8e931cb468fd669afa184dbca159168675a287489f688e1676237a911af36b02

General

Target

37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe
Size

155KB
MD5

37aaedbb570a397cfaddfd6daa65f3fd
SHA1

7b6d72fc5b0e506eb7751054a0a1d003a58ee600
SHA256

8e931cb468fd669afa184dbca159168675a287489f688e1676237a911af36b02
SHA512

c6d566d35cc49f46610f9020ee5f6393a65281829c3c556f7e1ac3c07932cf4a87e3c97cfb1aa83372dd5439f86dda1447cbd6993743e314e2ead0be2cfa71e3
SSDEEP

3072:DdmP+ga8N/kR2d42VGabw5ltawBF9+DiIqV3zLLCX7KXSkV/YsgdL/DB1tk:6Y2/kR2G2IkalF9YqxLLI7ZigxB1O

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4568-0-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/4568-1-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/4568-10-0x0000000000400000-0x0000000000462000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4568 set thread context of 3084	4568	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe	84
PID 3084 set thread context of 2200	3084	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe	86

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2200	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe
2200	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe
2200	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe
2200	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4568	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe
3084	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 3084	4568	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe	84
PID 4568 wrote to memory of 3084	4568	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe	84
PID 4568 wrote to memory of 3084	4568	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe	84
PID 4568 wrote to memory of 3084	4568	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe	84
PID 4568 wrote to memory of 3084	4568	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe	84
PID 4568 wrote to memory of 3084	4568	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe	84
PID 4568 wrote to memory of 3084	4568	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe	84
PID 4568 wrote to memory of 3084	4568	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe	84
PID 3084 wrote to memory of 2200	3084	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe	86
PID 3084 wrote to memory of 2200	3084	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe	86
PID 3084 wrote to memory of 2200	3084	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe	86
PID 3084 wrote to memory of 2200	3084	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe	86
PID 3084 wrote to memory of 2200	3084	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe	86
PID 3084 wrote to memory of 2200	3084	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe	86
PID 3084 wrote to memory of 2200	3084	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe	86
PID 2200 wrote to memory of 3376	2200	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe	56
PID 2200 wrote to memory of 3376	2200	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe	56
PID 2200 wrote to memory of 3376	2200	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe	56
PID 2200 wrote to memory of 3376	2200	37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3376
- C:\Users\Admin\AppData\Local\Temp\37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Users\Admin\AppData\Local\Temp\37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\37aaedbb570a397cfaddfd6daa65f3fd_JaffaCakes118.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2200-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2200-21-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2200-20-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2200-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3084-12-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3084-7-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3084-5-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3084-19-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3084-17-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download
memory/3376-22-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3376-23-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/4568-10-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4568-0-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4568-3-0x0000000000401000-0x000000000043D000-memory.dmp

Filesize
240KB

Download
memory/4568-1-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download

Analysis

Sharing