Malware Analysis Report

2025-01-03 08:12

Sample ID 240419-hhrhjacb41
Target f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118
SHA256 1013ad1290523f5417ed789d11900f8ae804c0d81ed60af75684039fb06223b8
Tags
lumma metasploit backdoor evasion stealer themida trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1013ad1290523f5417ed789d11900f8ae804c0d81ed60af75684039fb06223b8

Threat Level: Known bad

The file f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

lumma metasploit backdoor evasion stealer themida trojan

Lumma Stealer

Modifies security service

Detect Lumma Stealer payload V4

MetaSploit

Identifies Wine through registry keys

Loads dropped DLL

Themida packer

Executes dropped EXE

Checks computer location settings

Enumerates connected drives

Drops file in System32 directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies registry class

Runs .reg file with regedit

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-19 06:44

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-19 06:44

Reported

2024-04-19 06:47

Platform

win7-20240220-en

Max time kernel

140s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe"

Signatures

Detect Lumma Stealer payload V4

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Lumma Stealer

stealer lumma

MetaSploit

trojan backdoor metasploit

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" C:\Windows\SysWOW64\regedit.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine C:\Windows\SysWOW64\windows_update.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine C:\Windows\SysWOW64\windows_update.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine C:\Windows\SysWOW64\windows_update.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine C:\Windows\SysWOW64\windows_update.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine C:\Windows\SysWOW64\windows_update.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine C:\Windows\SysWOW64\windows_update.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\MINE.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine C:\Windows\SysWOW64\windows_update.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine C:\Windows\SysWOW64\windows_update.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine C:\Windows\SysWOW64\windows_update.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine C:\Windows\SysWOW64\windows_update.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MINE.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A
N/A N/A C:\Windows\SysWOW64\windows_update.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Q: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\msiexec.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\windows_update.exe C:\Users\Admin\AppData\Local\Temp\MINE.exe N/A
File opened for modification C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe N/A
File opened for modification C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe N/A
File created C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe N/A
File created C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe N/A
File opened for modification C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe N/A
File created C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe N/A
File opened for modification C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe N/A
File opened for modification C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe N/A
File opened for modification C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe N/A
File opened for modification C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe N/A
File created C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe N/A
File created C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe N/A
File opened for modification C:\Windows\SysWOW64\windows_update.exe C:\Users\Admin\AppData\Local\Temp\MINE.exe N/A
File created C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe N/A
File created C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe N/A
File created C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe N/A
File created C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe N/A
File opened for modification C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe N/A
File created C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe N/A
File opened for modification C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe N/A
File opened for modification C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2852 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2852 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2852 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2852 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2852 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2852 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2852 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2852 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\MINE.exe
PID 2852 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\MINE.exe
PID 2852 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\MINE.exe
PID 2852 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\MINE.exe
PID 3048 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\MINE.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\MINE.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\MINE.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\MINE.exe C:\Windows\SysWOW64\cmd.exe
PID 2776 wrote to memory of 540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2776 wrote to memory of 540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2776 wrote to memory of 540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2776 wrote to memory of 540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 3048 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\MINE.exe C:\Windows\SysWOW64\windows_update.exe
PID 3048 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\MINE.exe C:\Windows\SysWOW64\windows_update.exe
PID 3048 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\MINE.exe C:\Windows\SysWOW64\windows_update.exe
PID 3048 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\MINE.exe C:\Windows\SysWOW64\windows_update.exe
PID 3048 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\MINE.exe C:\Windows\SysWOW64\windows_update.exe
PID 3048 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\MINE.exe C:\Windows\SysWOW64\windows_update.exe
PID 3048 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\MINE.exe C:\Windows\SysWOW64\windows_update.exe
PID 1584 wrote to memory of 1300 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe
PID 1584 wrote to memory of 1300 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe
PID 1584 wrote to memory of 1300 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe
PID 1584 wrote to memory of 1300 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe
PID 1584 wrote to memory of 1300 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe
PID 1584 wrote to memory of 1300 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe
PID 1584 wrote to memory of 1300 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe
PID 1300 wrote to memory of 3008 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\cmd.exe
PID 1300 wrote to memory of 3008 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\cmd.exe
PID 1300 wrote to memory of 3008 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\cmd.exe
PID 1300 wrote to memory of 3008 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\cmd.exe
PID 1300 wrote to memory of 3008 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\cmd.exe
PID 1300 wrote to memory of 3008 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\cmd.exe
PID 1300 wrote to memory of 3008 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\cmd.exe
PID 3008 wrote to memory of 2460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 3008 wrote to memory of 2460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 3008 wrote to memory of 2460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 3008 wrote to memory of 2460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 3008 wrote to memory of 2460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 3008 wrote to memory of 2460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 3008 wrote to memory of 2460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 1300 wrote to memory of 1968 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe
PID 1300 wrote to memory of 1968 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe
PID 1300 wrote to memory of 1968 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe
PID 1300 wrote to memory of 1968 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe
PID 1300 wrote to memory of 1968 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe
PID 1300 wrote to memory of 1968 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe
PID 1300 wrote to memory of 1968 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\windows_update.exe
PID 1968 wrote to memory of 1652 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\cmd.exe
PID 1968 wrote to memory of 1652 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\cmd.exe
PID 1968 wrote to memory of 1652 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\cmd.exe
PID 1968 wrote to memory of 1652 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\cmd.exe
PID 1968 wrote to memory of 1652 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\cmd.exe
PID 1968 wrote to memory of 1652 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\cmd.exe
PID 1968 wrote to memory of 1652 N/A C:\Windows\SysWOW64\windows_update.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 1652 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 1652 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe"

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Mayoko110.msi"

C:\Users\Admin\AppData\Local\Temp\MINE.exe

"C:\Users\Admin\AppData\Local\Temp\MINE.exe"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\a.bat

C:\Windows\SysWOW64\regedit.exe

REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg

C:\Windows\SysWOW64\windows_update.exe

C:\Windows\system32\windows_update.exe 668 "C:\Users\Admin\AppData\Local\Temp\MINE.exe"

C:\Windows\SysWOW64\windows_update.exe

C:\Windows\system32\windows_update.exe 768 "C:\Windows\SysWOW64\windows_update.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\a.bat

C:\Windows\SysWOW64\regedit.exe

REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg

C:\Windows\SysWOW64\windows_update.exe

C:\Windows\system32\windows_update.exe 784 "C:\Windows\SysWOW64\windows_update.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\a.bat

C:\Windows\SysWOW64\regedit.exe

REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg

C:\Windows\SysWOW64\windows_update.exe

C:\Windows\system32\windows_update.exe 792 "C:\Windows\SysWOW64\windows_update.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\a.bat

C:\Windows\SysWOW64\regedit.exe

REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg

C:\Windows\SysWOW64\windows_update.exe

C:\Windows\system32\windows_update.exe 788 "C:\Windows\SysWOW64\windows_update.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\a.bat

C:\Windows\SysWOW64\regedit.exe

REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg

C:\Windows\SysWOW64\windows_update.exe

C:\Windows\system32\windows_update.exe 800 "C:\Windows\SysWOW64\windows_update.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\a.bat

C:\Windows\SysWOW64\regedit.exe

REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg

C:\Windows\SysWOW64\windows_update.exe

C:\Windows\system32\windows_update.exe 796 "C:\Windows\SysWOW64\windows_update.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\a.bat

C:\Windows\SysWOW64\regedit.exe

REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg

C:\Windows\SysWOW64\windows_update.exe

C:\Windows\system32\windows_update.exe 808 "C:\Windows\SysWOW64\windows_update.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\a.bat

C:\Windows\SysWOW64\regedit.exe

REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg

C:\Windows\SysWOW64\windows_update.exe

C:\Windows\system32\windows_update.exe 812 "C:\Windows\SysWOW64\windows_update.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\a.bat

C:\Windows\SysWOW64\regedit.exe

REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg

C:\Windows\SysWOW64\windows_update.exe

C:\Windows\system32\windows_update.exe 816 "C:\Windows\SysWOW64\windows_update.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\a.bat

C:\Windows\SysWOW64\regedit.exe

REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg

Network

N/A

Files

memory/2852-1-0x0000000000400000-0x0000000000412000-memory.dmp

\Users\Admin\AppData\Local\Temp\MINE.exe

MD5 9c0595fe4367e61e2e578ef6fa5e3d0f
SHA1 99a64947b86b69e2dda873076e18433a63338729
SHA256 60591d011a090da281ada86b6b9d505e7faa491ce23304b74f7e243a973d5714
SHA512 898712fa3192ccdfbb0346119357bada0839d58d095c18099ac839778b10eb13372618bf0ad0187b4a4526f95a6058bb5bbcd137046bbfb7ef19c60fa0417c85

memory/2852-13-0x0000000003010000-0x00000000033E4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Mayoko110.msi

MD5 c6b2b9d56db7b703f815cfb6c3afe15f
SHA1 755374a9e93762d5cc954b9ac8b7806b0350f5e9
SHA256 f5d26026febd4fb52b651fd2cb0677289a32db2dda7a76fa161a0f72f3e1f7b4
SHA512 a1e92ff0aec339275747f86c6261a2e78bd4511b406fd90e22e8514a76bf161c4758135e2142ccc472e4d4d04c9911853d17e27272c6c389e9bea6c01debcdd7

memory/2852-11-0x0000000000400000-0x0000000000412000-memory.dmp

memory/3048-15-0x00000000007E0000-0x00000000008DF000-memory.dmp

memory/3048-17-0x0000000000270000-0x0000000000271000-memory.dmp

memory/3048-16-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/3048-25-0x0000000004570000-0x0000000004572000-memory.dmp

C:\a.bat

MD5 0019a0451cc6b9659762c3e274bc04fb
SHA1 5259e256cc0908f2846e532161b989f1295f479b
SHA256 ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876
SHA512 314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

C:\Users\Admin\AppData\Local\Temp\1.reg

MD5 9e5db93bd3302c217b15561d8f1e299d
SHA1 95a5579b336d16213909beda75589fd0a2091f30
SHA256 f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e
SHA512 b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

memory/3048-122-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/3048-134-0x0000000004530000-0x0000000004531000-memory.dmp

memory/3048-136-0x0000000004450000-0x0000000004451000-memory.dmp

memory/3048-135-0x00000000044F0000-0x00000000044F1000-memory.dmp

memory/3048-139-0x0000000004540000-0x0000000004542000-memory.dmp

memory/3048-141-0x0000000004480000-0x0000000004481000-memory.dmp

memory/3048-140-0x0000000004460000-0x0000000004461000-memory.dmp

memory/3048-137-0x0000000004430000-0x0000000004431000-memory.dmp

memory/3048-142-0x00000000044E0000-0x00000000044E1000-memory.dmp

memory/3048-143-0x0000000004500000-0x0000000004501000-memory.dmp

memory/3048-144-0x0000000004420000-0x0000000004421000-memory.dmp

memory/3048-145-0x0000000004470000-0x0000000004471000-memory.dmp

memory/3048-149-0x0000000004510000-0x0000000004511000-memory.dmp

memory/3048-150-0x00000000044B0000-0x00000000044B1000-memory.dmp

memory/3048-152-0x0000000004550000-0x0000000004551000-memory.dmp

memory/3048-151-0x00000000044C0000-0x00000000044C1000-memory.dmp

memory/3048-162-0x0000000004C40000-0x0000000005014000-memory.dmp

memory/1584-164-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/3048-163-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/1584-165-0x0000000000D70000-0x0000000001144000-memory.dmp

memory/1584-166-0x0000000004AA0000-0x0000000004AA2000-memory.dmp

memory/1584-167-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/1584-169-0x00000000049F0000-0x00000000049F2000-memory.dmp

memory/1584-168-0x0000000004A70000-0x0000000004A72000-memory.dmp

memory/1584-170-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/1584-176-0x0000000000D70000-0x0000000001144000-memory.dmp

memory/1300-177-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/1300-178-0x0000000000E60000-0x0000000001234000-memory.dmp

memory/1300-179-0x0000000000E60000-0x0000000001234000-memory.dmp

memory/1300-180-0x0000000000E60000-0x0000000001234000-memory.dmp

memory/1584-181-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/1300-182-0x0000000004AA0000-0x0000000004AA2000-memory.dmp

memory/1300-298-0x0000000004A70000-0x0000000004A72000-memory.dmp

memory/1300-300-0x00000000049E0000-0x00000000049E2000-memory.dmp

memory/1300-190-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/1300-301-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/1300-308-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/1300-309-0x0000000000E60000-0x0000000001234000-memory.dmp

memory/1968-310-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/1968-311-0x0000000000D40000-0x0000000001114000-memory.dmp

memory/1968-314-0x0000000000D40000-0x0000000001114000-memory.dmp

memory/1968-313-0x0000000000D40000-0x0000000001114000-memory.dmp

memory/1968-322-0x0000000004AA0000-0x0000000004AA2000-memory.dmp

memory/1968-430-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/1968-433-0x0000000004A10000-0x0000000004A12000-memory.dmp

memory/1968-431-0x0000000004A70000-0x0000000004A72000-memory.dmp

memory/1968-434-0x00000000049F0000-0x00000000049F2000-memory.dmp

memory/1968-435-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/2632-441-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/2632-442-0x0000000000E50000-0x0000000001224000-memory.dmp

memory/2632-443-0x0000000000E50000-0x0000000001224000-memory.dmp

memory/2632-444-0x0000000000E50000-0x0000000001224000-memory.dmp

memory/1968-445-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/2632-447-0x0000000004AC0000-0x0000000004AC2000-memory.dmp

memory/2632-454-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/2632-470-0x0000000004A90000-0x0000000004A92000-memory.dmp

memory/2632-564-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/2632-570-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/2480-571-0x0000000001020000-0x00000000013F4000-memory.dmp

memory/2480-572-0x0000000001020000-0x00000000013F4000-memory.dmp

memory/2480-573-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/2480-575-0x0000000001020000-0x00000000013F4000-memory.dmp

memory/2480-583-0x0000000004AB0000-0x0000000004AB2000-memory.dmp

memory/2480-693-0x0000000004A80000-0x0000000004A82000-memory.dmp

memory/2480-585-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/2480-695-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/2004-831-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/2132-953-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/2132-964-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/1624-1084-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/1624-1094-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/988-1212-0x0000000000400000-0x00000000007D4000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-19 06:44

Reported

2024-04-19 06:47

Platform

win10v2004-20240226-en

Max time kernel

142s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MINE.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\MINE.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\msiexec.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f9bb522ae0a4aa47a6d94bc99e215bb6_JaffaCakes118.exe"

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Mayoko110.msi"

C:\Users\Admin\AppData\Local\Temp\MINE.exe

"C:\Users\Admin\AppData\Local\Temp\MINE.exe"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
GB 142.250.187.234:443 tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 169.117.168.52.in-addr.arpa udp

Files

memory/1348-0-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Mayoko110.msi

MD5 c6b2b9d56db7b703f815cfb6c3afe15f
SHA1 755374a9e93762d5cc954b9ac8b7806b0350f5e9
SHA256 f5d26026febd4fb52b651fd2cb0677289a32db2dda7a76fa161a0f72f3e1f7b4
SHA512 a1e92ff0aec339275747f86c6261a2e78bd4511b406fd90e22e8514a76bf161c4758135e2142ccc472e4d4d04c9911853d17e27272c6c389e9bea6c01debcdd7

C:\Users\Admin\AppData\Local\Temp\MINE.exe

MD5 9c0595fe4367e61e2e578ef6fa5e3d0f
SHA1 99a64947b86b69e2dda873076e18433a63338729
SHA256 60591d011a090da281ada86b6b9d505e7faa491ce23304b74f7e243a973d5714
SHA512 898712fa3192ccdfbb0346119357bada0839d58d095c18099ac839778b10eb13372618bf0ad0187b4a4526f95a6058bb5bbcd137046bbfb7ef19c60fa0417c85

memory/1348-14-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1288-15-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/1288-16-0x00000000022F0000-0x00000000023EF000-memory.dmp

memory/1288-17-0x00000000023F0000-0x00000000023F1000-memory.dmp

memory/1288-19-0x0000000000400000-0x00000000007D4000-memory.dmp

memory/1288-20-0x00000000023F0000-0x00000000023F1000-memory.dmp