88d2acc91d30007fe53a9e011accb2113d5d091ce294119c0c7ab4936d066fc8

General

Target

67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe
Size

626KB
MD5

67095ccb38deae056a983611eb8dd8e8
SHA1

5090017685e7e682b0a2c9ea61aea041ff1217d7
SHA256

88d2acc91d30007fe53a9e011accb2113d5d091ce294119c0c7ab4936d066fc8
SHA512

cffe6ad8b7e28cd7c494bc0a2dc58b51e29a5a45ef50f1b294997d2d6d3b13a66fd09465ad5c3beaed21613ca2770fb215b6e15011e0525050138c907499576c
SSDEEP

12288:NbDX9iZv/1ahmo1y6K2BVEBxlwlb3RWXUsV+QC2vXR:NbDtiZLooBGVEBEB3IX9F

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3284 set thread context of 3996	3284	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	87
PID 3996 set thread context of 2492	3996	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	88

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2492	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe
2492	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe
2492	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe
2492	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3284	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe
3996	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 3996	3284	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	87
PID 3284 wrote to memory of 3996	3284	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	87
PID 3284 wrote to memory of 3996	3284	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	87
PID 3284 wrote to memory of 3996	3284	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	87
PID 3284 wrote to memory of 3996	3284	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	87
PID 3284 wrote to memory of 3996	3284	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	87
PID 3284 wrote to memory of 3996	3284	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	87
PID 3284 wrote to memory of 3996	3284	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	87
PID 3284 wrote to memory of 3996	3284	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	87
PID 3284 wrote to memory of 3996	3284	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	87
PID 3284 wrote to memory of 3996	3284	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	87
PID 3996 wrote to memory of 2492	3996	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	88
PID 3996 wrote to memory of 2492	3996	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	88
PID 3996 wrote to memory of 2492	3996	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	88
PID 3996 wrote to memory of 2492	3996	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	88
PID 3996 wrote to memory of 2492	3996	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	88
PID 3996 wrote to memory of 2492	3996	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	88
PID 3996 wrote to memory of 2492	3996	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	88
PID 2492 wrote to memory of 3508	2492	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	56
PID 2492 wrote to memory of 3508	2492	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	56
PID 2492 wrote to memory of 3508	2492	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	56
PID 2492 wrote to memory of 3508	2492	67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3508
- C:\Users\Admin\AppData\Local\Temp\67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Users\Admin\AppData\Local\Temp\67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3996
  - - C:\Users\Admin\AppData\Local\Temp\67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\67095ccb38deae056a983611eb8dd8e8_JaffaCakes118.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2492-37-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2492-34-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2492-36-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3284-1-0x000000000068A000-0x0000000000692000-memory.dmp

Filesize
32KB

Download
memory/3284-3-0x0000000000400000-0x00000000006B1000-memory.dmp

Filesize
2.7MB

Download
memory/3284-0-0x0000000000400000-0x00000000006B1000-memory.dmp

Filesize
2.7MB

Download
memory/3284-29-0x0000000000400000-0x00000000006B1000-memory.dmp

Filesize
2.7MB

Download
memory/3284-30-0x000000000068A000-0x0000000000692000-memory.dmp

Filesize
32KB

Download
memory/3508-42-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3508-41-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3996-22-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3996-17-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3996-31-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3996-25-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3996-24-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3996-23-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3996-27-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3996-21-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3996-20-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3996-19-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3996-18-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3996-40-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3996-16-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3996-15-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3996-14-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3996-13-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3996-11-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3996-10-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3996-9-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3996-26-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3996-5-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3996-12-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3996-8-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads