Resubmissions
11-04-2024 11:14
240411-nb5z8sdd7y 1011-04-2024 11:14
240411-nb5dpsdd7w 1011-04-2024 11:14
240411-nb43yaac56 1011-04-2024 11:14
240411-nb3vwadd7t 1011-04-2024 11:14
240411-nb3j4sac55 1009-04-2024 03:54
240409-egc2zahd2z 1009-04-2024 03:53
240409-ef443adg89 1009-04-2024 03:53
240409-efxd8ahc9v 1009-04-2024 03:53
240409-efmvsahc8w 1003-04-2024 00:16
240403-akzypahh9t 10Analysis
-
max time kernel
598s -
max time network
603s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
11-04-2024 11:14
Behavioral task
behavioral1
Sample
9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe
-
Size
7.6MB
-
MD5
9b035bad2b8a21fb2c57fd784c89b8d5
-
SHA1
ee15fad65f3f22df7f54e218176c45d369ebb70f
-
SHA256
2d49873798ab5ee10992f377ebb27ee940b1f354b9ec4ebebe687177ea2b214c
-
SHA512
96c0189aba67db2f1c38affa5ac44665566ea17e20e5f749aef771739c81beb96bbcac8ea35aad80cffc9d492e23fcbaefbf03f72011d9bd1ccac36182466dde
-
SSDEEP
196608:imEljesxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQUDxtw3iFFrS6XOfTV73cP:balxwZ6v1CPwDv3uFteg2EeJUO9WLjD/
Malware Config
Extracted
bitrat
1.32
7ix5nfolcp4ta4mk2dtihev73rw7d2edpbd5tp7sf7zgmpv66fpxnwqd.onion:80
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
tor_process
dllhost
Signatures
-
BitRAT payload 2 IoCs
resource yara_rule behavioral4/memory/2436-0-0x0000000000400000-0x0000000000BAA000-memory.dmp family_bitrat behavioral4/memory/2436-52-0x0000000000400000-0x0000000000BAA000-memory.dmp family_bitrat -
ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral4/files/0x000100000002a781-18.dat acprotect behavioral4/files/0x000100000002a785-23.dat acprotect behavioral4/files/0x000100000002a783-32.dat acprotect behavioral4/files/0x000100000002a786-31.dat acprotect behavioral4/files/0x000100000002a788-30.dat acprotect behavioral4/files/0x000100000002a784-22.dat acprotect behavioral4/files/0x000100000002a782-21.dat acprotect -
Executes dropped EXE 25 IoCs
pid Process 1236 dllhost.exe 1744 dllhost.exe 4104 dllhost.exe 4860 dllhost.exe 4776 dllhost.exe 1424 dllhost.exe 932 dllhost.exe 2772 dllhost.exe 4500 dllhost.exe 4860 dllhost.exe 664 dllhost.exe 3120 dllhost.exe 800 dllhost.exe 1388 dllhost.exe 4712 dllhost.exe 4616 dllhost.exe 996 dllhost.exe 4100 dllhost.exe 2004 dllhost.exe 4332 dllhost.exe 5112 dllhost.exe 4236 dllhost.exe 1744 dllhost.exe 3152 dllhost.exe 1696 dllhost.exe -
Loads dropped DLL 64 IoCs
pid Process 1236 dllhost.exe 1236 dllhost.exe 1236 dllhost.exe 1236 dllhost.exe 1236 dllhost.exe 1236 dllhost.exe 1236 dllhost.exe 1744 dllhost.exe 1744 dllhost.exe 1744 dllhost.exe 1744 dllhost.exe 1744 dllhost.exe 1744 dllhost.exe 1744 dllhost.exe 4104 dllhost.exe 4104 dllhost.exe 4104 dllhost.exe 4104 dllhost.exe 4104 dllhost.exe 4104 dllhost.exe 4104 dllhost.exe 4860 dllhost.exe 4860 dllhost.exe 4860 dllhost.exe 4860 dllhost.exe 4860 dllhost.exe 4860 dllhost.exe 4860 dllhost.exe 4776 dllhost.exe 4776 dllhost.exe 4776 dllhost.exe 4776 dllhost.exe 4776 dllhost.exe 4776 dllhost.exe 4776 dllhost.exe 1424 dllhost.exe 1424 dllhost.exe 1424 dllhost.exe 1424 dllhost.exe 1424 dllhost.exe 1424 dllhost.exe 1424 dllhost.exe 932 dllhost.exe 932 dllhost.exe 932 dllhost.exe 932 dllhost.exe 932 dllhost.exe 932 dllhost.exe 932 dllhost.exe 2772 dllhost.exe 2772 dllhost.exe 2772 dllhost.exe 2772 dllhost.exe 2772 dllhost.exe 2772 dllhost.exe 2772 dllhost.exe 4500 dllhost.exe 4500 dllhost.exe 4500 dllhost.exe 4500 dllhost.exe 4500 dllhost.exe 4500 dllhost.exe 4500 dllhost.exe 4860 dllhost.exe -
resource yara_rule behavioral4/files/0x000100000002a787-14.dat upx behavioral4/files/0x000100000002a781-18.dat upx behavioral4/files/0x000100000002a785-23.dat upx behavioral4/files/0x000100000002a783-32.dat upx behavioral4/files/0x000100000002a786-31.dat upx behavioral4/memory/1236-33-0x0000000074130000-0x00000000741FE000-memory.dmp upx behavioral4/files/0x000100000002a788-30.dat upx behavioral4/files/0x000100000002a784-22.dat upx behavioral4/files/0x000100000002a782-21.dat upx behavioral4/memory/1236-20-0x00000000008E0000-0x0000000000CE4000-memory.dmp upx behavioral4/memory/1236-37-0x00000000740E0000-0x0000000074129000-memory.dmp upx behavioral4/memory/1236-38-0x0000000073E10000-0x00000000740DF000-memory.dmp upx behavioral4/memory/1236-39-0x0000000073DE0000-0x0000000073E04000-memory.dmp upx behavioral4/memory/1236-40-0x0000000073D50000-0x0000000073DD8000-memory.dmp upx behavioral4/memory/1236-41-0x0000000073C40000-0x0000000073D4A000-memory.dmp upx behavioral4/memory/1236-42-0x0000000074200000-0x00000000742C8000-memory.dmp upx behavioral4/memory/1236-44-0x00000000008E0000-0x0000000000CE4000-memory.dmp upx behavioral4/memory/1236-46-0x0000000074130000-0x00000000741FE000-memory.dmp upx behavioral4/memory/1236-53-0x00000000008E0000-0x0000000000CE4000-memory.dmp upx behavioral4/memory/1236-54-0x00000000008E0000-0x0000000000CE4000-memory.dmp upx behavioral4/memory/1236-62-0x00000000008E0000-0x0000000000CE4000-memory.dmp upx behavioral4/memory/1236-70-0x00000000008E0000-0x0000000000CE4000-memory.dmp upx behavioral4/memory/1236-101-0x00000000008E0000-0x0000000000CE4000-memory.dmp upx behavioral4/memory/1236-116-0x00000000008E0000-0x0000000000CE4000-memory.dmp upx behavioral4/memory/1236-124-0x00000000008E0000-0x0000000000CE4000-memory.dmp upx behavioral4/memory/1236-132-0x00000000008E0000-0x0000000000CE4000-memory.dmp upx behavioral4/memory/1744-156-0x00000000008E0000-0x0000000000CE4000-memory.dmp upx behavioral4/memory/1236-159-0x00000000008E0000-0x0000000000CE4000-memory.dmp upx behavioral4/memory/1744-158-0x0000000073E10000-0x00000000740DF000-memory.dmp upx behavioral4/memory/1744-160-0x0000000074200000-0x00000000742C8000-memory.dmp upx behavioral4/memory/1744-163-0x00000000740E0000-0x0000000074129000-memory.dmp upx behavioral4/memory/1744-164-0x0000000073DE0000-0x0000000073E04000-memory.dmp upx behavioral4/memory/1744-161-0x0000000074130000-0x00000000741FE000-memory.dmp upx behavioral4/memory/1744-166-0x0000000073C40000-0x0000000073D4A000-memory.dmp upx behavioral4/memory/1744-167-0x0000000073D50000-0x0000000073DD8000-memory.dmp upx behavioral4/memory/1744-175-0x0000000073E10000-0x00000000740DF000-memory.dmp upx behavioral4/memory/1744-176-0x0000000074200000-0x00000000742C8000-memory.dmp upx behavioral4/memory/1744-177-0x0000000074130000-0x00000000741FE000-memory.dmp upx behavioral4/memory/1744-180-0x00000000008E0000-0x0000000000CE4000-memory.dmp upx behavioral4/memory/1744-179-0x0000000073DE0000-0x0000000073E04000-memory.dmp upx behavioral4/memory/1744-178-0x00000000740E0000-0x0000000074129000-memory.dmp upx behavioral4/memory/4104-192-0x0000000074260000-0x0000000074328000-memory.dmp upx behavioral4/memory/4104-194-0x00000000746E0000-0x0000000074729000-memory.dmp upx behavioral4/memory/4104-193-0x0000000074190000-0x000000007425E000-memory.dmp upx behavioral4/memory/4104-195-0x0000000074CD0000-0x0000000074CF4000-memory.dmp upx behavioral4/memory/4104-201-0x0000000073FF0000-0x0000000074078000-memory.dmp upx behavioral4/memory/4104-199-0x0000000074080000-0x000000007418A000-memory.dmp upx behavioral4/memory/4104-202-0x0000000074330000-0x00000000745FF000-memory.dmp upx behavioral4/memory/4104-219-0x00000000008E0000-0x0000000000CE4000-memory.dmp upx behavioral4/memory/4104-228-0x0000000074260000-0x0000000074328000-memory.dmp upx behavioral4/memory/4104-229-0x0000000074190000-0x000000007425E000-memory.dmp upx behavioral4/memory/4860-255-0x00000000008E0000-0x0000000000CE4000-memory.dmp upx behavioral4/memory/4860-256-0x0000000074330000-0x00000000745FF000-memory.dmp upx behavioral4/memory/4860-258-0x0000000074260000-0x0000000074328000-memory.dmp upx behavioral4/memory/4860-261-0x0000000074190000-0x000000007425E000-memory.dmp upx behavioral4/memory/4104-263-0x00000000008E0000-0x0000000000CE4000-memory.dmp upx behavioral4/memory/4860-265-0x00000000746E0000-0x0000000074729000-memory.dmp upx behavioral4/memory/4860-267-0x0000000074CD0000-0x0000000074CF4000-memory.dmp upx behavioral4/memory/4860-269-0x0000000074080000-0x000000007418A000-memory.dmp upx behavioral4/memory/4860-271-0x0000000073FF0000-0x0000000074078000-memory.dmp upx behavioral4/memory/4860-276-0x0000000074190000-0x000000007425E000-memory.dmp upx behavioral4/memory/4860-277-0x00000000008E0000-0x0000000000CE4000-memory.dmp upx behavioral4/memory/4860-278-0x0000000074330000-0x00000000745FF000-memory.dmp upx behavioral4/memory/4860-279-0x0000000074260000-0x0000000074328000-memory.dmp upx -
Looks up external IP address via web service 14 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 97 myexternalip.com 118 myexternalip.com 10 myexternalip.com 53 myexternalip.com 66 myexternalip.com 75 myexternalip.com 82 myexternalip.com 89 myexternalip.com 111 myexternalip.com 27 myexternalip.com 39 myexternalip.com 47 myexternalip.com 59 myexternalip.com 104 myexternalip.com -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 30 IoCs
pid Process 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe Token: SeShutdownPrivilege 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2436 wrote to memory of 1236 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 76 PID 2436 wrote to memory of 1236 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 76 PID 2436 wrote to memory of 1236 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 76 PID 2436 wrote to memory of 1744 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 77 PID 2436 wrote to memory of 1744 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 77 PID 2436 wrote to memory of 1744 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 77 PID 2436 wrote to memory of 4104 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 78 PID 2436 wrote to memory of 4104 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 78 PID 2436 wrote to memory of 4104 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 78 PID 2436 wrote to memory of 4860 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 79 PID 2436 wrote to memory of 4860 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 79 PID 2436 wrote to memory of 4860 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 79 PID 2436 wrote to memory of 4776 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 80 PID 2436 wrote to memory of 4776 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 80 PID 2436 wrote to memory of 4776 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 80 PID 2436 wrote to memory of 1424 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 81 PID 2436 wrote to memory of 1424 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 81 PID 2436 wrote to memory of 1424 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 81 PID 2436 wrote to memory of 932 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 82 PID 2436 wrote to memory of 932 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 82 PID 2436 wrote to memory of 932 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 82 PID 2436 wrote to memory of 2772 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 83 PID 2436 wrote to memory of 2772 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 83 PID 2436 wrote to memory of 2772 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 83 PID 2436 wrote to memory of 4500 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 84 PID 2436 wrote to memory of 4500 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 84 PID 2436 wrote to memory of 4500 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 84 PID 2436 wrote to memory of 4860 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 85 PID 2436 wrote to memory of 4860 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 85 PID 2436 wrote to memory of 4860 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 85 PID 2436 wrote to memory of 664 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 86 PID 2436 wrote to memory of 664 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 86 PID 2436 wrote to memory of 664 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 86 PID 2436 wrote to memory of 3120 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 87 PID 2436 wrote to memory of 3120 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 87 PID 2436 wrote to memory of 3120 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 87 PID 2436 wrote to memory of 800 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 88 PID 2436 wrote to memory of 800 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 88 PID 2436 wrote to memory of 800 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 88 PID 2436 wrote to memory of 1388 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 89 PID 2436 wrote to memory of 1388 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 89 PID 2436 wrote to memory of 1388 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 89 PID 2436 wrote to memory of 4712 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 90 PID 2436 wrote to memory of 4712 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 90 PID 2436 wrote to memory of 4712 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 90 PID 2436 wrote to memory of 4616 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 91 PID 2436 wrote to memory of 4616 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 91 PID 2436 wrote to memory of 4616 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 91 PID 2436 wrote to memory of 996 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 92 PID 2436 wrote to memory of 996 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 92 PID 2436 wrote to memory of 996 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 92 PID 2436 wrote to memory of 4100 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 93 PID 2436 wrote to memory of 4100 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 93 PID 2436 wrote to memory of 4100 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 93 PID 2436 wrote to memory of 2004 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 94 PID 2436 wrote to memory of 2004 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 94 PID 2436 wrote to memory of 2004 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 94 PID 2436 wrote to memory of 4332 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 95 PID 2436 wrote to memory of 4332 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 95 PID 2436 wrote to memory of 4332 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 95 PID 2436 wrote to memory of 5112 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 96 PID 2436 wrote to memory of 5112 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 96 PID 2436 wrote to memory of 5112 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 96 PID 2436 wrote to memory of 4236 2436 9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4104
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4860
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4776
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:932
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4500
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4860
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
PID:664
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
PID:3120
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
PID:800
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
PID:1388
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
PID:4712
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
PID:4616
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
PID:996
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
PID:4100
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
PID:2004
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
PID:4332
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
PID:5112
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
PID:4236
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
PID:1744
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
PID:3152
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
PID:1696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD554d90d169f8daa3a1fd7a35935d1ef21
SHA14308f59e59aeb12914f4ece652755bc7d8ebeea5
SHA256bd5c641f0ac1c3e4a76efd5dcc55725efda9a24083c317c154e97b188b55ed05
SHA512b071af5978a8760adac0f297fc0de86a0fbb9dd8603b26122f8d6871ffbc7ed1163207b3f66810de2e53b8feda6725ba198fc58654bcedba34320633fc377998
-
Filesize
2.7MB
MD5a1ef6838f217c027c3abe2eb5891dc6c
SHA1a93bdbe5e553e23e45378153fb86026a76741fd0
SHA25643d67abc74bf54528d587ced07804275f3bc4d046f495d6bb931a101f0e99bd8
SHA512e81782ea2293bc3e52320446b8b83a31bd82647bc470396bac8c54e9d58a7b79aa11c6cd48e8d0fa1fdc5144a5c6bcaa89b0b4daa905b3075ee2706fa0ed10b7
-
Filesize
20.3MB
MD598a5391b041e87dc94a987cbaed2d92a
SHA1fb30bb9cbdffd6a4600efe1ac77cebf8ba4093c9
SHA25653aa82c43f6867dda26ff19b14eaed900ef17b6fc8bc94f72833f36532a118fd
SHA5121ad8facae58eefa52d8cb71f8b91b98c392651b143bc5fbbe9a3efc86871736f199f92ee45815f43e5395f377d0f661262bd366493c9941600f2132a14b76722
-
Filesize
20.3MB
MD5676b44782d56ce27cb1f6818595ca3af
SHA1ca54f6c53addfb9c979da804b151d196c6337d31
SHA256f2ce267174020b89c4edb97cd20e70df0dc8be96d73ea2a73eecace9d64f5a5f
SHA5127691542cbe4a1868407116897f25282f9e08da6d3e455d5b360f461d7aff4af39722f091987f7be54760791ff971314b5f239e2cd6fb4bdcaa0fbda9d30261a6
-
Filesize
5KB
MD55d053e829fd71f5ed9e83ebfe28747cb
SHA1817222e55e989d0511c8f7448bf1154541427fb4
SHA256e4b6951b2bbd52e53380cb08bbc74f41017d64229f1b00cb707b9816f06078d8
SHA51298f49282a3f820e2a1e813ccdf2381c641f78026c9e56440a54d47fffcc89944e1b1edbb0555334d4b643ccb4e3a7a2011877b60e68ce1466cceb2a5aff55a35
-
Filesize
9KB
MD5b6ae7c022862329a8c80075fbb9524dc
SHA1be0cd5778f3a0fd9e2bfb55f4ab026e01feedddd
SHA256436788fbcd5563720fe5a245edee1601a45bc75a5d6fd6f24227a32f30cf7c0a
SHA512297c4a7bc8128db5648667b3d5e5637eb261105215eed54821e5384d862ede3534d1b2c21c3afb54d1ab402848788268f1730f3d74a1a8adb926bdcd9a001cce
-
Filesize
9KB
MD5994d9133a718a1f1c764d37bb08c8c03
SHA12c853622d391d359853ce74e40e8ac9eb452af30
SHA256faa24b23e569f7bc3a5d739ca9a4d70a7b600b50db534e05c5d1807055a0b50d
SHA512b3e055884e2d6c233785892809faa1f19847a971236c0371dc496c5a8cfc2faaba64fbc2d9e511549560f2af8b7525c2b1416fd6d0569319583480cc4627f071
-
Filesize
973KB
MD55cfe61ff895c7daa889708665ef05d7b
SHA15e58efe30406243fbd58d4968b0492ddeef145f2
SHA256f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5
SHA51243b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da
-
Filesize
1.7MB
MD52384a02c4a1f7ec481adde3a020607d3
SHA17e848d35a10bf9296c8fa41956a3daa777f86365
SHA256c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369
SHA5121ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503
-
Filesize
366KB
MD5099983c13bade9554a3c17484e5481f1
SHA1a84e69ad9722f999252d59d0ed9a99901a60e564
SHA256b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838
SHA51289f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2
-
Filesize
286KB
MD5b0d98f7157d972190fe0759d4368d320
SHA15715a533621a2b642aad9616e603c6907d80efc4
SHA2562922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5
SHA51241ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496
-
Filesize
439KB
MD5c88826ac4bb879622e43ead5bdb95aeb
SHA187d29853649a86f0463bfd9ad887b85eedc21723
SHA256c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f
SHA512f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3
-
Filesize
88KB
MD52c916456f503075f746c6ea649cf9539
SHA1fa1afc1f3d728c89b2e90e14ca7d88b599580a9d
SHA256cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6
SHA5121c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd
-
Filesize
188KB
MD5d407cc6d79a08039a6f4b50539e560b8
SHA121171adbc176dc19aaa5e595cd2cd4bd1dfd0c71
SHA25692cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e
SHA512378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c
-
Filesize
139B
MD5dbd537e3da06f7d7aeaf58f4decc0c94
SHA17e740ea6dcf8545710f99519014e9bb029028a84
SHA256349b36a467d778e29b96528cdd25d6c34a54be659a9ef516b3833106ceb679b2
SHA512a84633c420c825b15ef2fc5cf83a6d75fcdddbb06d3b7dc74537d5bc98b5d910d3dec4838f30be3a06373662d2946f156f36bd2e033e0b6089753006ac327a90
-
Filesize
52KB
MD5add33041af894b67fe34e1dc819b7eb6
SHA16db46eb021855a587c95479422adcc774a272eeb
SHA2568688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183
SHA512bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa