488ae0b3a0df1a77dad45e68a114dc9b7a91bcf456709d5a4f9f2042dd8b8111

General

Target

0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe
Size

475KB
MD5

0102ca29c1ccb0900ac62bd3829a02c7
SHA1

1d4aa1b3dba90d0fe044ddb67a8ee535f965b698
SHA256

488ae0b3a0df1a77dad45e68a114dc9b7a91bcf456709d5a4f9f2042dd8b8111
SHA512

989388b9375d3e5568266fd01f4549a971d0960eb666a460a147f62cce530b65a4c8167bc7fcf36739c7fb13f43ada89e41845d96297ff20d27c5db456ed6904
SSDEEP

6144:aTBNAaBmTA7kra/EpqAWO55Fp1EkGcCTAOHwevOKo43HTvsAvkS/IZH:anJsTvrac8ONbGcEk4YlS

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe
2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe
Token: SeDebugPrivilege	2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 1120	2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	20
PID 2872 wrote to memory of 380	2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	3
PID 2872 wrote to memory of 432	2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	5
PID 2872 wrote to memory of 488	2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	7
PID 2872 wrote to memory of 496	2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	8
PID 2872 wrote to memory of 596	2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	9
PID 2872 wrote to memory of 676	2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	10
PID 2872 wrote to memory of 740	2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	11
PID 2872 wrote to memory of 804	2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	12
PID 2872 wrote to memory of 848	2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	13
PID 2872 wrote to memory of 952	2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	15
PID 2872 wrote to memory of 1016	2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	16
PID 2872 wrote to memory of 1036	2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	17
PID 2872 wrote to memory of 1048	2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	18
PID 2872 wrote to memory of 1068	2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	19
PID 2872 wrote to memory of 1120	2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	20
PID 2872 wrote to memory of 1148	2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	21
PID 2872 wrote to memory of 2004	2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	23
PID 2872 wrote to memory of 1436	2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	24
PID 2872 wrote to memory of 272	2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	25
PID 2872 wrote to memory of 2580	2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	26
PID 2872 wrote to memory of 2080	2872	0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe	27

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:380
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:488
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:496

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:596
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:2004
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
1⤵
PID:676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
1⤵
PID:804
- C:\Windows\system32\Dwm.exe
  "C:\Windows\system32\Dwm.exe"
  2⤵
  PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
1⤵
PID:1016

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1048

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1068

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1120
- C:\Users\Admin\AppData\Local\Temp\0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0102ca29c1ccb0900ac62bd3829a02c7_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:1148

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
1⤵
PID:2580

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
1⤵
PID:2080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1120-48-0x000000000EA90000-0x000000000EAE7000-memory.dmp

Filesize
348KB

Download
memory/1120-1-0x000000000EA00000-0x000000000EA4D000-memory.dmp

Filesize
308KB

Download
memory/2872-0-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2872-27-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads