Malware Analysis Report

2024-10-23 19:44

Sample ID 240426-se1xxaea96
Target 010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118
SHA256 330975f098d84c78c5a602f28fee0e6507872c3de822d267cd10e8879ec3aecc
Tags
nanocore evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

330975f098d84c78c5a602f28fee0e6507872c3de822d267cd10e8879ec3aecc

Threat Level: Known bad

The file 010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger persistence spyware stealer trojan

NanoCore

Drops startup file

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-26 15:03

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-26 15:03

Reported

2024-04-26 15:05

Platform

win7-20240215-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Amkbvc.url C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Subsystem = "C:\\Program Files (x86)\\DDP Subsystem\\ddpss.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1876 set thread context of 2756 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\DDP Subsystem\ddpss.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
File opened for modification C:\Program Files (x86)\DDP Subsystem\ddpss.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1876 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1876 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1876 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1876 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2988 wrote to memory of 2620 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2988 wrote to memory of 2620 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2988 wrote to memory of 2620 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2988 wrote to memory of 2620 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 1876 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1876 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1876 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1876 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1876 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1876 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1876 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1876 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1876 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1876 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1876 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1876 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2756 wrote to memory of 2408 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2756 wrote to memory of 2408 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2756 wrote to memory of 2408 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2756 wrote to memory of 2408 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2756 wrote to memory of 2840 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2756 wrote to memory of 2840 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2756 wrote to memory of 2840 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2756 wrote to memory of 2840 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pbsfbugm\pbsfbugm.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES140D.tmp" "c:\Users\Admin\AppData\Local\Temp\pbsfbugm\CSC7501D42EACA04CCD8C77AE99ADA6E682.TMP"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DDP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp162F.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DDP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp16BD.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 192.169.69.26:7719 moranhq.duckdns.org tcp

Files

memory/1876-0-0x0000000000BE0000-0x0000000000C36000-memory.dmp

memory/1876-1-0x0000000074590000-0x0000000074C7E000-memory.dmp

memory/1876-4-0x0000000004D30000-0x0000000004D70000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\pbsfbugm\pbsfbugm.cmdline

MD5 20742cb590c70a5ee277fe16988a733d
SHA1 22e027071a46a6b188be0b2bec4ac0d15ef673d5
SHA256 7dd29c94a76e3dcef890d1405392d290ba9d3188f9092d7dfa06dbe0401c6fda
SHA512 de26c855e9078a2aab794c1017dd5e222be80c59abc75c74b26dde48d2c552b3c0a838088654ae3332de4d60c31711fd9eacc6195f78020c3f148af85dfaba5a

\??\c:\Users\Admin\AppData\Local\Temp\pbsfbugm\pbsfbugm.0.cs

MD5 d008b533315d3a3dfe0ab52ba6ca9dd6
SHA1 f41143f93a7aebaefe12568d0997a1d6d778a2da
SHA256 c9da722a81316670bf37097da756826bac0b39600ccca9e8e360e9b46346987f
SHA512 9398c70790dd38bebcc42f247271482ab33deb2b1f679ce8f44d6b3c33d83549c3bc5b04d7bff6e23f4e783f0b548d1d139b1bf0324c13d20df892a7a353de91

\??\c:\Users\Admin\AppData\Local\Temp\pbsfbugm\CSC7501D42EACA04CCD8C77AE99ADA6E682.TMP

MD5 03ddda88d31dc38716a45572ef92b63f
SHA1 643c3cb00abac7488f20e31e28dd26f36b55f7d6
SHA256 c433158eea37a3c96241a45807329e460ce1392ed084943eabe881c3dc34636b
SHA512 c492fa99feb2c744eb3a57c97d76d57d909f785f5fc8ff0b3ff53176c3e94559b6287a9eb13c9a422893055fab6d3c3a384c28d087b37c2572aff31c23de8259

C:\Users\Admin\AppData\Local\Temp\RES140D.tmp

MD5 e9a31fdae6c4ac91588e9815800b6cf1
SHA1 0c72e1a8bb74a075a9aea2554d48afd695f90c0d
SHA256 82c76ebba32b8ab9069595c597d3d117c9d1b04d349e3d43aa4886f23703ef8d
SHA512 27ac35557fca32dd20405e6872a220021bb15c7a0214c770f18983295694795ad6b41dfa71ce1d4fed2a1dd02a921a4c72f9c12360f0ca823db2c7f948942782

C:\Users\Admin\AppData\Local\Temp\pbsfbugm\pbsfbugm.pdb

MD5 a918963ee1e1d80e6a4e1463d453ad4a
SHA1 ae472c3f49009775eb78bb9ee68dda83556dde5d
SHA256 26512d64fa7f8df5a218b8d5d8626f3822b81e882827ec082ee7fecae654d66f
SHA512 009e5591da8a8f11ea1dbe1d1f730591bc741732cdca6821547c94e0c86cfe04712cd0df12bf17e0b5e79c7d8f914f7344f66e341500c892301597c2afc695a8

C:\Users\Admin\AppData\Local\Temp\pbsfbugm\pbsfbugm.dll

MD5 de4fcd0bef2328c99acdce195fd78c4f
SHA1 a45c4af4689af99948256fa19fa4b7af349b79c5
SHA256 e95d6c0355e44727f95e0949a461184f53186e1f1941d28cdf65d85571e91ba9
SHA512 a32646f91a9ed6c5383b32d31d8d39d4576f064e9a874b6d53130a359b4ea9f566cf1dda02222696258f0dc2ffceb014782e77f3aadd6f9374d1288656e1102b

memory/1876-17-0x0000000000420000-0x000000000042A000-memory.dmp

memory/1876-19-0x0000000004260000-0x00000000042A2000-memory.dmp

memory/1876-20-0x0000000000450000-0x000000000045C000-memory.dmp

memory/1876-23-0x00000000044C0000-0x00000000044F8000-memory.dmp

memory/2756-26-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2756-25-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2756-24-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2756-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2756-32-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2756-35-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2756-28-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2756-36-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1876-37-0x0000000074590000-0x0000000074C7E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp162F.tmp

MD5 c6f0625bf4c1cdfb699980c9243d3b22
SHA1 43de1fe580576935516327f17b5da0c656c72851
SHA256 8dfc4e937f0b2374e3ced25fce344b0731cf44b8854625b318d50ece2da8f576
SHA512 9ef2dbd4142ad0e1e6006929376ecb8011e7ffc801ee2101e906787d70325ad82752df65839de9972391fa52e1e5974ec1a5c7465a88aa56257633ebb7d70969

C:\Users\Admin\AppData\Local\Temp\tmp16BD.tmp

MD5 8e2d5fba24ae8a54087d8e6cadc188c1
SHA1 548555025543b4773b8f36301f5fa5003e1c85dc
SHA256 f8a3739cca23897792b42a11a21adcce745201fa19f8d84ec66a6e0c5e519759
SHA512 9246583d7b08152cd73dc40254013e1ae4b8c93603dbb1f4e6b82624e14b134c59de6c8039b588f14075602768a388121e985f886322ae5fb9ec2eee94d4ea3d

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-26 15:03

Reported

2024-04-26 15:05

Platform

win10v2004-20240419-en

Max time kernel

138s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Amkbvc.url C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LAN Subsystem = "C:\\Program Files (x86)\\LAN Subsystem\\lanss.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2512 set thread context of 2212 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\LAN Subsystem\lanss.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
File opened for modification C:\Program Files (x86)\LAN Subsystem\lanss.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2512 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2512 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2512 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 3404 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3404 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3404 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2512 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2512 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2512 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2512 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2512 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2512 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2512 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2512 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2512 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2512 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2512 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2512 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2512 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2512 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2212 wrote to memory of 2836 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2212 wrote to memory of 2836 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2212 wrote to memory of 2836 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2212 wrote to memory of 3592 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2212 wrote to memory of 3592 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2212 wrote to memory of 3592 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\010911bc2d16430d96aa7d3d8e884c92_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\djxt50ic\djxt50ic.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES323B.tmp" "c:\Users\Admin\AppData\Local\Temp\djxt50ic\CSCB3D17A2F32E4B3A9AB63327AA8047.TMP"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "LAN Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp36A0.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "LAN Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp36EF.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 8.8.8.8:53 moranhq.duckdns.org udp
US 8.8.8.8:53 moranhq.duckdns.org udp

Files

memory/2512-0-0x0000000000110000-0x0000000000166000-memory.dmp

memory/2512-1-0x0000000074F60000-0x0000000075710000-memory.dmp

memory/2512-3-0x0000000004B80000-0x0000000004B90000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\djxt50ic\djxt50ic.cmdline

MD5 710245565c7c377b999511a452145b6f
SHA1 ea179d2b462d1b4af1f160897489788eed8a6335
SHA256 b4baeddefc1aafbf6ec3d14481ce21d19bca3550ce0e33e5f8612dc821fe5645
SHA512 bb48b2bf312114b106b26fed8301d7ca25c2f1271d3a23ebb40e954eebd681b418168ac3517d1256e607b6dd3c8de52365a4d208ff96d941d460635f87da29ce

\??\c:\Users\Admin\AppData\Local\Temp\djxt50ic\djxt50ic.0.cs

MD5 d008b533315d3a3dfe0ab52ba6ca9dd6
SHA1 f41143f93a7aebaefe12568d0997a1d6d778a2da
SHA256 c9da722a81316670bf37097da756826bac0b39600ccca9e8e360e9b46346987f
SHA512 9398c70790dd38bebcc42f247271482ab33deb2b1f679ce8f44d6b3c33d83549c3bc5b04d7bff6e23f4e783f0b548d1d139b1bf0324c13d20df892a7a353de91

\??\c:\Users\Admin\AppData\Local\Temp\djxt50ic\CSCB3D17A2F32E4B3A9AB63327AA8047.TMP

MD5 935261e9f404e667b075dcd4d094dccd
SHA1 bfce9185c8c945099714ba78ee4d878316b4eeba
SHA256 27f22487db75de90cebbfd441f5c7489cd80fd8d1c67095e0eec87faea3dec79
SHA512 11c7589d28c39374bfd85acf4a5a7571ecc9e5556d98de522fdefe75e2980c2ef1797dc8044f6bc192d625494c217ad0f5742a45ff70bf203a879ed54d9da831

C:\Users\Admin\AppData\Local\Temp\RES323B.tmp

MD5 f149383d348c586312cad7f6c8c12293
SHA1 32e2549ff7b975021f76b4d6a7d5f6b319ff2624
SHA256 eb9a8f8cbd2f4be2931de46644d12c346a33352350f700c7c1c28c96addf119e
SHA512 d5e528ee6a47b913ccdaf3cec481282e7a0beac7bf662062c555351342a6ffff9466443d5b88365d9e35bd36a305c8a2da95e6ed659c82696cb5898224fa1e46

C:\Users\Admin\AppData\Local\Temp\djxt50ic\djxt50ic.pdb

MD5 43692946c0b36e1de9aa2e2bfde570fe
SHA1 40f2f544ba91055f3bad7b7b5add2292474e0a3f
SHA256 bf49ac99b89a1f2aa116c628669a8d7a90fde969fb732973149d75cb5e978cd0
SHA512 eb536762f6e510096a5d2f76aef8edf5a5e68f04d231f288f33ca50b7c6dc156ebae6b1a717ebedc755aa4b821b176c57d8fc89f25bed21dbd6417e2b5d1104c

C:\Users\Admin\AppData\Local\Temp\djxt50ic\djxt50ic.dll

MD5 4f06264a32fdbf87462f0fff1f3b6b1a
SHA1 8df70d52e894b1dc6f2662e95d868f8cfe204b31
SHA256 77adea3ac347a86bd756ac68a09c76387d3a8fd513e5565e86fad2f30843ce8f
SHA512 3c66f0d2dd2e6c2a655d90aa6800ef72f2c4993c914511d6e1561bf36721b17ce039c89569cec50f0165ffccef3f5a9c6717bc8219af23c3eced7df8f1b8dc66

memory/2512-17-0x0000000002380000-0x000000000238A000-memory.dmp

memory/2512-19-0x0000000004B90000-0x0000000004C22000-memory.dmp

memory/2512-20-0x0000000004D30000-0x0000000004D72000-memory.dmp

memory/2512-21-0x0000000004D70000-0x0000000004D7C000-memory.dmp

memory/2512-24-0x00000000050E0000-0x0000000005118000-memory.dmp

memory/2512-25-0x00000000051C0000-0x000000000525C000-memory.dmp

memory/2212-26-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2512-28-0x0000000074F60000-0x0000000075710000-memory.dmp

memory/2212-29-0x0000000071C10000-0x00000000721C1000-memory.dmp

memory/2212-31-0x0000000002730000-0x0000000002740000-memory.dmp

memory/2212-30-0x0000000071C10000-0x00000000721C1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp36A0.tmp

MD5 c6f0625bf4c1cdfb699980c9243d3b22
SHA1 43de1fe580576935516327f17b5da0c656c72851
SHA256 8dfc4e937f0b2374e3ced25fce344b0731cf44b8854625b318d50ece2da8f576
SHA512 9ef2dbd4142ad0e1e6006929376ecb8011e7ffc801ee2101e906787d70325ad82752df65839de9972391fa52e1e5974ec1a5c7465a88aa56257633ebb7d70969

C:\Users\Admin\AppData\Local\Temp\tmp36EF.tmp

MD5 924694e208642d4d8a4c7e0f0cba0de1
SHA1 87e9496a918036c3e3902f125b95a47e38548828
SHA256 8de0bab59a9fe15f312e81a373382ed992ce5110deb3813f663b92cfc5eae0b6
SHA512 ef3cfc08df53777f13fb51fdc0269f6f686c0df57c4dd72f395dc53d1d8ef2b08e33c3601507a45c3cc31a25b70ebf365d0fa93db64e1e851173216a45c49c2c

memory/2212-39-0x0000000071C10000-0x00000000721C1000-memory.dmp

memory/2212-40-0x0000000071C10000-0x00000000721C1000-memory.dmp

memory/2212-41-0x0000000002730000-0x0000000002740000-memory.dmp