5c4560dd26514c21bd3ba66ceaffdbb8fb2d932df399a7730077209a8897b7f8

General

Target

4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe
Size

283KB
MD5

4609ffea455182ebe7297db487fb4948
SHA1

6ba3f53a56d7bac02916c17a8fbe1377c913668a
SHA256

5c4560dd26514c21bd3ba66ceaffdbb8fb2d932df399a7730077209a8897b7f8
SHA512

383600cd1f1d03ba9e5ce14722e42e56aade9cbfbda4fe630617d116743e397d1187735cea77dd7fb562e41a1d0b9a6e0ba45559628f633c4aa045c8ebebf6c9
SSDEEP

6144:h88PSs+dhq7fO6c0XrrhaWjRSHnVW5GJZ2tNYLj8Mfsf15T0l4G:XOdsc0bd2VzYKj86sLIt

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1788 set thread context of 3204	1788	4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe	86

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3204	4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe
3204	4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe
3204	4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe
3204	4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1788	4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 3204	1788	4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe	86
PID 1788 wrote to memory of 3204	1788	4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe	86
PID 1788 wrote to memory of 3204	1788	4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe	86
PID 1788 wrote to memory of 3204	1788	4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe	86
PID 1788 wrote to memory of 3204	1788	4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe	86
PID 1788 wrote to memory of 3204	1788	4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe	86
PID 1788 wrote to memory of 3204	1788	4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe	86
PID 3204 wrote to memory of 3468	3204	4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe	56
PID 3204 wrote to memory of 3468	3204	4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe	56
PID 3204 wrote to memory of 3468	3204	4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe	56
PID 3204 wrote to memory of 3468	3204	4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3468
- C:\Users\Admin\AppData\Local\Temp\4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Users\Admin\AppData\Local\Temp\4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4609ffea455182ebe7297db487fb4948_JaffaCakes118.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1788-7-0x0000000002C10000-0x0000000002C11000-memory.dmp

Filesize
4KB

Download
memory/1788-16-0x0000000002C10000-0x0000000002C11000-memory.dmp

Filesize
4KB

Download
memory/1788-1-0x0000000002BA0000-0x0000000002BA2000-memory.dmp

Filesize
8KB

Download
memory/1788-0-0x0000000000400000-0x00000000004FB000-memory.dmp

Filesize
1004KB

Download
memory/1788-19-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/1788-18-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/1788-17-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/1788-6-0x0000000002C10000-0x0000000002C11000-memory.dmp

Filesize
4KB

Download
memory/1788-15-0x0000000002C10000-0x0000000002C11000-memory.dmp

Filesize
4KB

Download
memory/1788-14-0x0000000002C10000-0x0000000002C11000-memory.dmp

Filesize
4KB

Download
memory/1788-13-0x0000000002C10000-0x0000000002C11000-memory.dmp

Filesize
4KB

Download
memory/1788-12-0x0000000002C10000-0x0000000002C11000-memory.dmp

Filesize
4KB

Download
memory/1788-11-0x0000000002C10000-0x0000000002C11000-memory.dmp

Filesize
4KB

Download
memory/1788-5-0x0000000002C10000-0x0000000002C11000-memory.dmp

Filesize
4KB

Download
memory/1788-9-0x0000000002C10000-0x0000000002C11000-memory.dmp

Filesize
4KB

Download
memory/1788-8-0x0000000002C10000-0x0000000002C11000-memory.dmp

Filesize
4KB

Download
memory/1788-20-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/1788-2-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/1788-10-0x0000000002C10000-0x0000000002C11000-memory.dmp

Filesize
4KB

Download
memory/1788-4-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/1788-3-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/1788-22-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/1788-26-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/1788-25-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/1788-24-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/1788-31-0x0000000000400000-0x00000000004FB000-memory.dmp

Filesize
1004KB

Download
memory/3204-27-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3204-29-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3204-28-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3204-36-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3204-37-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3468-32-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3468-33-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing