b04e2f4bf3e07b9219f5819c633c65ed8a66af319b6fa7fd0611c882c3d80189

General

Target

2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe
Size

144KB
MD5

2d4e018ff490045d37e1753b00d6f346
SHA1

22c55bf42f45187df28bd7435c2bceb347f1f140
SHA256

b04e2f4bf3e07b9219f5819c633c65ed8a66af319b6fa7fd0611c882c3d80189
SHA512

62d75e2c1d910ac2038c68422c5d55e30e65abf840af5f7577685e6be64d060ec9635db9d917daf4426527cfab396b15bab4a6231ab50040de60e8cf32f7e769
SSDEEP

3072:Rl5/o6xm9ZvIlT4p65IgN267R1s40RXH0nd4HAEfCCrKmDkZPrgsdGC9NoH:LS6xmLvWT4tgNZl1vEH0nAphrkJj39Ny

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe
2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe
Token: SeDebugPrivilege	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 1228	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe	21
PID 2700 wrote to memory of 368	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe	3
PID 2700 wrote to memory of 416	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe	5
PID 2700 wrote to memory of 476	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe	7
PID 2700 wrote to memory of 484	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe	8
PID 2700 wrote to memory of 580	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe	9
PID 2700 wrote to memory of 660	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe	10
PID 2700 wrote to memory of 740	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe	11
PID 2700 wrote to memory of 804	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe	12
PID 2700 wrote to memory of 828	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe	13
PID 2700 wrote to memory of 984	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe	15
PID 2700 wrote to memory of 296	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe	16
PID 2700 wrote to memory of 452	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe	17
PID 2700 wrote to memory of 1068	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe	18
PID 2700 wrote to memory of 1104	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe	19
PID 2700 wrote to memory of 1160	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe	20
PID 2700 wrote to memory of 1228	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe	21
PID 2700 wrote to memory of 1224	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe	23
PID 2700 wrote to memory of 1600	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe	24
PID 2700 wrote to memory of 1740	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe	25
PID 2700 wrote to memory of 2812	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe	26
PID 2700 wrote to memory of 2864	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe	27
PID 2700 wrote to memory of 2140	2700	2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe	28

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:476
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:484

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:580
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:1224
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:1740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
1⤵
PID:660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
1⤵
PID:804
- C:\Windows\system32\Dwm.exe
  "C:\Windows\system32\Dwm.exe"
  2⤵
  PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
PID:984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
1⤵
PID:296

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:1068

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1104

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1228
- C:\Users\Admin\AppData\Local\Temp\2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2d4e018ff490045d37e1753b00d6f346_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2700

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
1⤵
PID:1600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
1⤵
PID:2812

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
1⤵
PID:2864

C:\Users\Admin\AppData\Local\Temp\3693219570\zmstage.exe
C:\Users\Admin\AppData\Local\Temp\3693219570\zmstage.exe
1⤵
PID:2140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1228-3-0x000000000EA00000-0x000000000EA2F000-memory.dmp

Filesize
188KB

Download
memory/1228-51-0x000000000EA50000-0x000000000EA8D000-memory.dmp

Filesize
244KB

Download
memory/2700-0-0x0000000000350000-0x0000000000389000-memory.dmp

Filesize
228KB

Download
memory/2700-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2700-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing