03ba14ded678b6252fa6dd4fff63e878fb8bd885dd10c428cc4835ee0b782bda

General

Target

4d580d06b11d2ff2dcf2c41f4c8c30ef_JaffaCakes118.exe
Size

483KB
MD5

4d580d06b11d2ff2dcf2c41f4c8c30ef
SHA1

9a45f9544a4867b67d22f36715ea1a59b325f285
SHA256

03ba14ded678b6252fa6dd4fff63e878fb8bd885dd10c428cc4835ee0b782bda
SHA512

e7d3c9badc8c9e7af6530c0ffad67742c3323b59c7db6722d88f5ba1cdd1a90ec9fa398885ebbfb4bb0311b421e1311c90a3876aa121cfe039cb87e07180ba47
SSDEEP

12288:SrdowI9xV9Htra/6WhCZQ3rMujRGJcYh9GQDqqUq+:Srdo9bdY/fQZE79S6CUq+

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3064	4d580d06b11d2ff2dcf2c41f4c8c30ef_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1668-22-0x0000000000400000-0x0000000000502000-memory.dmp	upx
behavioral1/memory/1668-0-0x0000000000400000-0x0000000000502000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1668 set thread context of 3064	1668	4d580d06b11d2ff2dcf2c41f4c8c30ef_JaffaCakes118.exe	30

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3064	4d580d06b11d2ff2dcf2c41f4c8c30ef_JaffaCakes118.exe
3064	4d580d06b11d2ff2dcf2c41f4c8c30ef_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 3064	1668	4d580d06b11d2ff2dcf2c41f4c8c30ef_JaffaCakes118.exe	30
PID 1668 wrote to memory of 3064	1668	4d580d06b11d2ff2dcf2c41f4c8c30ef_JaffaCakes118.exe	30
PID 1668 wrote to memory of 3064	1668	4d580d06b11d2ff2dcf2c41f4c8c30ef_JaffaCakes118.exe	30
PID 1668 wrote to memory of 3064	1668	4d580d06b11d2ff2dcf2c41f4c8c30ef_JaffaCakes118.exe	30
PID 1668 wrote to memory of 3064	1668	4d580d06b11d2ff2dcf2c41f4c8c30ef_JaffaCakes118.exe	30
PID 1668 wrote to memory of 3064	1668	4d580d06b11d2ff2dcf2c41f4c8c30ef_JaffaCakes118.exe	30
PID 1668 wrote to memory of 3064	1668	4d580d06b11d2ff2dcf2c41f4c8c30ef_JaffaCakes118.exe	30
PID 1668 wrote to memory of 3064	1668	4d580d06b11d2ff2dcf2c41f4c8c30ef_JaffaCakes118.exe	30
PID 1668 wrote to memory of 3064	1668	4d580d06b11d2ff2dcf2c41f4c8c30ef_JaffaCakes118.exe	30
PID 1668 wrote to memory of 3064	1668	4d580d06b11d2ff2dcf2c41f4c8c30ef_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4d580d06b11d2ff2dcf2c41f4c8c30ef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4d580d06b11d2ff2dcf2c41f4c8c30ef_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\4d580d06b11d2ff2dcf2c41f4c8c30ef_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\4d580d06b11d2ff2dcf2c41f4c8c30ef_JaffaCakes118.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\bmDD74.tmp

Filesize
33KB

MD5
e4ec57e8508c5c4040383ebe6d367928

SHA1
b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

SHA256
8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

SHA512
77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

Download Submit
memory/1668-2-0x0000000000290000-0x0000000000295000-memory.dmp

Filesize
20KB

Download
memory/1668-0-0x0000000000400000-0x0000000000502000-memory.dmp

Filesize
1.0MB

Download
memory/1668-23-0x0000000000510000-0x0000000000612000-memory.dmp

Filesize
1.0MB

Download
memory/1668-22-0x0000000000400000-0x0000000000502000-memory.dmp

Filesize
1.0MB

Download
memory/1668-1-0x0000000000220000-0x0000000000273000-memory.dmp

Filesize
332KB

Download
memory/3064-7-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3064-34-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3064-5-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3064-3-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3064-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3064-16-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3064-10-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3064-13-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3064-27-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3064-28-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3064-30-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3064-29-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3064-32-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3064-21-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3064-36-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3064-38-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3064-40-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3064-42-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3064-44-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3064-46-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3064-48-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3064-50-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3064-52-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3064-54-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3064-56-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing