19e60fcde1b38e7fd6274e33a8defc1658677800d4a85a2c788decc600a36e66

General

Target

631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe
Size

2.7MB
MD5

631c9d33ff3a8d714864fd18e1dbf725
SHA1

d56dbf573cb6082eea1f7b4469e8a5f2be6c75be
SHA256

19e60fcde1b38e7fd6274e33a8defc1658677800d4a85a2c788decc600a36e66
SHA512

86be94c10eecf2c76b5b92dec3bd8ed188c4be0a8b2b3078131ee037185ecb58a37aa99c3df2767800c4c1272f9dc8440613dccae5e5d9e21331a1051e8f9ee3
SSDEEP

49152:RAbx0lVw1ug+yPmu1YNTxNMUWHNIFS3v+4X3PMkMNI/JhM:RAbxL1ug+yuu1Yp7MUWHNHqkwI/A

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\oleaut32.dll	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\pstorec.dll	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\rasapi32.dll	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\rasapi32.dll	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\advapi32.dll	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\advapi32.dll	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ole32.dll	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\oleaut32.dll	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\pstorec.dll	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\crypt32.dll	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\crypt32.dll	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ole32.dll	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 728 set thread context of 924	728	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	93
PID 924 set thread context of 2248	924	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	94

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1252	2248	WerFault.exe	94

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00020412-0000-0000-C000-000000000046}	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	728	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
924	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 924	728	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	93
PID 728 wrote to memory of 924	728	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	93
PID 728 wrote to memory of 924	728	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	93
PID 728 wrote to memory of 924	728	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	93
PID 728 wrote to memory of 924	728	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	93
PID 728 wrote to memory of 924	728	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	93
PID 728 wrote to memory of 924	728	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	93
PID 728 wrote to memory of 924	728	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	93
PID 924 wrote to memory of 2248	924	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	94
PID 924 wrote to memory of 2248	924	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	94
PID 924 wrote to memory of 2248	924	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	94
PID 924 wrote to memory of 2248	924	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	94
PID 924 wrote to memory of 2248	924	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	94
PID 924 wrote to memory of 2248	924	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	94
PID 924 wrote to memory of 2248	924	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	94
PID 924 wrote to memory of 2248	924	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	94
PID 924 wrote to memory of 2248	924	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	94
PID 924 wrote to memory of 2248	924	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	94
PID 924 wrote to memory of 2248	924	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	94
PID 924 wrote to memory of 2248	924	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	94
PID 924 wrote to memory of 2248	924	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	94
PID 924 wrote to memory of 2248	924	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	94
PID 924 wrote to memory of 2248	924	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	94
PID 924 wrote to memory of 2248	924	631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:728
- C:\Users\Admin\AppData\Local\Temp\631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Users\Admin\AppData\Local\Temp\631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\631c9d33ff3a8d714864fd18e1dbf725_JaffaCakes118.exe
    3⤵
    - Drops file in System32 directory
    - Modifies registry class
    PID:2248
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 464
      4⤵
      Program crash
      PID:1252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2248 -ip 2248
1⤵
PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/728-0-0x0000000074E92000-0x0000000074E93000-memory.dmp

Filesize
4KB

Download
memory/728-1-0x0000000074E90000-0x0000000075441000-memory.dmp

Filesize
5.7MB

Download
memory/728-2-0x0000000074E90000-0x0000000075441000-memory.dmp

Filesize
5.7MB

Download
memory/728-9-0x0000000074E90000-0x0000000075441000-memory.dmp

Filesize
5.7MB

Download
memory/924-3-0x0000000000400000-0x00000000005C5000-memory.dmp

Filesize
1.8MB

Download
memory/924-6-0x0000000000400000-0x00000000005C5000-memory.dmp

Filesize
1.8MB

Download
memory/924-13-0x0000000000400000-0x00000000005C5000-memory.dmp

Filesize
1.8MB

Download
memory/2248-10-0x0000000000400000-0x00000000005CA000-memory.dmp

Filesize
1.8MB

Download
memory/2248-11-0x0000000000400000-0x00000000005CA000-memory.dmp

Filesize
1.8MB

Download
memory/2248-14-0x0000000000400000-0x00000000005CA000-memory.dmp

Filesize
1.8MB

Download
memory/2248-12-0x0000000000400000-0x00000000005CA000-memory.dmp

Filesize
1.8MB

Download
memory/2248-15-0x0000000000400000-0x00000000005CA000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing