842898cfb97f8c01b55ea1aaf32ffffb5497e1dbe6ea309bfa715e37212bb6da

General

Target

5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe
Size

2.4MB
MD5

5a53f07640f66b7e88ac3d0b4acd5f9a
SHA1

f8fbe7bbf85d97e557257c9fe09414a804da4a36
SHA256

842898cfb97f8c01b55ea1aaf32ffffb5497e1dbe6ea309bfa715e37212bb6da
SHA512

c0de15838eb3f87f0846f6c132db4e7c31630092d8af1552eac89a9f10cba3fd06373e0768f7504814c9728716ceaa9623db151a0b7f41354bd23c5d32b61242
SSDEEP

49152:uooZ0ajbQzlq5O+l4QOnn8jeX+l8uvlhfNf5lWLPNyeL9+hw/USGy7Xk/51HwgGQ:eX0zlC6mJ98BVF/Q1a7

Score

9^/10

Malware Config

Signatures

Beds Protector Packer 1 IoCs

Detects Beds Protector packer used to load .NET malware.

resource	yara_rule
behavioral1/memory/2084-3-0x00000000050E0000-0x0000000005348000-memory.dmp	beds_protector

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2684	2084	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe
2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe
2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe
2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe
2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe
2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe
2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe
2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe
2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe
2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2744	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2744	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2744	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2744	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2780	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe	31
PID 2084 wrote to memory of 2780	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe	31
PID 2084 wrote to memory of 2780	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe	31
PID 2084 wrote to memory of 2780	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe	31
PID 2084 wrote to memory of 2800	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe	32
PID 2084 wrote to memory of 2800	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe	32
PID 2084 wrote to memory of 2800	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe	32
PID 2084 wrote to memory of 2800	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe	32
PID 2084 wrote to memory of 2728	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe	33
PID 2084 wrote to memory of 2728	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe	33
PID 2084 wrote to memory of 2728	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe	33
PID 2084 wrote to memory of 2728	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe	33
PID 2084 wrote to memory of 2692	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe	34
PID 2084 wrote to memory of 2692	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe	34
PID 2084 wrote to memory of 2692	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe	34
PID 2084 wrote to memory of 2692	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe	34
PID 2084 wrote to memory of 2684	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe	35
PID 2084 wrote to memory of 2684	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe	35
PID 2084 wrote to memory of 2684	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe	35
PID 2084 wrote to memory of 2684	2084	5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe	35

C:\Users\Admin\AppData\Local\Temp\5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe"
  2⤵
  PID:2744
- C:\Users\Admin\AppData\Local\Temp\5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe"
  2⤵
  PID:2780
- C:\Users\Admin\AppData\Local\Temp\5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe"
  2⤵
  PID:2800
- C:\Users\Admin\AppData\Local\Temp\5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe"
  2⤵
  PID:2728
- C:\Users\Admin\AppData\Local\Temp\5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe"
  2⤵
  PID:2692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 716
  2⤵
  - Program crash
  PID:2684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2084-0-0x00000000740AE000-0x00000000740AF000-memory.dmp

Filesize
4KB

Download
memory/2084-1-0x0000000000310000-0x0000000000586000-memory.dmp

Filesize
2.5MB

Download
memory/2084-2-0x00000000740A0000-0x000000007478E000-memory.dmp

Filesize
6.9MB

Download
memory/2084-3-0x00000000050E0000-0x0000000005348000-memory.dmp

Filesize
2.4MB

Download
memory/2084-4-0x0000000001FE0000-0x0000000001FF6000-memory.dmp

Filesize
88KB

Download
memory/2084-5-0x00000000740AE000-0x00000000740AF000-memory.dmp

Filesize
4KB

Download
memory/2084-6-0x00000000740A0000-0x000000007478E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing