Malware Analysis Report

2024-10-23 19:45

Sample ID 240421-kv5a9sfe24
Target fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118
SHA256 155f0bd1a6d92bf811c5157707eec4780d4b17cf6fb1166200a9d1ab9b93da48
Tags
nanocore evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

155f0bd1a6d92bf811c5157707eec4780d4b17cf6fb1166200a9d1ab9b93da48

Threat Level: Known bad

The file fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger persistence spyware stealer trojan

NanoCore

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Drops file in Program Files directory

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-21 08:56

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-21 08:56

Reported

2024-04-21 08:58

Platform

win7-20240221-en

Max time kernel

150s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Net Display = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Bit57\\ndmgr.exe" C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NAS Host = "C:\\Program Files (x86)\\NAS Host\\nashost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Net Display = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Bit57\\ndmgr.exe" C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2212 set thread context of 2580 N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\NAS Host\nashost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
File opened for modification C:\Program Files (x86)\NAS Host\nashost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sql_support.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2212 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2212 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2212 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2212 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2212 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2212 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2212 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2212 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2212 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2212 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2212 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2212 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2212 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\sql_support.exe
PID 2212 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\sql_support.exe
PID 2212 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\sql_support.exe
PID 2212 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\sql_support.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\sql_support.exe

"C:\Users\Admin\AppData\Local\Temp\sql_support.exe" -woohoo 2580 C:\Users\Admin\AppData\Local\Temp\ndmgr.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 netserv.serveftp.com udp
US 8.8.4.4:53 netserv.serveftp.com udp
US 8.8.8.8:53 netserv.serveftp.com udp
US 8.8.8.8:53 netserv.serveftp.com udp
US 8.8.4.4:53 netserv.serveftp.com udp
US 8.8.8.8:53 netserv.serveftp.com udp
US 8.8.4.4:53 netserv.serveftp.com udp
FR 176.31.174.37:55128 tcp
FR 176.31.174.37:55128 tcp
FR 176.31.174.37:55128 tcp
US 8.8.8.8:53 netserv.serveftp.com udp
US 8.8.4.4:53 netserv.serveftp.com udp
US 8.8.8.8:53 netserv.serveftp.com udp
US 8.8.4.4:53 netserv.serveftp.com udp
US 8.8.8.8:53 netserv.serveftp.com udp
US 8.8.4.4:53 netserv.serveftp.com udp
FR 176.31.174.37:55128 tcp
FR 176.31.174.37:55128 tcp
FR 176.31.174.37:55128 tcp
US 8.8.8.8:53 netserv.serveftp.com udp
US 8.8.4.4:53 netserv.serveftp.com udp
US 8.8.8.8:53 netserv.serveftp.com udp
US 8.8.4.4:53 netserv.serveftp.com udp
US 8.8.8.8:53 netserv.serveftp.com udp
US 8.8.4.4:53 netserv.serveftp.com udp
FR 176.31.174.37:55128 tcp

Files

memory/2212-1-0x0000000000570000-0x00000000005B0000-memory.dmp

memory/2212-0-0x0000000074710000-0x0000000074CBB000-memory.dmp

memory/2212-2-0x0000000074710000-0x0000000074CBB000-memory.dmp

memory/2212-12-0x0000000000570000-0x00000000005B0000-memory.dmp

memory/2580-14-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2580-16-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2580-18-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2580-21-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2580-24-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2580-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2580-30-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2580-32-0x0000000000400000-0x0000000000438000-memory.dmp

memory/3032-43-0x00000000001B0000-0x00000000001F0000-memory.dmp

memory/3032-44-0x0000000074710000-0x0000000074CBB000-memory.dmp

memory/2580-42-0x0000000074710000-0x0000000074CBB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sql_support.exe

MD5 fee9cf8ec3de16009f0ffecdb2a8a831
SHA1 93af1af6f4d7ba623f03892032a805a099e2ab3c
SHA256 155f0bd1a6d92bf811c5157707eec4780d4b17cf6fb1166200a9d1ab9b93da48
SHA512 70e7e5b0810df304774d547d14546b13dfea0e4a69775589ec1d9727868e0dba9db76948749274ebfd11551465ec6a432edc77ead4111f713abc10fb713f6e66

C:\Users\Admin\AppData\Local\Temp\Cab27CC.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 475f0cc45e2c54ac6583403530c06810
SHA1 8f1167fd739015fa9e40a2bdb3db9e18ebedf7b3
SHA256 19daf5bd0627a03a17f45ca7dbe0cf0d8e3ccbc33f58eaf1fff3b2a554f39772
SHA512 f190e23c72688e8d31ffff5a1c482e47cfa7fe78fb9815dd37bb23e29faa197427e3b22be76597637cf296ded35e498ed7adc1d902cd9245c3e3065a69325932

memory/3032-57-0x00000000001B0000-0x00000000001F0000-memory.dmp

memory/2212-59-0x0000000000570000-0x00000000005B0000-memory.dmp

memory/2212-58-0x0000000074710000-0x0000000074CBB000-memory.dmp

memory/2212-60-0x0000000000570000-0x00000000005B0000-memory.dmp

memory/2580-61-0x0000000074710000-0x0000000074CBB000-memory.dmp

memory/3032-62-0x00000000001B0000-0x00000000001F0000-memory.dmp

memory/3032-63-0x0000000074710000-0x0000000074CBB000-memory.dmp

memory/3032-64-0x0000000074710000-0x0000000074CBB000-memory.dmp

memory/3032-65-0x00000000001B0000-0x00000000001F0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-21 08:56

Reported

2024-04-21 08:58

Platform

win10v2004-20240412-en

Max time kernel

144s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe"

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\fee9cf8ec3de16009f0ffecdb2a8a831_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
NL 23.62.61.138:443 www.bing.com tcp
NL 23.62.61.138:443 www.bing.com tcp
US 8.8.8.8:53 138.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 154.173.246.72.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 48.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/4780-0-0x00000000754B0000-0x0000000075A61000-memory.dmp

memory/4780-1-0x00000000754B0000-0x0000000075A61000-memory.dmp

memory/4780-2-0x0000000001280000-0x0000000001290000-memory.dmp

memory/4780-5-0x0000000001280000-0x0000000001290000-memory.dmp

memory/4780-7-0x00000000754B0000-0x0000000075A61000-memory.dmp