Malware Analysis Report

2024-11-30 23:43

Sample ID 240428-npwcyseh7z
Target 051934711120beb60bd299a7e133e3c1_JaffaCakes118
SHA256 7bc0f4e51796df68892ee16a279b6706e88f87809389641075e2a5cd76c1323c
Tags
lokibot sality backdoor collection evasion spyware stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7bc0f4e51796df68892ee16a279b6706e88f87809389641075e2a5cd76c1323c

Threat Level: Known bad

The file 051934711120beb60bd299a7e133e3c1_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

lokibot sality backdoor collection evasion spyware stealer trojan upx

Sality

UAC bypass

Windows security bypass

Lokibot

Modifies firewall policy service

Windows security modification

Reads user/profile data of web browsers

UPX packed file

Accesses Microsoft Outlook profiles

Checks whether UAC is enabled

Enumerates connected drives

Drops autorun.inf file

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

System policy modification

outlook_win_path

Suspicious use of WriteProcessMemory

outlook_office_path

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-28 11:34

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-28 11:34

Reported

2024-04-28 11:37

Platform

win7-20231129-en

Max time kernel

124s

Max time network

145s

Command Line

"taskhost.exe"

Signatures

Lokibot

trojan spyware stealer lokibot

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\f7608c7 C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2548 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 2548 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 2548 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 2548 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 2548 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 2548 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 2548 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 2548 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 2548 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 2548 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 3056 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 3056 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 3056 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3056 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 3056 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 3056 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 3056 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 3056 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 3056 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3056 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 3056 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 3056 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 3056 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3056 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 3056 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 3056 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 3056 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3056 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 3056 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 3056 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 3056 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3056 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 3056 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 3056 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 3056 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3056 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 3056 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 3056 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 3056 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3056 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 3056 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 3056 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 3056 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3056 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 3056 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 3056 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 3056 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3056 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 3056 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 3056 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 3056 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3056 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 3056 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 3056 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 3056 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3056 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 3056 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 3056 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 3056 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3056 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 3056 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 3056 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 3056 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3056 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\DllHost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 mclhk-net.com udp

Files

memory/2548-0-0x0000000074720000-0x0000000074CCB000-memory.dmp

memory/2548-1-0x0000000074720000-0x0000000074CCB000-memory.dmp

memory/2548-2-0x0000000000360000-0x00000000003A0000-memory.dmp

memory/3056-3-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/3056-14-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/3056-13-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/3056-15-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/3056-26-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/3056-20-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/3056-24-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/3056-25-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/3056-22-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/3056-19-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/2548-45-0x00000000003B0000-0x00000000003B2000-memory.dmp

memory/3056-51-0x0000000000340000-0x0000000000342000-memory.dmp

memory/3056-50-0x0000000000340000-0x0000000000342000-memory.dmp

memory/2548-44-0x00000000003B0000-0x00000000003B2000-memory.dmp

memory/3056-43-0x0000000000390000-0x0000000000391000-memory.dmp

memory/2548-37-0x00000000003C0000-0x00000000003C1000-memory.dmp

memory/2548-36-0x00000000003C0000-0x00000000003C1000-memory.dmp

memory/2548-35-0x00000000003B0000-0x00000000003B2000-memory.dmp

memory/1116-28-0x0000000001F90000-0x0000000001F92000-memory.dmp

memory/3056-17-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/3056-23-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/3056-21-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/3056-18-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/3056-12-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/3056-10-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/3056-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/3056-7-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/3056-6-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/3056-4-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/3056-5-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/3056-55-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/3056-56-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/3056-57-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/3056-60-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/3056-64-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/3056-67-0x0000000002600000-0x00000000036BA000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3627615824-4061627003-3019543961-1000\0f5007522459c86e95ffcc62f32308f1_12cce00e-511f-47e5-8588-7df67886da42

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3627615824-4061627003-3019543961-1000\0f5007522459c86e95ffcc62f32308f1_12cce00e-511f-47e5-8588-7df67886da42

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

memory/3056-76-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/3056-78-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/3056-85-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/3056-87-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/2548-89-0x0000000074720000-0x0000000074CCB000-memory.dmp

memory/3056-107-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/3056-108-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/3056-110-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/3056-112-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/2548-123-0x0000000000360000-0x00000000003A0000-memory.dmp

memory/3056-132-0x0000000000400000-0x00000000004B4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\winveeuhs.exe

MD5 b360fa63134a63f9acfe046d2dfe10d9
SHA1 b47a7f2ad61c79e454b55e39b0d7500aca753a17
SHA256 03e0c6c4ca8a24f961477887763397045e67862e059f7494014aefc21891d40e
SHA512 575673255d389fc6667f46931301925bf4bb3030d7a3f6da3d3e7d878f86bb496ad6706e20191a1daa2e177cacda9b677424327bd9d438c1ad109c4222064102

memory/3056-142-0x0000000002600000-0x00000000036BA000-memory.dmp

memory/3056-157-0x0000000000340000-0x0000000000342000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-28 11:34

Reported

2024-04-28 11:37

Platform

win10v2004-20240419-en

Max time kernel

122s

Max time network

116s

Command Line

"fontdrvhost.exe"

Signatures

Lokibot

trojan spyware stealer lokibot

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened for modification F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\e574798 C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2768 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 2768 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 2768 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 2768 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 2768 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 2768 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 2768 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 2768 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 2768 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 2768 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 2768 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 2768 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 3084 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 3084 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 3084 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 3084 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 3084 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 3084 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 3084 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3084 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 3084 wrote to memory of 3728 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 3084 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 3084 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3084 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 3084 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3084 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 3084 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3084 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\backgroundTaskHost.exe
PID 3084 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\backgroundTaskHost.exe
PID 3084 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 3084 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe
PID 3084 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 3084 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 3084 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 3084 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 3084 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 3084 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 3084 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3084 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 3084 wrote to memory of 3728 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 3084 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 3084 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3084 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 3084 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3084 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 3084 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3084 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\backgroundTaskHost.exe
PID 3084 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\backgroundTaskHost.exe
PID 3084 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3084 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3084 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 3084 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 3084 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 3084 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 3084 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 3084 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 3084 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3084 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 3084 wrote to memory of 3728 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 3084 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 3084 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3084 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 3084 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3084 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\051934711120beb60bd299a7e133e3c1_JaffaCakes118.exe"

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 mclhk-net.com udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 mclhk-net.com udp
US 8.8.8.8:53 mclhk-net.com udp
US 8.8.8.8:53 mclhk-net.com udp

Files

memory/2768-0-0x0000000074A50000-0x0000000075001000-memory.dmp

memory/2768-1-0x0000000001020000-0x0000000001030000-memory.dmp

memory/2768-2-0x0000000074A50000-0x0000000075001000-memory.dmp

memory/3084-4-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/3084-6-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/3084-5-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/3084-7-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/3084-8-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-10-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-11-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-13-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-12-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-14-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-23-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-22-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-29-0x0000000004CB0000-0x0000000004CB2000-memory.dmp

memory/2768-28-0x0000000004BE0000-0x0000000004BE2000-memory.dmp

memory/3084-27-0x0000000004E00000-0x0000000004E01000-memory.dmp

memory/2768-25-0x00000000051F0000-0x00000000051F1000-memory.dmp

memory/2768-24-0x0000000004BE0000-0x0000000004BE2000-memory.dmp

memory/3084-21-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-20-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-32-0x0000000004CB0000-0x0000000004CB2000-memory.dmp

memory/2768-31-0x0000000004BE0000-0x0000000004BE2000-memory.dmp

memory/3084-33-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-30-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-34-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-38-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-39-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-41-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-42-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-43-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-45-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-46-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-48-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-49-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-52-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-56-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-57-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-58-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/2768-65-0x0000000074A50000-0x0000000075001000-memory.dmp

memory/3084-67-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-69-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-75-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/2768-77-0x0000000001020000-0x0000000001030000-memory.dmp

memory/3084-78-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-79-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-81-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-82-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-85-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-86-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-89-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-90-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-93-0x0000000000400000-0x00000000004B4000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-17203666-93769886-2545153620-1000\0f5007522459c86e95ffcc62f32308f1_54631303-6cba-4b22-b333-215df416769a

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-17203666-93769886-2545153620-1000\0f5007522459c86e95ffcc62f32308f1_54631303-6cba-4b22-b333-215df416769a

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

memory/3084-128-0x0000000002C50000-0x0000000003D0A000-memory.dmp

memory/3084-132-0x0000000004CB0000-0x0000000004CB2000-memory.dmp

C:\mojkto.exe

MD5 06801cc087c6a89dd60b78f604c3f186
SHA1 1d012193402d29b2a756e9b8073edc2f9de560ed
SHA256 45aaa87bd6b0c043c7dc3bf72b10519449efb78f905a025a3639a33629aecb34
SHA512 8ff4f643149fde60f1ae9a01104a161fc117e8314fb501c04e6b0c92b5eb1d3c3b7ed10bba961615591e902ed9ec3fd772ca0502cf37142933f3865fa9890330