76afa14cbd51dc9e3ef362928b4c9309a80d1ae077dcfcefb16abfe429be4365

General

Target

4d63605c5e8f18d43a5b34e96ffeb4b4_JaffaCakes118.exe
Size

303KB
MD5

4d63605c5e8f18d43a5b34e96ffeb4b4
SHA1

3f83c274bc385f65c2bbc92c76189ff16933be5f
SHA256

76afa14cbd51dc9e3ef362928b4c9309a80d1ae077dcfcefb16abfe429be4365
SHA512

ecf11935355476e0c318f73bd1728d896fd9bbcf0039697c83a3a5970c84f3810a428efc85bf0aa9c88f722c0ba8fa66e1b2f23a0991480523535eac35ff8226
SSDEEP

6144:/WF2cNUTdsHoj+Tl39kWJpAcETNBaur8bv4LoSiAdqQK8TLlbmMCqZCH:/W5oTWX2jau4v4LoSiAoQK8HFvCH

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4968	48093.exe
2524	19882.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2180-0-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/files/0x00090000000234d8-6.dat	upx
behavioral2/memory/4968-8-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/2180-12-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/4968-14-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/4968-15-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/4968-16-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/4968-17-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/4968-18-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/4968-19-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/4968-20-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/4968-21-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/4968-22-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/4968-23-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/4968-24-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/4968-25-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/4968-26-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/4968-27-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral2/memory/4968-28-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\48093.exe	4d63605c5e8f18d43a5b34e96ffeb4b4_JaffaCakes118.exe
File opened for modification	C:\Windows\48093.exe	4d63605c5e8f18d43a5b34e96ffeb4b4_JaffaCakes118.exe
File created	C:\Windows\19882.exe	4d63605c5e8f18d43a5b34e96ffeb4b4_JaffaCakes118.exe
File opened for modification	C:\Windows\19882.exe	4d63605c5e8f18d43a5b34e96ffeb4b4_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2684	2524	WerFault.exe	85

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4468	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4468	AUDIODG.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 4968	2180	4d63605c5e8f18d43a5b34e96ffeb4b4_JaffaCakes118.exe	84
PID 2180 wrote to memory of 4968	2180	4d63605c5e8f18d43a5b34e96ffeb4b4_JaffaCakes118.exe	84
PID 2180 wrote to memory of 4968	2180	4d63605c5e8f18d43a5b34e96ffeb4b4_JaffaCakes118.exe	84
PID 2180 wrote to memory of 2524	2180	4d63605c5e8f18d43a5b34e96ffeb4b4_JaffaCakes118.exe	85
PID 2180 wrote to memory of 2524	2180	4d63605c5e8f18d43a5b34e96ffeb4b4_JaffaCakes118.exe	85
PID 2180 wrote to memory of 2524	2180	4d63605c5e8f18d43a5b34e96ffeb4b4_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\4d63605c5e8f18d43a5b34e96ffeb4b4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4d63605c5e8f18d43a5b34e96ffeb4b4_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\48093.exe
  C:\Windows/48093.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\19882.exe
  C:\Windows/19882.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 304
    3⤵
    - Program crash
    PID:2684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2524 -ip 2524
1⤵
PID:2632

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x308 0x41c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\19882.exe

Filesize
37KB

MD5
336f7f2f964f466f5c71aef9042ab0ff

SHA1
b315e2e11ccfa7573dcf8085a8f65e0da86835f7

SHA256
e0a5186cf901f4d14be0f43c6b8b3c2a18c119a6207c669b0267333d026c38d1

SHA512
9913370915dc33c2cb72da6511660d70fb74a9b03d6644f59c0e4f40183df8b6b9ea04b541197ef07effb4a45afc9634254fed66125374bd82b101730323d084

Download Submit
C:\Windows\48093.exe

Filesize
87KB

MD5
842fdeb77fde3bf55e427e817f19ac08

SHA1
892219c94aa8f8a60865ced2c2585754ea87d71f

SHA256
85dcc6df127023e74c8a0f7cfc539038ca216096e8123ec601b7ef32b72d26b8

SHA512
e7680a8d601b5239b583bcf531abee8de28e37eb713f867b13d3402b1aa8f22c63a87fe948c33d5aab6549a0fc619587d3fe6ade70072f98e14b08b6e6998577

Download Submit
memory/2180-0-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2180-12-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2524-13-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4968-18-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4968-20-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4968-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4968-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4968-17-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4968-8-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4968-19-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4968-14-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4968-21-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4968-22-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4968-23-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4968-24-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4968-25-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4968-26-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4968-27-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4968-28-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing