7f744868222acc5b95f7082180a1520e7ac6b8c5c5673595f982c6cfed4a4612

General

Target

4445a1fb09c4563320e690801b122f2e_JaffaCakes118.exe
Size

488KB
MD5

4445a1fb09c4563320e690801b122f2e
SHA1

303f68527b0bbf40dcc4a2bcdd54355ecea8fcb1
SHA256

7f744868222acc5b95f7082180a1520e7ac6b8c5c5673595f982c6cfed4a4612
SHA512

c358ab5817e42d6722a984f49e36027b04f77d780a6a9c0abbf929ae7b14df57541419d0465ff6f62dceb0b31abbd446dce66af31c95ce957db8b122ecbe10fd
SSDEEP

12288:aNSTHCkc4in1lNToZuXeKZmZLKiRcskOpJa/JIV9gm1:Fm1lxoZtgmRKmlpJaRI

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1348	4445a1fb09c4563320e690801b122f2e_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2408-23-0x0000000000400000-0x0000000000504000-memory.dmp	upx
behavioral1/memory/2408-0-0x0000000000400000-0x0000000000504000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2408 set thread context of 1348	2408	4445a1fb09c4563320e690801b122f2e_JaffaCakes118.exe	28

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1348	4445a1fb09c4563320e690801b122f2e_JaffaCakes118.exe
1348	4445a1fb09c4563320e690801b122f2e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 1348	2408	4445a1fb09c4563320e690801b122f2e_JaffaCakes118.exe	28
PID 2408 wrote to memory of 1348	2408	4445a1fb09c4563320e690801b122f2e_JaffaCakes118.exe	28
PID 2408 wrote to memory of 1348	2408	4445a1fb09c4563320e690801b122f2e_JaffaCakes118.exe	28
PID 2408 wrote to memory of 1348	2408	4445a1fb09c4563320e690801b122f2e_JaffaCakes118.exe	28
PID 2408 wrote to memory of 1348	2408	4445a1fb09c4563320e690801b122f2e_JaffaCakes118.exe	28
PID 2408 wrote to memory of 1348	2408	4445a1fb09c4563320e690801b122f2e_JaffaCakes118.exe	28
PID 2408 wrote to memory of 1348	2408	4445a1fb09c4563320e690801b122f2e_JaffaCakes118.exe	28
PID 2408 wrote to memory of 1348	2408	4445a1fb09c4563320e690801b122f2e_JaffaCakes118.exe	28
PID 2408 wrote to memory of 1348	2408	4445a1fb09c4563320e690801b122f2e_JaffaCakes118.exe	28
PID 2408 wrote to memory of 1348	2408	4445a1fb09c4563320e690801b122f2e_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\4445a1fb09c4563320e690801b122f2e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4445a1fb09c4563320e690801b122f2e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\4445a1fb09c4563320e690801b122f2e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\4445a1fb09c4563320e690801b122f2e_JaffaCakes118.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\bm8D80.tmp

Filesize
33KB

MD5
e4ec57e8508c5c4040383ebe6d367928

SHA1
b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

SHA256
8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

SHA512
77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

Download Submit
memory/1348-38-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1348-30-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1348-21-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1348-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1348-17-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1348-14-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1348-8-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1348-6-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1348-56-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1348-4-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1348-54-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1348-52-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1348-50-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1348-48-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1348-27-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1348-11-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1348-42-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1348-32-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1348-34-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1348-36-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1348-29-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1348-40-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1348-28-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1348-44-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1348-46-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2408-0-0x0000000000400000-0x0000000000504000-memory.dmp

Filesize
1.0MB

Download
memory/2408-1-0x0000000000290000-0x0000000000295000-memory.dmp

Filesize
20KB

Download
memory/2408-2-0x0000000000510000-0x0000000000614000-memory.dmp

Filesize
1.0MB

Download
memory/2408-3-0x0000000000220000-0x0000000000273000-memory.dmp

Filesize
332KB

Download
memory/2408-23-0x0000000000400000-0x0000000000504000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing