f928b74b982e16d39df103d29a467f9a3a6515d9b14b3dcbd45ff412d5985c7c

General

Target

63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe
Size

288KB
MD5

63846950d8e55fb7d81e6ef23d6cc17c
SHA1

644b9cc3fb8e1c434f1136bc7cb5ba3dafd32ad3
SHA256

f928b74b982e16d39df103d29a467f9a3a6515d9b14b3dcbd45ff412d5985c7c
SHA512

8f3fa62a7196d6ad638922fb610f6c717a259df5a8f3a494b92bea0bacc3a68f7542cb900e2453c4016fa695d0f5fe9f410235723d9bf5ded8ae05a68f1e82d7
SSDEEP

6144:lWEOHkBrrBg8pnmQwKTS8eGXZzI3zbywe8Pl+GIZ:lWEOHkk8IQK85ql9GZ

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2248-7-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2248-11-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2248-9-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2248-4-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2248-17-0x0000000000400000-0x0000000000427000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1656 set thread context of 2248	1656	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	29
PID 2248 set thread context of 2972	2248	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2972	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe
2972	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1656	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe
2248	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2248	1656	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	29
PID 1656 wrote to memory of 2248	1656	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	29
PID 1656 wrote to memory of 2248	1656	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	29
PID 1656 wrote to memory of 2248	1656	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	29
PID 1656 wrote to memory of 2248	1656	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	29
PID 1656 wrote to memory of 2248	1656	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	29
PID 1656 wrote to memory of 2248	1656	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	29
PID 1656 wrote to memory of 2248	1656	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	29
PID 1656 wrote to memory of 2248	1656	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	29
PID 2248 wrote to memory of 2972	2248	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2972	2248	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2972	2248	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2972	2248	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2972	2248	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2972	2248	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2972	2248	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2972	2248	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	30
PID 2972 wrote to memory of 1192	2972	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	20
PID 2972 wrote to memory of 1192	2972	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	20
PID 2972 wrote to memory of 1192	2972	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	20
PID 2972 wrote to memory of 1192	2972	63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe	20

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Users\Admin\AppData\Local\Temp\63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\63846950d8e55fb7d81e6ef23d6cc17c_JaffaCakes118.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-25-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1192-22-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1656-5-0x0000000002B10000-0x0000000002C3A000-memory.dmp

Filesize
1.2MB

Download
memory/1656-2-0x0000000000401000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/1656-0-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/1656-10-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2248-11-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2248-4-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2248-14-0x0000000002810000-0x000000000293A000-memory.dmp

Filesize
1.2MB

Download
memory/2248-17-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2248-9-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2248-7-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2972-20-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2972-19-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2972-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing