3e7d94766e1d19a041943deb396881a1b5015fce257d61f3350d095c2ec07136

General

Target

3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
Size

1.1MB
MD5

3665af3ad5fed9a66f8ea364fbd8720c
SHA1

8fad6d709b0da6f86896d0f85fa69888b5b36e6d
SHA256

3e7d94766e1d19a041943deb396881a1b5015fce257d61f3350d095c2ec07136
SHA512

eaf2b560b9c1c65952c80ac0bbc6b377b2ca370b5b0641b914c00967d229b2507543ba6613d5963e4e3b6b0b5047d71f6967e631ae7b7ce0fd05db8b2af3b627
SSDEEP

3072:Yjd5WXpYI+538b8Hpd3cN+UQTvK96iCAn+hQn2T1thg9i4sHNKgRDSaRRn4Boi6J:H2DSabMoi6YimyDXJbDx3iYUT+hnHd

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2284-4-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/2284-7-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/2284-6-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/2284-8-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/2284-19-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Suspicious use of SetThreadContext 3 IoCs

Processes:

3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe

description	pid	process	target process
PID 2476 set thread context of 2284	2476	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 2476 set thread context of 0	2476	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 2284 set thread context of 2820	2284	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe

pid process

2476 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
2284 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe

pid	process
2476	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
2284	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476

C:\Users\Admin\AppData\Local\Temp\3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284

C:\Users\Admin\AppData\Local\Temp\3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe"
3⤵
PID:2820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2284-8-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2284-4-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2284-7-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2284-6-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2284-15-0x0000000000330000-0x00000000003F3000-memory.dmp

Filesize
780KB

Download
memory/2284-19-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2476-1-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/2476-9-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/2476-0-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/2820-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2820-16-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2820-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2820-20-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

description	pid	process	target process
PID 2476 wrote to memory of 2284	2476	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 2476 wrote to memory of 2284	2476	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 2476 wrote to memory of 2284	2476	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 2476 wrote to memory of 2284	2476	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 2476 wrote to memory of 2284	2476	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 2476 wrote to memory of 2284	2476	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 2476 wrote to memory of 2284	2476	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 2476 wrote to memory of 2284	2476	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 2476 wrote to memory of 2284	2476	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 2476 wrote to memory of 0	2476	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 2476 wrote to memory of 0	2476	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 2476 wrote to memory of 0	2476	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 2476 wrote to memory of 0	2476	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 2476 wrote to memory of 0	2476	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 2284 wrote to memory of 2820	2284	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 2284 wrote to memory of 2820	2284	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 2284 wrote to memory of 2820	2284	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 2284 wrote to memory of 2820	2284	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 2284 wrote to memory of 2820	2284	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 2284 wrote to memory of 2820	2284	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 2284 wrote to memory of 2820	2284	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 2284 wrote to memory of 2820	2284	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads