bd03e51c3435b2336ac692350a0a4db1741484c9efc5434bd0d35f5085a642da

General

Target

3c27209acab5e8180c654e60daf99773_JaffaCakes118.exe
Size

100KB
MD5

3c27209acab5e8180c654e60daf99773
SHA1

09508d2b2b0895f949a009c5bbc4f05063315c26
SHA256

bd03e51c3435b2336ac692350a0a4db1741484c9efc5434bd0d35f5085a642da
SHA512

f5f66fc09d01fda40b354533d7110bbc0dab117028333c4c9ce1d40e8198d440e8d7a1375302a4d61431c4f75d94c3b31203d9a3b65dae938940f4c7ab9ebdbf
SSDEEP

768:SukcgwdvusLtvlAzdXkEkKZWlOhL8dZ2Zny1/Mdl1nyKPtnKUdckK:lYgvlLtNyd7ky8Ak2g1/UbymtnKUds

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2728	msnmsgs.exe

Loads dropped DLL 2 IoCs

pid	Process
2272	3c27209acab5e8180c654e60daf99773_JaffaCakes118.exe
2272	3c27209acab5e8180c654e60daf99773_JaffaCakes118.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2272-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0009000000012118-2.dat	upx
behavioral1/memory/2272-4-0x0000000000330000-0x000000000035A000-memory.dmp	upx
behavioral1/memory/2272-10-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2728-11-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2728-13-0x0000000000400000-0x000000000042A000-memory.dmp	upx

Drops file in System32 directory 23 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe	3c27209acab5e8180c654e60daf99773_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File opened for modification	C:\Windows\SysWOW64\msnmsgs.exe	3c27209acab5e8180c654e60daf99773_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File opened for modification	C:\Windows\SysWOW64\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2728	2272	3c27209acab5e8180c654e60daf99773_JaffaCakes118.exe	30
PID 2272 wrote to memory of 2728	2272	3c27209acab5e8180c654e60daf99773_JaffaCakes118.exe	30
PID 2272 wrote to memory of 2728	2272	3c27209acab5e8180c654e60daf99773_JaffaCakes118.exe	30
PID 2272 wrote to memory of 2728	2272	3c27209acab5e8180c654e60daf99773_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3c27209acab5e8180c654e60daf99773_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3c27209acab5e8180c654e60daf99773_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\msnmsgs.exe
  C:\Windows\system32\msnmsgs.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\msnmsgs.exe

Filesize
100KB

MD5
3c27209acab5e8180c654e60daf99773

SHA1
09508d2b2b0895f949a009c5bbc4f05063315c26

SHA256
bd03e51c3435b2336ac692350a0a4db1741484c9efc5434bd0d35f5085a642da

SHA512
f5f66fc09d01fda40b354533d7110bbc0dab117028333c4c9ce1d40e8198d440e8d7a1375302a4d61431c4f75d94c3b31203d9a3b65dae938940f4c7ab9ebdbf

Download Submit
memory/2272-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2272-4-0x0000000000330000-0x000000000035A000-memory.dmp

Filesize
168KB

Download
memory/2272-10-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2728-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2728-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing