990ae56392ced57dc4ce9fa40f6986bd53b28caa2e15cd402bf7b4daf2c3c4ae

General

Target

5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe
Size

580KB
MD5

5da7edef44bd632085e25c6dea8b1ffe
SHA1

96f6c1e93f93f240cf18c1265139da3433dae449
SHA256

990ae56392ced57dc4ce9fa40f6986bd53b28caa2e15cd402bf7b4daf2c3c4ae
SHA512

96298dab7e6487737bb4cc4e54dbcf7e68f608a92a02cd1b742ddca82dce1b51e610083c76ce11e5af12eb7f404e261a95c953440eb1b58d3ee3f00304bb5999
SSDEEP

12288:0WjKsYs1aoIPIzQXahXX5qAlZ0VzYKj86sFt7/QpTx:0C1bcXahTX0pYOUt7a

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1672 set thread context of 2096	1672	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	84
PID 1672 set thread context of 0	1672	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2096	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe
2096	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe
2096	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe
2096	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1672	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2096	1672	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	84
PID 1672 wrote to memory of 2096	1672	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	84
PID 1672 wrote to memory of 2096	1672	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	84
PID 1672 wrote to memory of 2096	1672	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	84
PID 1672 wrote to memory of 2096	1672	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	84
PID 1672 wrote to memory of 2096	1672	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	84
PID 1672 wrote to memory of 2096	1672	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	84
PID 1672 wrote to memory of 0	1672	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe
PID 1672 wrote to memory of 0	1672	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe
PID 1672 wrote to memory of 0	1672	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe
PID 1672 wrote to memory of 0	1672	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe
PID 2096 wrote to memory of 3452	2096	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	56
PID 2096 wrote to memory of 3452	2096	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	56
PID 2096 wrote to memory of 3452	2096	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	56
PID 2096 wrote to memory of 3452	2096	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3452
- C:\Users\Admin\AppData\Local\Temp\5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Users\Admin\AppData\Local\Temp\5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-15-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/1672-8-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/1672-1-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/1672-4-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/1672-3-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/1672-5-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/1672-21-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/1672-20-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/1672-19-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/1672-18-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/1672-17-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/1672-13-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/1672-2-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/1672-28-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/1672-16-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/1672-12-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/1672-11-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/1672-10-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/1672-9-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/1672-0-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/1672-7-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/1672-6-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/1672-14-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/2096-24-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2096-25-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2096-26-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3452-29-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing