743ba5782a1c0a13a06587549d955c302751e661870e3ba5aa84d05477714b7b

General

Target

47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe
Size

316KB
MD5

47e8d62ea1558f9b78f3c143f1352ab3
SHA1

a026c20ded7c604fb7b7dd2a7f246c53bbc846a7
SHA256

743ba5782a1c0a13a06587549d955c302751e661870e3ba5aa84d05477714b7b
SHA512

8209708b680d1e9fc6a71238cd246de4b84d51ddfdb72e6e9d6f363bf8dc19dc1b9caace0ebbb71ae71a1db7ccc417403ca33cf27a18388adfb29dc5aae34aeb
SSDEEP

6144:xxMDZbaUGbP2ap9oWj8srS7LkA4IrGzcpmcL6UKGwfe:zMdBG2apm88srS7LkAXyGjoo

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2000-0-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2000-6-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2000 set thread context of 2412	2000	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe	30
PID 2412 set thread context of 1060	2412	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe	31

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2780	1060	WerFault.exe	31

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2000	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe
2412	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2412	2000	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe	30
PID 2000 wrote to memory of 2412	2000	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe	30
PID 2000 wrote to memory of 2412	2000	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe	30
PID 2000 wrote to memory of 2412	2000	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe	30
PID 2000 wrote to memory of 2412	2000	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe	30
PID 2000 wrote to memory of 2412	2000	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe	30
PID 2000 wrote to memory of 2412	2000	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe	30
PID 2000 wrote to memory of 2412	2000	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe	30
PID 2000 wrote to memory of 2412	2000	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe	30
PID 2412 wrote to memory of 1060	2412	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe	31
PID 2412 wrote to memory of 1060	2412	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe	31
PID 2412 wrote to memory of 1060	2412	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe	31
PID 2412 wrote to memory of 1060	2412	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe	31
PID 2412 wrote to memory of 1060	2412	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe	31
PID 2412 wrote to memory of 1060	2412	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe	31
PID 2412 wrote to memory of 1060	2412	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe	31
PID 2412 wrote to memory of 1060	2412	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe	31
PID 2412 wrote to memory of 1060	2412	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe	31
PID 1060 wrote to memory of 2780	1060	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe	32
PID 1060 wrote to memory of 2780	1060	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe	32
PID 1060 wrote to memory of 2780	1060	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe	32
PID 1060 wrote to memory of 2780	1060	47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Users\Admin\AppData\Local\Temp\47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\47e8d62ea1558f9b78f3c143f1352ab3_JaffaCakes118.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 92
      4⤵
      Program crash
      PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1060-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1060-18-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1060-31-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1060-14-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1060-12-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1060-20-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1060-25-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1060-16-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2000-6-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2000-3-0x0000000000320000-0x000000000033C000-memory.dmp

Filesize
112KB

Download
memory/2000-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2412-4-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2412-30-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2412-27-0x0000000000230000-0x000000000024C000-memory.dmp

Filesize
112KB

Download
memory/2412-7-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing