3
PID 1848 wrote to memory of 408	1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe	5
PID 1848 wrote to memory of 472	1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe	7
PID 1848 wrote to memory of 480	1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe	8
PID 1848 wrote to memory of 588	1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe	9
PID 1848 wrote to memory of 664	1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe	10
PID 1848 wrote to memory of 748	1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe	11
PID 1848 wrote to memory of 796	1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe	12
PID 1848 wrote to memory of 832	1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe	13
PID 1848 wrote to memory of 976	1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe	15
PID 1848 wrote to memory of 280	1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe	16
PID 1848 wrote to memory of 1000	1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe	17
PID 1848 wrote to memory of 1048	1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe	18
PID 1848 wrote to memory of 1088	1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe	19
PID 1848 wrote to memory of 1144	1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe	20
PID 1848 wrote to memory of 1184	1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe	21
PID 1848 wrote to memory of 1220	1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe	23
PID 1848 wrote to memory of 1404	1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe	24
PID 1848 wrote to memory of 1544	1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe	25
PID 1848 wrote to memory of 2236	1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe	26
PID 1848 wrote to memory of 1940	1848	298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe	27

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:472
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:480

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:588
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:1404
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
1⤵
PID:664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
1⤵
PID:796
- C:\Windows\system32\Dwm.exe
  "C:\Windows\system32\Dwm.exe"
  2⤵
  PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
PID:976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
1⤵
PID:280

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:1048

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1088

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1184
- C:\Users\Admin\AppData\Local\Temp\298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\298e58ca40b026bffcaeb872f8ea9c9e_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1848

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
1⤵
PID:1220

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
1⤵
PID:2236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
1⤵
PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1184-4-0x000000000EA00000-0x000000000EA36000-memory.dmp

Filesize
216KB

Download
memory/1184-54-0x000000000EA60000-0x000000000EAA2000-memory.dmp

Filesize
264KB

Download
memory/1848-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1848-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1848-28-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1848-10-0x000000000041D000-0x0000000000434000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing