Malware Analysis Report

2024-10-23 19:45

Sample ID 240428-nfmz8aee49
Target 05128e915edd0fdd68acba9d59920f84_JaffaCakes118
SHA256 02dc826d77d9078193f7646257e4e05fd5b7be70e77078d1171bbcd792247011
Tags
lokibot nanocore collection evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

02dc826d77d9078193f7646257e4e05fd5b7be70e77078d1171bbcd792247011

Threat Level: Known bad

The file 05128e915edd0fdd68acba9d59920f84_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

lokibot nanocore collection evasion keylogger persistence spyware stealer trojan

Lokibot

NanoCore

Executes dropped EXE

Reads user/profile data of web browsers

Checks computer location settings

Loads dropped DLL

Checks whether UAC is enabled

Accesses Microsoft Outlook profiles

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: RenamesItself

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_win_path

Suspicious behavior: EnumeratesProcesses

Suspicious use of UnmapMainImage

Suspicious behavior: GetForegroundWindowSpam

outlook_office_path

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-28 11:20

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-28 11:20

Reported

2024-04-28 11:23

Platform

win10v2004-20240419-en

Max time kernel

146s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe"

Signatures

Lokibot

trojan spyware stealer lokibot

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WPA Monitor = "C:\\Program Files (x86)\\WPA Monitor\\wpamon.exe" C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\WPA Monitor\wpamon.exe C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe N/A
File created C:\Program Files (x86)\WPA Monitor\wpamon.exe C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe N/A
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe N/A
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe N/A
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4508 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe
PID 4508 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe
PID 4508 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe
PID 2192 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe
PID 2192 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe
PID 2192 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe
PID 1672 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe
PID 1672 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe
PID 1672 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe
PID 3464 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Windows\SysWOW64\schtasks.exe
PID 3464 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Windows\SysWOW64\schtasks.exe
PID 3464 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Windows\SysWOW64\schtasks.exe
PID 3464 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Windows\SysWOW64\schtasks.exe
PID 3464 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Windows\SysWOW64\schtasks.exe
PID 3464 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Windows\SysWOW64\schtasks.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe

"C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe"

C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe

"C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "WPA Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5D72.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "WPA Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5DC1.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 lethatch.se udp
US 8.8.8.8:53 ldouab.ddns.net udp
US 8.8.8.8:53 lethatch.se udp
US 8.8.8.8:53 ldouab.ddns.net udp
US 8.8.8.8:53 lethatch.se udp
US 8.8.8.8:53 maquicantro.duckdns.org udp
US 8.8.8.8:53 maquicantro.duckdns.org udp
US 8.8.8.8:53 ldouab.ddns.net udp
US 8.8.8.8:53 ldouab.ddns.net udp
US 8.8.8.8:53 lethatch.se udp
US 8.8.8.8:53 maquicantro.duckdns.org udp
US 8.8.8.8:53 maquicantro.duckdns.org udp
US 8.8.8.8:53 ldouab.ddns.net udp
US 8.8.8.8:53 ldouab.ddns.net udp
US 8.8.8.8:53 maquicantro.duckdns.org udp

Files

memory/4508-3-0x0000000077701000-0x0000000077821000-memory.dmp

C:\Windows\win.ini

MD5 6bf517432f65eb7f0d18d574bf14124c
SHA1 5b9f37c1dd1318ebbec3bd2f07c109eb9d22c727
SHA256 6e2b70dfccabf3cc651545676a3a566c9cfae03f15f772886646abce1da35b46
SHA512 7b0cb8c20034585ec8bf4b45eda5eda5993a56e24931a7426dc5a9f081ec1f82545f3e26a48a4df885c8691fc6e8026d0808aebe3cc3358ba85ddca08ac4cb06

memory/4508-8-0x0000000077701000-0x0000000077821000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe

MD5 3a87c3d36a7d64d7eca737d25a0df1a8
SHA1 66e922badc7b32e1fddb0394a92f00a5688e0180
SHA256 fe15c5a36d9e6c32e8be719bedf8ba0546eae95421ae64ebfe7ff65a6f270eb6
SHA512 4db6167cc9fb8098d9cc3e5315e5d429652152651e568521d96339189b015276ca875680069b89f46dc5a69bbf1e8e6938e18dd4b94039cd8c5d82d96de274ba

memory/2192-18-0x0000000000400000-0x00000000005C1000-memory.dmp

memory/2192-21-0x0000000000780000-0x0000000000786000-memory.dmp

memory/3464-37-0x0000000000770000-0x0000000000776000-memory.dmp

memory/3464-36-0x0000000000400000-0x00000000004BC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp5D72.tmp

MD5 0d59098d3a4ab5cfbd55d88ca680feed
SHA1 f185a6d4c305184ff56926738d2dc6f984ab57ae
SHA256 faf74335f8c960fdd6e779b60cf718dfbe200a85b97e98a6e2e139c490f6956c
SHA512 12bcb9ae4450486462b345262f324f81bdcdc9e2b9b33ff54654b0552c7358fc584270e52d7e9f38bd1eea728a5df9f5a9f80191af54ec0035a20a35a85be80b

C:\Users\Admin\AppData\Local\Temp\tmp5DC1.tmp

MD5 a246b3561d823177f3586e629f144233
SHA1 0f05d12e55a1d2e5e6a4f307c193882fba093315
SHA256 6abae7707b06e52b58f537b335e367cc54b093e899d78f16e94ceaf7ceafca52
SHA512 4246aa9a96331e2c7e36b37fa778e31ecae055c77164e0dc673aa50cdec368f08d356ab06ef1a4540816c474828048ab1bebed7e211a4eb929f2918e1fac9c6d

memory/2192-45-0x0000000000400000-0x00000000005C1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2818691465-3043947619-2475182763-1000\0f5007522459c86e95ffcc62f32308f1_f546c72a-ef7d-4387-9afa-727536aab388

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2818691465-3043947619-2475182763-1000\0f5007522459c86e95ffcc62f32308f1_f546c72a-ef7d-4387-9afa-727536aab388

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

memory/2192-87-0x0000000000400000-0x00000000005C1000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-28 11:20

Reported

2024-04-28 11:23

Platform

win7-20231129-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe"

Signatures

Lokibot

trojan spyware stealer lokibot

NanoCore

keylogger trojan stealer spyware nanocore

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Service = "C:\\Program Files (x86)\\TCP Service\\tcpsv.exe" C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\TCP Service\tcpsv.exe C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe N/A
File opened for modification C:\Program Files (x86)\TCP Service\tcpsv.exe C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe N/A
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe N/A
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe N/A
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1072 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe
PID 1072 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe
PID 1072 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe
PID 1072 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe
PID 1072 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe
PID 1072 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe
PID 1072 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe
PID 2092 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe
PID 2092 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe
PID 2092 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe
PID 2092 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe
PID 2092 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe
PID 2092 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe
PID 2092 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe
PID 1888 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe
PID 1888 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe
PID 1888 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe
PID 1888 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe
PID 1888 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe
PID 1888 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe
PID 1888 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe
PID 2700 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Windows\SysWOW64\schtasks.exe
PID 2700 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Windows\SysWOW64\schtasks.exe
PID 2700 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Windows\SysWOW64\schtasks.exe
PID 2700 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Windows\SysWOW64\schtasks.exe
PID 2700 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Windows\SysWOW64\schtasks.exe
PID 2700 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Windows\SysWOW64\schtasks.exe
PID 2700 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Windows\SysWOW64\schtasks.exe
PID 2700 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Windows\SysWOW64\schtasks.exe
PID 2700 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Windows\SysWOW64\schtasks.exe
PID 2700 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Windows\SysWOW64\schtasks.exe
PID 2700 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Windows\SysWOW64\schtasks.exe
PID 2700 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Windows\SysWOW64\schtasks.exe
PID 2700 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Windows\SysWOW64\schtasks.exe
PID 2700 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe C:\Windows\SysWOW64\schtasks.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\05128e915edd0fdd68acba9d59920f84_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe

"C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe"

C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe

"C:\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "TCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2607.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "TCP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp26B4.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 lethatch.se udp
US 8.8.8.8:53 ldouab.ddns.net udp
US 8.8.8.8:53 maquicantro.duckdns.org udp
NG 197.242.125.206:3340 maquicantro.duckdns.org tcp
NG 197.242.125.206:3340 maquicantro.duckdns.org tcp
NG 197.242.125.206:3340 maquicantro.duckdns.org tcp
US 8.8.8.8:53 maquicantro.duckdns.org udp
NG 197.242.125.206:3340 maquicantro.duckdns.org tcp
NG 197.242.125.206:3340 maquicantro.duckdns.org tcp
NG 197.242.125.206:3340 maquicantro.duckdns.org tcp

Files

memory/1072-3-0x00000000770C0000-0x0000000077269000-memory.dmp

memory/1072-6-0x00000000772B0000-0x0000000077386000-memory.dmp

C:\Windows\win.ini

MD5 d2a2412bddba16d60ec63bd9550d933f
SHA1 deb3d3bdc9055f0b4909b31d3048446848fae0e1
SHA256 79ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a
SHA512 8fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31

memory/2092-10-0x00000000770C0000-0x0000000077269000-memory.dmp

\Users\Admin\AppData\Local\Temp\fresh_output4DA6B70.exe

MD5 3a87c3d36a7d64d7eca737d25a0df1a8
SHA1 66e922badc7b32e1fddb0394a92f00a5688e0180
SHA256 fe15c5a36d9e6c32e8be719bedf8ba0546eae95421ae64ebfe7ff65a6f270eb6
SHA512 4db6167cc9fb8098d9cc3e5315e5d429652152651e568521d96339189b015276ca875680069b89f46dc5a69bbf1e8e6938e18dd4b94039cd8c5d82d96de274ba

memory/2092-18-0x0000000000400000-0x00000000005C1000-memory.dmp

memory/2092-22-0x00000000002C0000-0x00000000002C6000-memory.dmp

memory/2700-40-0x0000000000320000-0x0000000000326000-memory.dmp

memory/2700-39-0x0000000000400000-0x00000000004BC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp2607.tmp

MD5 0d59098d3a4ab5cfbd55d88ca680feed
SHA1 f185a6d4c305184ff56926738d2dc6f984ab57ae
SHA256 faf74335f8c960fdd6e779b60cf718dfbe200a85b97e98a6e2e139c490f6956c
SHA512 12bcb9ae4450486462b345262f324f81bdcdc9e2b9b33ff54654b0552c7358fc584270e52d7e9f38bd1eea728a5df9f5a9f80191af54ec0035a20a35a85be80b

C:\Users\Admin\AppData\Local\Temp\tmp26B4.tmp

MD5 93fc3117767507c9889abd12dc667d22
SHA1 1096e4cfa0c35756e3c3fb866c1e4c1e59115df9
SHA256 684997dd4ce15031cec8f2f93933b1d41d7bf5cbbff655dd64377b07055c449a
SHA512 e403348ee77bd3e7c45245dd5dae81c3ea130d5cf342f630982772ce5f75548b292013480e2831d68cf51349b64afde4589d4eec94b567d20f0a01e3b9549bdc

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3627615824-4061627003-3019543961-1000\0f5007522459c86e95ffcc62f32308f1_12cce00e-511f-47e5-8588-7df67886da42

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3627615824-4061627003-3019543961-1000\0f5007522459c86e95ffcc62f32308f1_12cce00e-511f-47e5-8588-7df67886da42

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

memory/2092-68-0x0000000000400000-0x00000000005C1000-memory.dmp

memory/2092-84-0x0000000000400000-0x00000000005C1000-memory.dmp

memory/2092-112-0x0000000000400000-0x00000000005C1000-memory.dmp