eb7b428633e1261c96af3569b2de0ad9d81c34d14048721ba6f18743e5700fab

General

Target

3665740f0ac73da74eeb707a496866b4_JaffaCakes118.exe
Size

630KB
MD5

3665740f0ac73da74eeb707a496866b4
SHA1

dea9eb4067800e4789730563ff92152148552e76
SHA256

eb7b428633e1261c96af3569b2de0ad9d81c34d14048721ba6f18743e5700fab
SHA512

29c9aba7b7febb983603190233fce1e631242df59b9d5287d127bd6cb9b0ead85228fcbd31e148683fcabbfa26760eb5da4052220d2a038ba387901c5d450ff7
SSDEEP

12288:pPJRDTkGVGUlqmKir+isGxP5i1zF3Z4mxx30MHoTAFbiZg:rRDQyG99iSGxP5i9QmX3KZC

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Hacker.com.cn.exe

pid process

2792 Hacker.com.cn.exe

pid	process
2792	Hacker.com.cn.exe

Drops file in Windows directory 2 IoCs

Processes:

3665740f0ac73da74eeb707a496866b4_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\Hacker.com.cn.exe	3665740f0ac73da74eeb707a496866b4_JaffaCakes118.exe
File opened for modification	C:\Windows\Hacker.com.cn.exe	3665740f0ac73da74eeb707a496866b4_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

3665740f0ac73da74eeb707a496866b4_JaffaCakes118.exeHacker.com.cn.exe

description pid process

Token: SeDebugPrivilege 1272 3665740f0ac73da74eeb707a496866b4_JaffaCakes118.exe
Token: SeDebugPrivilege 2792 Hacker.com.cn.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Hacker.com.cn.exe

pid process

2792 Hacker.com.cn.exe

description	pid	process
Token: SeDebugPrivilege	1272	3665740f0ac73da74eeb707a496866b4_JaffaCakes118.exe
Token: SeDebugPrivilege	2792	Hacker.com.cn.exe

pid	process
2792	Hacker.com.cn.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Hacker.com.cn.exe

description	pid	process	target process
PID 2792 wrote to memory of 2752	2792	Hacker.com.cn.exe	IEXPLORE.EXE
PID 2792 wrote to memory of 2752	2792	Hacker.com.cn.exe	IEXPLORE.EXE
PID 2792 wrote to memory of 2752	2792	Hacker.com.cn.exe	IEXPLORE.EXE
PID 2792 wrote to memory of 2752	2792	Hacker.com.cn.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\3665740f0ac73da74eeb707a496866b4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3665740f0ac73da74eeb707a496866b4_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1272

C:\Windows\Hacker.com.cn.exe
C:\Windows\Hacker.com.cn.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2792

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"
2⤵
PID:2752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Hacker.com.cn.exe

Filesize
630KB

MD5
3665740f0ac73da74eeb707a496866b4

SHA1
dea9eb4067800e4789730563ff92152148552e76

SHA256
eb7b428633e1261c96af3569b2de0ad9d81c34d14048721ba6f18743e5700fab

SHA512
29c9aba7b7febb983603190233fce1e631242df59b9d5287d127bd6cb9b0ead85228fcbd31e148683fcabbfa26760eb5da4052220d2a038ba387901c5d450ff7

Download Submit
memory/1272-10-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/1272-13-0x0000000003270000-0x0000000003271000-memory.dmp

Filesize
4KB

Download
memory/1272-9-0x0000000001F10000-0x0000000001F11000-memory.dmp

Filesize
4KB

Download
memory/1272-14-0x0000000003270000-0x0000000003271000-memory.dmp

Filesize
4KB

Download
memory/1272-8-0x0000000001EE0000-0x0000000001EE1000-memory.dmp

Filesize
4KB

Download
memory/1272-21-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/1272-20-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/1272-19-0x00000000032A0000-0x00000000032A1000-memory.dmp

Filesize
4KB

Download
memory/1272-18-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/1272-17-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1272-12-0x0000000003270000-0x0000000003271000-memory.dmp

Filesize
4KB

Download
memory/1272-7-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

Filesize
4KB

Download
memory/1272-11-0x0000000003260000-0x0000000003360000-memory.dmp

Filesize
1024KB

Download
memory/1272-0-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download
memory/1272-15-0x0000000003260000-0x0000000003263000-memory.dmp

Filesize
12KB

Download
memory/1272-16-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/1272-22-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/1272-6-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1272-5-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1272-4-0x0000000001F00000-0x0000000001F01000-memory.dmp

Filesize
4KB

Download
memory/1272-3-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1272-2-0x0000000001ED0000-0x0000000001ED1000-memory.dmp

Filesize
4KB

Download
memory/1272-1-0x0000000000520000-0x0000000000574000-memory.dmp

Filesize
336KB

Download
memory/1272-30-0x0000000000520000-0x0000000000574000-memory.dmp

Filesize
336KB

Download
memory/1272-29-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download
memory/2792-27-0x0000000000320000-0x0000000000374000-memory.dmp

Filesize
336KB

Download
memory/2792-26-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download
memory/2792-31-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download
memory/2792-33-0x0000000000320000-0x0000000000374000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads