Malware Analysis Report

2025-01-02 12:15

Sample ID 240416-1hvjasdd22
Target f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118
SHA256 f23cdf7d982b3e0953701893f4104a186da68d8d56c4e8f99f798eff27b7fbae
Tags
asyncrat default rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f23cdf7d982b3e0953701893f4104a186da68d8d56c4e8f99f798eff27b7fbae

Threat Level: Known bad

The file f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

asyncrat default rat

AsyncRat

Loads dropped DLL

Checks computer location settings

Drops startup file

Executes dropped EXE

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-16 21:39

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-16 21:39

Reported

2024-04-16 21:42

Platform

win7-20240221-en

Max time kernel

146s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118.exe"

Signatures

AsyncRat

rat asyncrat

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Odvhfcwmlbrkgm.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Odvhfcwmlbrkgm.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2556 set thread context of 2504 N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1972 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Nzllbibva.exe
PID 1972 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Nzllbibva.exe
PID 1972 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Nzllbibva.exe
PID 1972 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Nzllbibva.exe
PID 1972 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe
PID 1972 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe
PID 1972 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe
PID 1972 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe
PID 2556 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe
PID 2556 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe
PID 2556 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe
PID 2556 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe
PID 2556 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe
PID 2556 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe
PID 2556 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe
PID 2556 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe
PID 2556 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\Nzllbibva.exe

"C:\Users\Admin\AppData\Local\Temp\Nzllbibva.exe"

C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe

"C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe"

C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe

"C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 shortcut2021.duckdns.org udp

Files

memory/1972-0-0x0000000000400000-0x0000000000444000-memory.dmp

memory/1972-1-0x0000000074DF0000-0x00000000754DE000-memory.dmp

memory/1972-2-0x0000000004BA0000-0x0000000004BE0000-memory.dmp

\Users\Admin\AppData\Local\Temp\Nzllbibva.exe

MD5 fb3ae19f3c99124fb0ed13205ba967c2
SHA1 4fc3d1efd07d29d657b2a8fb7bec3d05cd430627
SHA256 0a92b929cc8041cd868683116f3e7741cd22755a5ad57af56aa9bd6c54968c43
SHA512 faef6c2fd3a71a308df24174e189f40b5e0909f3c99886d449f1b738dd91cedc2dbbaa4146f56448eb392f67925792c028dd92778ca3a440ed751378e5631b75

\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe

MD5 269d7728dbb38468ba697dedc335d4e6
SHA1 3e6980bb5a3b0bf247800e6100dcbd7a97db2d4b
SHA256 b452105ebb3c208a7955ac226a26c5d9322921c26f055c9ef10a0b4c5a4ae7b5
SHA512 0ae87dceeb02bf0b9d27a304b44add4fecc2382a9c444013d8e5add04b4760fe121839aea10f9eada8497e01ac85b0c2db2673897c0273cfe8d4c0a3915df3b6

memory/2444-18-0x0000000074DF0000-0x00000000754DE000-memory.dmp

memory/2444-17-0x0000000001220000-0x000000000124E000-memory.dmp

memory/2556-19-0x0000000074DF0000-0x00000000754DE000-memory.dmp

memory/2556-20-0x0000000000C60000-0x0000000000C96000-memory.dmp

memory/1972-21-0x0000000074DF0000-0x00000000754DE000-memory.dmp

memory/2556-22-0x00000000046D0000-0x0000000004710000-memory.dmp

memory/2556-23-0x00000000046D0000-0x0000000004710000-memory.dmp

memory/2556-24-0x00000000004A0000-0x00000000004CA000-memory.dmp

memory/2556-26-0x0000000000C20000-0x0000000000C21000-memory.dmp

memory/2504-29-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2504-31-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2504-33-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2504-30-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2504-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2504-37-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2504-40-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2504-43-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2556-42-0x0000000074DF0000-0x00000000754DE000-memory.dmp

memory/2504-44-0x0000000074DF0000-0x00000000754DE000-memory.dmp

memory/2444-45-0x0000000074DF0000-0x00000000754DE000-memory.dmp

memory/2504-46-0x0000000000710000-0x0000000000750000-memory.dmp

memory/2504-47-0x0000000074DF0000-0x00000000754DE000-memory.dmp

memory/2504-48-0x0000000000710000-0x0000000000750000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-16 21:39

Reported

2024-04-16 21:42

Platform

win10v2004-20240412-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118.exe"

Signatures

AsyncRat

rat asyncrat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Odvhfcwmlbrkgm.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Odvhfcwmlbrkgm.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4896 set thread context of 4780 N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4016 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Nzllbibva.exe
PID 4016 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Nzllbibva.exe
PID 4016 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Nzllbibva.exe
PID 4016 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe
PID 4016 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe
PID 4016 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe
PID 4896 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe
PID 4896 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe
PID 4896 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe
PID 4896 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe
PID 4896 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe
PID 4896 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe
PID 4896 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe
PID 4896 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f461e0baafcd9a9bc218ac8bfdd5e31a_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\Nzllbibva.exe

"C:\Users\Admin\AppData\Local\Temp\Nzllbibva.exe"

C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe

"C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe"

C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe

"C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 87.126.19.2.in-addr.arpa udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp
US 8.8.8.8:53 shortcut2021.duckdns.org udp

Files

memory/4016-0-0x0000000000400000-0x0000000000444000-memory.dmp

memory/4016-1-0x0000000074D20000-0x00000000754D0000-memory.dmp

memory/4016-2-0x00000000049B0000-0x0000000004F54000-memory.dmp

memory/4016-3-0x0000000004F60000-0x0000000004FF2000-memory.dmp

memory/4016-4-0x00000000051B0000-0x00000000051C0000-memory.dmp

memory/4016-5-0x0000000005160000-0x000000000516A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Nzllbibva.exe

MD5 fb3ae19f3c99124fb0ed13205ba967c2
SHA1 4fc3d1efd07d29d657b2a8fb7bec3d05cd430627
SHA256 0a92b929cc8041cd868683116f3e7741cd22755a5ad57af56aa9bd6c54968c43
SHA512 faef6c2fd3a71a308df24174e189f40b5e0909f3c99886d449f1b738dd91cedc2dbbaa4146f56448eb392f67925792c028dd92778ca3a440ed751378e5631b75

C:\Users\Admin\AppData\Local\Temp\Odvhfcwmlbrkgm.exe

MD5 269d7728dbb38468ba697dedc335d4e6
SHA1 3e6980bb5a3b0bf247800e6100dcbd7a97db2d4b
SHA256 b452105ebb3c208a7955ac226a26c5d9322921c26f055c9ef10a0b4c5a4ae7b5
SHA512 0ae87dceeb02bf0b9d27a304b44add4fecc2382a9c444013d8e5add04b4760fe121839aea10f9eada8497e01ac85b0c2db2673897c0273cfe8d4c0a3915df3b6

memory/4016-29-0x0000000074D20000-0x00000000754D0000-memory.dmp

memory/4896-28-0x0000000074D20000-0x00000000754D0000-memory.dmp

memory/4896-30-0x0000000000FF0000-0x0000000001026000-memory.dmp

memory/2056-32-0x0000000000040000-0x000000000006E000-memory.dmp

memory/2056-33-0x0000000074D20000-0x00000000754D0000-memory.dmp

memory/4896-34-0x0000000005A80000-0x0000000005A90000-memory.dmp

memory/4896-35-0x00000000070C0000-0x0000000007136000-memory.dmp

memory/4896-36-0x0000000007140000-0x000000000716A000-memory.dmp

memory/4896-37-0x00000000071B0000-0x00000000071CE000-memory.dmp

memory/4896-38-0x00000000087B0000-0x000000000884C000-memory.dmp

memory/4896-39-0x0000000008710000-0x0000000008776000-memory.dmp

memory/4896-41-0x0000000008780000-0x0000000008781000-memory.dmp

memory/4780-43-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4896-46-0x0000000074D20000-0x00000000754D0000-memory.dmp

memory/2056-47-0x0000000074D20000-0x00000000754D0000-memory.dmp

memory/4780-48-0x0000000074D20000-0x00000000754D0000-memory.dmp

memory/4780-49-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

memory/4780-50-0x0000000074D20000-0x00000000754D0000-memory.dmp

memory/4780-51-0x0000000004FB0000-0x0000000004FC0000-memory.dmp