f8c6590b5e7bbf0a148bef40a990dce10617145aae267942ca427ff6d1a39ce8

General

Target

279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe
Size

540KB
MD5

279185154a0aad5321ed4e37579f70b0
SHA1

020daccb61625c0fd64bf8ad62a05e41a34b728b
SHA256

f8c6590b5e7bbf0a148bef40a990dce10617145aae267942ca427ff6d1a39ce8
SHA512

7d05e17cfb08ba2851a0d48cc086c9f061230bbb44ddcce1d3387b1aa6f1df70391629bdde7e5de84b8001b48eabc48152d0f5ed69a14e5da506a6232b126222
SSDEEP

12288:LUxJmXn0arBSXwXZ7JM5+MZD7EO+hZn7od2+rp/n++jm:LUxJmXxAXwXZ7a+Mp7EOSB22+rp/n++C

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2408-4-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2408-8-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2408-7-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2408-6-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2408-18-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2408-12-0x0000000000400000-0x0000000000427000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1776 set thread context of 2408	1776	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	28
PID 2408 set thread context of 2004	2408	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2004	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe
2004	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1776	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe
2408	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 2408	1776	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	28
PID 1776 wrote to memory of 2408	1776	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	28
PID 1776 wrote to memory of 2408	1776	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	28
PID 1776 wrote to memory of 2408	1776	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	28
PID 1776 wrote to memory of 2408	1776	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	28
PID 1776 wrote to memory of 2408	1776	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	28
PID 1776 wrote to memory of 2408	1776	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	28
PID 1776 wrote to memory of 2408	1776	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	28
PID 1776 wrote to memory of 2408	1776	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	28
PID 2408 wrote to memory of 2004	2408	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	29
PID 2408 wrote to memory of 2004	2408	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	29
PID 2408 wrote to memory of 2004	2408	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	29
PID 2408 wrote to memory of 2004	2408	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	29
PID 2408 wrote to memory of 2004	2408	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	29
PID 2408 wrote to memory of 2004	2408	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	29
PID 2408 wrote to memory of 2004	2408	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	29
PID 2408 wrote to memory of 2004	2408	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	29
PID 2004 wrote to memory of 1208	2004	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	21
PID 2004 wrote to memory of 1208	2004	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	21
PID 2004 wrote to memory of 1208	2004	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	21
PID 2004 wrote to memory of 1208	2004	279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Users\Admin\AppData\Local\Temp\279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\279185154a0aad5321ed4e37579f70b0_JaffaCakes118.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-25-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1208-22-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1776-13-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/1776-1-0x0000000000401000-0x00000000004F7000-memory.dmp

Filesize
984KB

Download
memory/1776-0-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/2004-20-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2004-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2004-21-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2408-6-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2408-7-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2408-18-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2408-14-0x00000000026E0000-0x00000000027F8000-memory.dmp

Filesize
1.1MB

Download
memory/2408-12-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2408-8-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2408-4-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing