bd03e51c3435b2336ac692350a0a4db1741484c9efc5434bd0d35f5085a642da

General

Target

3c27209acab5e8180c654e60daf99773_JaffaCakes118.exe
Size

100KB
MD5

3c27209acab5e8180c654e60daf99773
SHA1

09508d2b2b0895f949a009c5bbc4f05063315c26
SHA256

bd03e51c3435b2336ac692350a0a4db1741484c9efc5434bd0d35f5085a642da
SHA512

f5f66fc09d01fda40b354533d7110bbc0dab117028333c4c9ce1d40e8198d440e8d7a1375302a4d61431c4f75d94c3b31203d9a3b65dae938940f4c7ab9ebdbf
SSDEEP

768:SukcgwdvusLtvlAzdXkEkKZWlOhL8dZ2Zny1/Mdl1nyKPtnKUdckK:lYgvlLtNyd7ky8Ak2g1/UbymtnKUds

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1564	msnmsgs.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2128-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x00090000000233f0-3.dat	upx
behavioral2/memory/2128-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1564-6-0x0000000000400000-0x000000000042A000-memory.dmp	upx

Drops file in System32 directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msnmsgs.exe	3c27209acab5e8180c654e60daf99773_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe	3c27209acab5e8180c654e60daf99773_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe
File created	C:\Windows\SysWOW64\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe\msnmsgs.exe	msnmsgs.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1308	1564	WerFault.exe	86
2676	1564	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1564	2128	3c27209acab5e8180c654e60daf99773_JaffaCakes118.exe	86
PID 2128 wrote to memory of 1564	2128	3c27209acab5e8180c654e60daf99773_JaffaCakes118.exe	86
PID 2128 wrote to memory of 1564	2128	3c27209acab5e8180c654e60daf99773_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\3c27209acab5e8180c654e60daf99773_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3c27209acab5e8180c654e60daf99773_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\msnmsgs.exe
  C:\Windows\system32\msnmsgs.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 372
    3⤵
    - Program crash
    PID:1308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 412
    3⤵
    - Program crash
    PID:2676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1564 -ip 1564
1⤵
PID:2664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1564 -ip 1564
1⤵
PID:1600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\msnmsgs.exe

Filesize
100KB

MD5
3c27209acab5e8180c654e60daf99773

SHA1
09508d2b2b0895f949a009c5bbc4f05063315c26

SHA256
bd03e51c3435b2336ac692350a0a4db1741484c9efc5434bd0d35f5085a642da

SHA512
f5f66fc09d01fda40b354533d7110bbc0dab117028333c4c9ce1d40e8198d440e8d7a1375302a4d61431c4f75d94c3b31203d9a3b65dae938940f4c7ab9ebdbf

Download Submit
memory/1564-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2128-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2128-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing