7a66b1c7464f16e68abd64ea68815ae363777594acd1a868f3922d8725596194

General

Target

319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe
Size

512KB
MD5

319422405a1a190a457d7201b3aa1b13
SHA1

f7cae5652c9db702534de6a3903450c1afcafa3e
SHA256

7a66b1c7464f16e68abd64ea68815ae363777594acd1a868f3922d8725596194
SHA512

3a0317b6e7727a40835decd9ba5cd0f0e260fbfd90947d89dc37b16fb0002912dab93c58828386db30669b8e1904b95905239b5638336dbd49358ce49d0d8512
SSDEEP

12288:CxDGaHdeGmZ5MUC+efxILItXKZbyqVkGSBKLp:Cx9degagwkLKLp

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2788 set thread context of 448	2788	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	84
PID 448 set thread context of 992	448	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	85

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3524	992	WerFault.exe	85

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 448	2788	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	84
PID 2788 wrote to memory of 448	2788	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	84
PID 2788 wrote to memory of 448	2788	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	84
PID 2788 wrote to memory of 448	2788	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	84
PID 2788 wrote to memory of 448	2788	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	84
PID 448 wrote to memory of 992	448	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	85
PID 448 wrote to memory of 992	448	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	85
PID 448 wrote to memory of 992	448	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	85
PID 448 wrote to memory of 992	448	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	85
PID 448 wrote to memory of 992	448	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	85
PID 448 wrote to memory of 992	448	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	85
PID 448 wrote to memory of 992	448	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	85
PID 448 wrote to memory of 992	448	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	85
PID 448 wrote to memory of 992	448	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	85
PID 448 wrote to memory of 992	448	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	85
PID 448 wrote to memory of 992	448	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	85
PID 448 wrote to memory of 992	448	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	85
PID 448 wrote to memory of 992	448	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	85
PID 448 wrote to memory of 992	448	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	85
PID 448 wrote to memory of 992	448	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	85
PID 448 wrote to memory of 992	448	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	85
PID 448 wrote to memory of 992	448	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	85
PID 448 wrote to memory of 992	448	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	85
PID 448 wrote to memory of 992	448	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	85
PID 448 wrote to memory of 992	448	319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Users\Admin\AppData\Local\Temp\319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:448
- - C:\Users\Admin\AppData\Local\Temp\319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\319422405a1a190a457d7201b3aa1b13_JaffaCakes118.exe"
    3⤵
    PID:992
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 12
      4⤵
      Program crash
      PID:3524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 992 -ip 992
1⤵
PID:2404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/448-5-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/448-1-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/448-3-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/448-23-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/448-6-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/992-19-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/992-16-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/992-21-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/992-7-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/992-20-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/992-9-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/992-18-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/992-17-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/992-14-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/992-15-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/992-13-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/992-11-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/992-12-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2788-0-0x0000000010000000-0x0000000010083200-memory.dmp

Filesize
524KB

Download
memory/2788-4-0x0000000010000000-0x0000000010083200-memory.dmp

Filesize
524KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads