3e7d94766e1d19a041943deb396881a1b5015fce257d61f3350d095c2ec07136

General

Target

3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
Size

1.1MB
MD5

3665af3ad5fed9a66f8ea364fbd8720c
SHA1

8fad6d709b0da6f86896d0f85fa69888b5b36e6d
SHA256

3e7d94766e1d19a041943deb396881a1b5015fce257d61f3350d095c2ec07136
SHA512

eaf2b560b9c1c65952c80ac0bbc6b377b2ca370b5b0641b914c00967d229b2507543ba6613d5963e4e3b6b0b5047d71f6967e631ae7b7ce0fd05db8b2af3b627
SSDEEP

3072:Yjd5WXpYI+538b8Hpd3cN+UQTvK96iCAn+hQn2T1thg9i4sHNKgRDSaRRn4Boi6J:H2DSabMoi6YimyDXJbDx3iYUT+hnHd

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4396-4-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/4396-6-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/4396-8-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/4396-19-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Suspicious use of SetThreadContext 3 IoCs

Processes:

3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe

description	pid	process	target process
PID 4780 set thread context of 4396	4780	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 4780 set thread context of 0	4780	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 4396 set thread context of 1252	4396	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe

pid process

4780 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
4396 3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe

pid	process
4780	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
4396	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4780

C:\Users\Admin\AppData\Local\Temp\3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4396

C:\Users\Admin\AppData\Local\Temp\3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe"
3⤵
PID:1252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1252-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1252-14-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1252-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1252-17-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1252-20-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4396-4-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4396-6-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4396-8-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4396-19-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4780-0-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/4780-1-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/4780-11-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download

description	pid	process	target process
PID 4780 wrote to memory of 4396	4780	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 4780 wrote to memory of 4396	4780	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 4780 wrote to memory of 4396	4780	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 4780 wrote to memory of 4396	4780	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 4780 wrote to memory of 4396	4780	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 4780 wrote to memory of 4396	4780	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 4780 wrote to memory of 4396	4780	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 4780 wrote to memory of 4396	4780	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 4780 wrote to memory of 0	4780	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 4780 wrote to memory of 0	4780	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 4780 wrote to memory of 0	4780	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 4780 wrote to memory of 0	4780	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 4780 wrote to memory of 0	4780	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 4396 wrote to memory of 1252	4396	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 4396 wrote to memory of 1252	4396	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 4396 wrote to memory of 1252	4396	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 4396 wrote to memory of 1252	4396	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 4396 wrote to memory of 1252	4396	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 4396 wrote to memory of 1252	4396	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe
PID 4396 wrote to memory of 1252	4396	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe	3665af3ad5fed9a66f8ea364fbd8720c_JaffaCakes118.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads