Malware Analysis Report

2024-11-15 08:30

Sample ID 240408-y4x57sag96
Target e8545399823b411ea6cb927e80aded0f_JaffaCakes118
SHA256 3d31e58a5488a2ec7fb942d3b7005b73b7a617b2b31c89aae7edf6b460edd11e
Tags
asyncrat default agilenet persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3d31e58a5488a2ec7fb942d3b7005b73b7a617b2b31c89aae7edf6b460edd11e

Threat Level: Known bad

The file e8545399823b411ea6cb927e80aded0f_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

asyncrat default agilenet persistence rat

AsyncRat

Modifies WinLogon for persistence

Executes dropped EXE

Obfuscated with Agile.Net obfuscator

Drops startup file

Checks computer location settings

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-08 20:20

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-08 20:20

Reported

2024-04-08 20:23

Platform

win7-20231129-en

Max time kernel

118s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe"

Signatures

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e210f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.google.com udp
GB 142.250.178.4:443 www.google.com tcp
US 8.8.8.8:53 pki.goog udp
US 216.239.32.29:80 pki.goog tcp
US 8.8.8.8:53 www.microsoft.com udp
NL 23.62.61.129:443 www.bing.com tcp
GB 142.250.178.4:443 www.google.com tcp
NL 23.62.61.155:443 www.bing.com tcp

Files

memory/2548-0-0x00000000002C0000-0x0000000000342000-memory.dmp

memory/2548-1-0x00000000745E0000-0x0000000074CCE000-memory.dmp

memory/2548-2-0x0000000004920000-0x0000000004960000-memory.dmp

memory/2548-17-0x00000000745E0000-0x0000000074CCE000-memory.dmp

memory/2548-18-0x0000000004920000-0x0000000004960000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-08 20:20

Reported

2024-04-08 20:23

Platform

win10v2004-20240226-en

Max time kernel

159s

Max time network

165s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe"

Signatures

AsyncRat

rat asyncrat

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Adobes\\sys30.exe," C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2348 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2348 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2348 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1304 wrote to memory of 3104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1304 wrote to memory of 3104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1304 wrote to memory of 3104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2348 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe
PID 2348 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe
PID 2348 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe
PID 2940 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe
PID 2940 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe
PID 2940 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe
PID 2940 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe
PID 2940 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe
PID 2940 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe
PID 2940 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe
PID 2940 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e8545399823b411ea6cb927e80aded0f_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe,"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe,"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3488 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 13.107.253.67:443 tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.178.4:443 www.google.com tcp
NL 23.62.61.152:443 www.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 4.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 152.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
GB 142.250.178.4:443 www.google.com tcp
NL 23.62.61.129:443 www.bing.com tcp
US 8.8.8.8:53 129.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 ControllerFinallineballinglove33.webredirect.org udp
NL 91.92.248.48:7719 ControllerFinallineballinglove33.webredirect.org tcp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
NL 91.92.248.48:7719 ControllerFinallineballinglove33.webredirect.org tcp
US 8.8.8.8:53 7.173.189.20.in-addr.arpa udp
NL 91.92.248.48:7719 ControllerFinallineballinglove33.webredirect.org tcp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.200.42:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 42.200.250.142.in-addr.arpa udp

Files

memory/2348-0-0x0000000074AD0000-0x0000000075280000-memory.dmp

memory/2348-1-0x0000000000F10000-0x0000000000F92000-memory.dmp

memory/2348-2-0x0000000005AF0000-0x0000000005E44000-memory.dmp

memory/2348-3-0x0000000005930000-0x00000000059CC000-memory.dmp

memory/2348-4-0x0000000006020000-0x0000000006030000-memory.dmp

memory/2348-5-0x0000000006A80000-0x0000000006AA8000-memory.dmp

memory/2348-6-0x0000000006C20000-0x0000000006C86000-memory.dmp

memory/2348-7-0x0000000006BE0000-0x0000000006C02000-memory.dmp

memory/2348-8-0x0000000006E30000-0x0000000006EC2000-memory.dmp

memory/2348-9-0x0000000074AD0000-0x0000000075280000-memory.dmp

memory/2348-10-0x0000000006020000-0x0000000006030000-memory.dmp

memory/2348-11-0x0000000006020000-0x0000000006030000-memory.dmp

memory/2348-13-0x0000000006020000-0x0000000006030000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobes\sys30.exe

MD5 e8545399823b411ea6cb927e80aded0f
SHA1 22af521e6119003289b6bd5d7be9a3328acb59cc
SHA256 3d31e58a5488a2ec7fb942d3b7005b73b7a617b2b31c89aae7edf6b460edd11e
SHA512 91b5f2c5fda648d4b54e5a434cb8848c3b1a51627387d552d12461adbc4f1925d3a1f23321f36e6404d6d7eff616cd428f648e5b44384f2c394e2777f0b938f6

memory/2940-24-0x0000000074AD0000-0x0000000075280000-memory.dmp

memory/2940-25-0x0000000005420000-0x0000000005430000-memory.dmp

memory/2940-27-0x0000000005420000-0x0000000005430000-memory.dmp

memory/2348-28-0x0000000074AD0000-0x0000000075280000-memory.dmp

memory/2940-29-0x0000000006470000-0x0000000006484000-memory.dmp

memory/2940-30-0x00000000068B0000-0x00000000068B6000-memory.dmp

memory/4008-31-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\sys30.exe.log

MD5 232c537b9de63796f124d6e7c3afcbd9
SHA1 cfa10e8cfc64eaaa0f2b17363a65426c41729e9d
SHA256 da9ff8d5d3ad1a97c7f369973506ad780565ef44ed7f89df850cc6be5d07801c
SHA512 0157b54708b6a33497bd3eabc07f6c17ad784882afcd18be8ffcdb835564ab9d43c5be25347db0a715fc32d70f116026dd11db15005ec0cdc13f8acea44e7eb9

memory/2940-35-0x0000000074AD0000-0x0000000075280000-memory.dmp

memory/4008-36-0x0000000074AD0000-0x0000000075280000-memory.dmp

memory/4008-37-0x0000000005030000-0x0000000005040000-memory.dmp

memory/4008-38-0x0000000074AD0000-0x0000000075280000-memory.dmp

memory/4008-39-0x0000000005030000-0x0000000005040000-memory.dmp