94b61d14cd80da4df3ee4716b6b41c15660a1097634f3bc1693949a027fcb3ed

General

Target

644a7e2f853879b95cd790901265df03_JaffaCakes118.exe
Size

310KB
MD5

644a7e2f853879b95cd790901265df03
SHA1

8266c7211e67e3a16527220e247e30b9f483b880
SHA256

94b61d14cd80da4df3ee4716b6b41c15660a1097634f3bc1693949a027fcb3ed
SHA512

02f29a7df3304940057174d85d78aecaa5ade2a49ca4e0a063f93303b132b5e65fcccd455bf76698e74a0def328ebda87aa3354fe0ba4d45b45cb349265d3678
SSDEEP

6144:gEYZeuHwRzaIHqGUb/jWWE2xBhId5yDK4KuqHkvTmO6fOezAEfdPC1sBv:KeuQRzaIKnWWEA3I5FkvT+ftjPC1sBv

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4980 set thread context of 1688	4980	644a7e2f853879b95cd790901265df03_JaffaCakes118.exe	84
PID 4980 set thread context of 0	4980	644a7e2f853879b95cd790901265df03_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1688	644a7e2f853879b95cd790901265df03_JaffaCakes118.exe
1688	644a7e2f853879b95cd790901265df03_JaffaCakes118.exe
1688	644a7e2f853879b95cd790901265df03_JaffaCakes118.exe
1688	644a7e2f853879b95cd790901265df03_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4980	644a7e2f853879b95cd790901265df03_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 1688	4980	644a7e2f853879b95cd790901265df03_JaffaCakes118.exe	84
PID 4980 wrote to memory of 1688	4980	644a7e2f853879b95cd790901265df03_JaffaCakes118.exe	84
PID 4980 wrote to memory of 1688	4980	644a7e2f853879b95cd790901265df03_JaffaCakes118.exe	84
PID 4980 wrote to memory of 1688	4980	644a7e2f853879b95cd790901265df03_JaffaCakes118.exe	84
PID 4980 wrote to memory of 1688	4980	644a7e2f853879b95cd790901265df03_JaffaCakes118.exe	84
PID 4980 wrote to memory of 1688	4980	644a7e2f853879b95cd790901265df03_JaffaCakes118.exe	84
PID 4980 wrote to memory of 1688	4980	644a7e2f853879b95cd790901265df03_JaffaCakes118.exe	84
PID 4980 wrote to memory of 0	4980	644a7e2f853879b95cd790901265df03_JaffaCakes118.exe
PID 4980 wrote to memory of 0	4980	644a7e2f853879b95cd790901265df03_JaffaCakes118.exe
PID 4980 wrote to memory of 0	4980	644a7e2f853879b95cd790901265df03_JaffaCakes118.exe
PID 4980 wrote to memory of 0	4980	644a7e2f853879b95cd790901265df03_JaffaCakes118.exe
PID 1688 wrote to memory of 3420	1688	644a7e2f853879b95cd790901265df03_JaffaCakes118.exe	56
PID 1688 wrote to memory of 3420	1688	644a7e2f853879b95cd790901265df03_JaffaCakes118.exe	56
PID 1688 wrote to memory of 3420	1688	644a7e2f853879b95cd790901265df03_JaffaCakes118.exe	56
PID 1688 wrote to memory of 3420	1688	644a7e2f853879b95cd790901265df03_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3420
- C:\Users\Admin\AppData\Local\Temp\644a7e2f853879b95cd790901265df03_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\644a7e2f853879b95cd790901265df03_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Users\Admin\AppData\Local\Temp\644a7e2f853879b95cd790901265df03_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\644a7e2f853879b95cd790901265df03_JaffaCakes118.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1688-25-0x00000000773A0000-0x0000000077490000-memory.dmp

Filesize
960KB

Download
memory/1688-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1688-18-0x00000000773A0000-0x0000000077490000-memory.dmp

Filesize
960KB

Download
memory/1688-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1688-16-0x00000000773A0000-0x0000000077490000-memory.dmp

Filesize
960KB

Download
memory/1688-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3420-20-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3420-19-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/4980-34-0x00000000773A0000-0x0000000077490000-memory.dmp

Filesize
960KB

Download
memory/4980-3-0x0000000077512000-0x0000000077513000-memory.dmp

Filesize
4KB

Download
memory/4980-17-0x00000000773A0000-0x0000000077490000-memory.dmp

Filesize
960KB

Download
memory/4980-4-0x00000000024D0000-0x00000000024E0000-memory.dmp

Filesize
64KB

Download
memory/4980-8-0x00000000773A0000-0x0000000077490000-memory.dmp

Filesize
960KB

Download
memory/4980-7-0x00000000773C0000-0x00000000773C1000-memory.dmp

Filesize
4KB

Download
memory/4980-28-0x00000000024D0000-0x00000000024E0000-memory.dmp

Filesize
64KB

Download
memory/4980-5-0x00000000024B0000-0x00000000024C0000-memory.dmp

Filesize
64KB

Download
memory/4980-6-0x0000000002460000-0x0000000002470000-memory.dmp

Filesize
64KB

Download
memory/4980-14-0x00000000773A0000-0x0000000077490000-memory.dmp

Filesize
960KB

Download
memory/4980-0-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/4980-26-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/4980-27-0x0000000000A50000-0x0000000000A9E000-memory.dmp

Filesize
312KB

Download
memory/4980-1-0x0000000000A50000-0x0000000000A9E000-memory.dmp

Filesize
312KB

Download
memory/4980-30-0x0000000002460000-0x0000000002470000-memory.dmp

Filesize
64KB

Download
memory/4980-29-0x00000000024B0000-0x00000000024C0000-memory.dmp

Filesize
64KB

Download
memory/4980-31-0x00000000773A0000-0x0000000077490000-memory.dmp

Filesize
960KB

Download
memory/4980-32-0x00000000773A0000-0x0000000077490000-memory.dmp

Filesize
960KB

Download
memory/4980-2-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads