56608464550743054a9af358f1bb75a2c79f6eb8919a2933dcfb9c02afb3e052

General

Target

3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe
Size

318KB
MD5

3bad48ab2692523a80bbde1c1657073f
SHA1

6b73e98b29e7f12d1aa7d9610f03ee9981576cdd
SHA256

56608464550743054a9af358f1bb75a2c79f6eb8919a2933dcfb9c02afb3e052
SHA512

c5c001b3edc6f8440e41c79b3849105803c5bf00cf91114fb8f67ea3884e0a480d77bf2a01130ce1f7366067a833bedf6bf10b28c6b84da29cd42e35e35f9233
SSDEEP

3072:hgnwPtNdVFJxkj33CiDlC49C6BJKjf/RFkyY:h+iQ3NDFA6BJK1FhY

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1748-0-0x0000000000400000-0x0000000000449000-memory.dmp	upx
behavioral1/memory/1748-7-0x0000000000400000-0x0000000000449000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1748 set thread context of 1640	1748	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	30
PID 1640 set thread context of 2052	1640	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	31

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2052	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe
2052	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1748	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe
1640	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1640	1748	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	30
PID 1748 wrote to memory of 1640	1748	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	30
PID 1748 wrote to memory of 1640	1748	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	30
PID 1748 wrote to memory of 1640	1748	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	30
PID 1748 wrote to memory of 1640	1748	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	30
PID 1748 wrote to memory of 1640	1748	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	30
PID 1748 wrote to memory of 1640	1748	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	30
PID 1748 wrote to memory of 1640	1748	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	30
PID 1748 wrote to memory of 1640	1748	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	30
PID 1640 wrote to memory of 2052	1640	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	31
PID 1640 wrote to memory of 2052	1640	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	31
PID 1640 wrote to memory of 2052	1640	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	31
PID 1640 wrote to memory of 2052	1640	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	31
PID 1640 wrote to memory of 2052	1640	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	31
PID 1640 wrote to memory of 2052	1640	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	31
PID 1640 wrote to memory of 2052	1640	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	31
PID 1640 wrote to memory of 2052	1640	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	31
PID 2052 wrote to memory of 1228	2052	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	21
PID 2052 wrote to memory of 1228	2052	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	21
PID 2052 wrote to memory of 1228	2052	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	21
PID 2052 wrote to memory of 1228	2052	3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1228
- C:\Users\Admin\AppData\Local\Temp\3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Users\Admin\AppData\Local\Temp\3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1640
  - - C:\Users\Admin\AppData\Local\Temp\3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\3bad48ab2692523a80bbde1c1657073f_JaffaCakes118.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1228-29-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1228-25-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1640-23-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1640-6-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1640-3-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1748-7-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/1748-0-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2052-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2052-18-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2052-20-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2052-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2052-24-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2052-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2052-28-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2052-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing