5da25d9af00cded5377cc30943ae9084253d110abbf057e995aacfedfa1ef145

General

Target

5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
Size

864KB
MD5

5fa85f6b9d586234d86a92dfe663f160
SHA1

b8ddf9bd783457e180f6bdcb31c712debacbddfc
SHA256

5da25d9af00cded5377cc30943ae9084253d110abbf057e995aacfedfa1ef145
SHA512

99baab2eceaa41deee6e84ae99edead62e15132b6e4b6c43680f6c64c23c7cdb9a0fc1cbd73181c5e7aed8bcc4c257d0dad3bdbdd9746d59c0759b1490bdb1d5
SSDEEP

24576:ZA6CFuZyE+ood7qYUAokmz9Buk/GwkU+Foo:jCFuZyE5od7zUFkmruDwkU6oo

Score

1^/10

Malware Config

Signatures

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.gmkasm\ = "GMKAssembler.Project"	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\GMKAssembler.Project	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\GMKAssembler.Project\Shell	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\GMKAssembler.Project\DefaultIcon	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\GMKAssembler.Project\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe"	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.gmkasm	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\GMKAssembler.Project\Shell\open\command	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\GMKAssembler.Project\Shell\open	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\GMKAssembler.Project\Shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe\" \"%1\""	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 1636	2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe	33
PID 2296 wrote to memory of 1636	2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe	33
PID 2296 wrote to memory of 1636	2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe	33
PID 2296 wrote to memory of 1636	2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe	33
PID 2296 wrote to memory of 1272	2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe	34
PID 2296 wrote to memory of 1272	2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe	34
PID 2296 wrote to memory of 1272	2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe	34
PID 2296 wrote to memory of 1272	2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe	34
PID 2296 wrote to memory of 1032	2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe	35
PID 2296 wrote to memory of 1032	2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe	35
PID 2296 wrote to memory of 1032	2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe	35
PID 2296 wrote to memory of 1032	2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe	35
PID 2296 wrote to memory of 1344	2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe	36
PID 2296 wrote to memory of 1344	2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe	36
PID 2296 wrote to memory of 1344	2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe	36
PID 2296 wrote to memory of 1344	2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe	36
PID 2296 wrote to memory of 1688	2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe	37
PID 2296 wrote to memory of 1688	2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe	37
PID 2296 wrote to memory of 1688	2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe	37
PID 2296 wrote to memory of 1688	2296	5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe	37

C:\Users\Admin\AppData\Local\Temp\5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Users\Admin\AppData\Local\Temp\5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe"
  2⤵
  PID:1636
- C:\Users\Admin\AppData\Local\Temp\5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe"
  2⤵
  PID:1272
- C:\Users\Admin\AppData\Local\Temp\5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe"
  2⤵
  PID:1032
- C:\Users\Admin\AppData\Local\Temp\5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe"
  2⤵
  PID:1344
- C:\Users\Admin\AppData\Local\Temp\5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5fa85f6b9d586234d86a92dfe663f160_JaffaCakes118.exe"
  2⤵
  PID:1688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2296-0-0x0000000074CEE000-0x0000000074CEF000-memory.dmp

Filesize
4KB

Download
memory/2296-1-0x0000000000330000-0x000000000040E000-memory.dmp

Filesize
888KB

Download
memory/2296-2-0x0000000074CE0000-0x00000000753CE000-memory.dmp

Filesize
6.9MB

Download
memory/2296-3-0x0000000000690000-0x00000000006B2000-memory.dmp

Filesize
136KB

Download
memory/2296-4-0x0000000074CEE000-0x0000000074CEF000-memory.dmp

Filesize
4KB

Download
memory/2296-5-0x0000000074CE0000-0x00000000753CE000-memory.dmp

Filesize
6.9MB

Download
memory/2296-6-0x0000000005100000-0x0000000005178000-memory.dmp

Filesize
480KB

Download
memory/2296-7-0x0000000004FB0000-0x0000000004FF8000-memory.dmp

Filesize
288KB

Download
memory/2296-8-0x0000000074CE0000-0x00000000753CE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads