88d2acc91d30007fe53a9e011accb2113d5d091ce294119c0c7ab4936d066fc8

General

Target

67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe
Size

626KB
MD5

67095ccb38deae056a983611eb8dd8e8
SHA1

5090017685e7e682b0a2c9ea61aea041ff1217d7
SHA256

88d2acc91d30007fe53a9e011accb2113d5d091ce294119c0c7ab4936d066fc8
SHA512

cffe6ad8b7e28cd7c494bc0a2dc58b51e29a5a45ef50f1b294997d2d6d3b13a66fd09465ad5c3beaed21613ca2770fb215b6e15011e0525050138c907499576c
SSDEEP

12288:NbDX9iZv/1ahmo1y6K2BVEBxlwlb3RWXUsV+QC2vXR:NbDtiZLooBGVEBEB3IX9F

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2652 set thread context of 2796	2652	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	30
PID 2796 set thread context of 2920	2796	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	31

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2920	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe
2920	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2652	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe
2796	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2796	2652	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	30
PID 2652 wrote to memory of 2796	2652	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	30
PID 2652 wrote to memory of 2796	2652	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	30
PID 2652 wrote to memory of 2796	2652	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	30
PID 2652 wrote to memory of 2796	2652	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	30
PID 2652 wrote to memory of 2796	2652	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	30
PID 2652 wrote to memory of 2796	2652	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	30
PID 2652 wrote to memory of 2796	2652	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	30
PID 2652 wrote to memory of 2796	2652	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	30
PID 2652 wrote to memory of 2796	2652	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	30
PID 2652 wrote to memory of 2796	2652	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	30
PID 2652 wrote to memory of 2796	2652	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	30
PID 2796 wrote to memory of 2920	2796	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	31
PID 2796 wrote to memory of 2920	2796	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	31
PID 2796 wrote to memory of 2920	2796	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	31
PID 2796 wrote to memory of 2920	2796	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	31
PID 2796 wrote to memory of 2920	2796	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	31
PID 2796 wrote to memory of 2920	2796	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	31
PID 2796 wrote to memory of 2920	2796	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	31
PID 2796 wrote to memory of 2920	2796	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	31
PID 2920 wrote to memory of 1200	2920	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	21
PID 2920 wrote to memory of 1200	2920	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	21
PID 2920 wrote to memory of 1200	2920	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	21
PID 2920 wrote to memory of 1200	2920	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Users\Admin\AppData\Local\Temp\67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-45-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1200-42-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/2652-1-0x000000000068A000-0x0000000000692000-memory.dmp

Filesize
32KB

Download
memory/2652-0-0x0000000000400000-0x00000000006B1000-memory.dmp

Filesize
2.7MB

Download
memory/2652-3-0x0000000000400000-0x00000000006B1000-memory.dmp

Filesize
2.7MB

Download
memory/2652-30-0x0000000000400000-0x00000000006B1000-memory.dmp

Filesize
2.7MB

Download
memory/2796-18-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2796-14-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2796-28-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2796-26-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2796-25-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2796-24-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2796-23-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2796-22-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2796-21-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2796-20-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2796-31-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2796-15-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2796-16-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2796-29-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2796-13-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2796-12-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2796-11-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2796-9-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2796-10-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2796-17-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2796-7-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2796-5-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2796-27-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2796-39-0x0000000002920000-0x0000000002BD1000-memory.dmp

Filesize
2.7MB

Download
memory/2796-41-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2920-40-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2920-38-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2920-34-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads