Malware Analysis Report

2024-09-11 10:04

Sample ID 240502-2vgnmsaf79
Target 0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118
SHA256 0ab7b0b931490bf95e8dd6ec8e9f3d014b5c93b2ba3b3a32445f481f2db2bdb6
Tags
limerat rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0ab7b0b931490bf95e8dd6ec8e9f3d014b5c93b2ba3b3a32445f481f2db2bdb6

Threat Level: Known bad

The file 0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

limerat rat

LimeRAT

Checks computer location settings

Executes dropped EXE

Maps connected drives based on registry

Legitimate hosting services abused for malware hosting/C2

AutoIT Executable

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-02 22:54

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-02 22:53

Reported

2024-05-02 22:56

Platform

win7-20240419-en

Max time kernel

148s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe"

Signatures

LimeRAT

rat limerat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\secinit\sdchange.exe N/A
N/A N/A C:\Users\Admin\secinit\sdchange.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2396 set thread context of 2416 N/A C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2464 set thread context of 2184 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2304 set thread context of 2104 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2396 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2396 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2396 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2396 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2396 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2396 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2396 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2396 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2396 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2396 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2396 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2396 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2396 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 284 wrote to memory of 2464 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\secinit\sdchange.exe
PID 284 wrote to memory of 2464 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\secinit\sdchange.exe
PID 284 wrote to memory of 2464 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\secinit\sdchange.exe
PID 284 wrote to memory of 2464 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\secinit\sdchange.exe
PID 2464 wrote to memory of 2184 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2464 wrote to memory of 2184 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2464 wrote to memory of 2184 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2464 wrote to memory of 2184 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2464 wrote to memory of 2184 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2464 wrote to memory of 2184 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2464 wrote to memory of 2184 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2464 wrote to memory of 2184 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2464 wrote to memory of 2184 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2464 wrote to memory of 1664 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\SysWOW64\schtasks.exe
PID 2464 wrote to memory of 1664 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\SysWOW64\schtasks.exe
PID 2464 wrote to memory of 1664 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\SysWOW64\schtasks.exe
PID 2464 wrote to memory of 1664 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\SysWOW64\schtasks.exe
PID 284 wrote to memory of 2304 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\secinit\sdchange.exe
PID 284 wrote to memory of 2304 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\secinit\sdchange.exe
PID 284 wrote to memory of 2304 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\secinit\sdchange.exe
PID 284 wrote to memory of 2304 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\secinit\sdchange.exe
PID 2304 wrote to memory of 2104 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2304 wrote to memory of 2104 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2304 wrote to memory of 2104 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2304 wrote to memory of 2104 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2304 wrote to memory of 2104 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2304 wrote to memory of 2104 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2304 wrote to memory of 2104 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2304 wrote to memory of 2104 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2304 wrote to memory of 2104 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2304 wrote to memory of 944 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\SysWOW64\schtasks.exe
PID 2304 wrote to memory of 944 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\SysWOW64\schtasks.exe
PID 2304 wrote to memory of 944 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\SysWOW64\schtasks.exe
PID 2304 wrote to memory of 944 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn SettingSyncHost /tr "C:\Users\Admin\secinit\sdchange.exe" /sc minute /mo 1 /F

C:\Windows\system32\taskeng.exe

taskeng.exe {8A189D21-DAA5-434E-A38D-3A4063945737} S-1-5-21-481678230-3773327859-3495911762-1000:UIBNQNMA\Admin:Interactive:[1]

C:\Users\Admin\secinit\sdchange.exe

C:\Users\Admin\secinit\sdchange.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn SettingSyncHost /tr "C:\Users\Admin\secinit\sdchange.exe" /sc minute /mo 1 /F

C:\Users\Admin\secinit\sdchange.exe

C:\Users\Admin\secinit\sdchange.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn SettingSyncHost /tr "C:\Users\Admin\secinit\sdchange.exe" /sc minute /mo 1 /F

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastebin.com udp
US 104.20.3.235:443 pastebin.com tcp

Files

memory/2416-0-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2416-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2416-7-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2396-8-0x00000000001D0000-0x00000000001D1000-memory.dmp

memory/2416-6-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2416-1-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2416-9-0x0000000073E32000-0x0000000073E34000-memory.dmp

memory/2416-12-0x0000000073E32000-0x0000000073E34000-memory.dmp

C:\Users\Admin\secinit\sdchange.exe

MD5 b30497019584af44a28c40290e9a359f
SHA1 c8d45ce31decb93c67cc20be314a2b7265ae74b0
SHA256 f74c9767ca5c15710b68dbeb05c7de4c538272e82df623c2d2b50d68479c525f
SHA512 d25b6b80ef7e43327fd8db5518a4f71d6972ad72de2533a753151c9d418e9f7758308607021fe9d4002f43c0d155d8b2c436c84e1107016958cf2cb4b5e4c9e8

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-02 22:53

Reported

2024-05-02 22:56

Platform

win10v2004-20240419-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe"

Signatures

LimeRAT

rat limerat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation C:\Users\Admin\secinit\sdchange.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation C:\Users\Admin\secinit\sdchange.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\secinit\sdchange.exe N/A
N/A N/A C:\Users\Admin\secinit\sdchange.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4380 set thread context of 3404 N/A C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4504 set thread context of 4368 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 676 set thread context of 4496 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4380 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4380 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4380 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4380 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4380 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4380 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 4380 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 4380 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 4504 wrote to memory of 4368 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4504 wrote to memory of 4368 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4504 wrote to memory of 4368 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4504 wrote to memory of 4368 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4504 wrote to memory of 4368 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4504 wrote to memory of 3264 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\SysWOW64\schtasks.exe
PID 4504 wrote to memory of 3264 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\SysWOW64\schtasks.exe
PID 4504 wrote to memory of 3264 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\SysWOW64\schtasks.exe
PID 676 wrote to memory of 4496 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 676 wrote to memory of 4496 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 676 wrote to memory of 4496 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 676 wrote to memory of 4496 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 676 wrote to memory of 4496 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 676 wrote to memory of 4764 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\SysWOW64\schtasks.exe
PID 676 wrote to memory of 4764 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\SysWOW64\schtasks.exe
PID 676 wrote to memory of 4764 N/A C:\Users\Admin\secinit\sdchange.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0f12d87b67f6175122a15eadddfa53bb_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn SettingSyncHost /tr "C:\Users\Admin\secinit\sdchange.exe" /sc minute /mo 1 /F

C:\Users\Admin\secinit\sdchange.exe

C:\Users\Admin\secinit\sdchange.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn SettingSyncHost /tr "C:\Users\Admin\secinit\sdchange.exe" /sc minute /mo 1 /F

C:\Users\Admin\secinit\sdchange.exe

C:\Users\Admin\secinit\sdchange.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn SettingSyncHost /tr "C:\Users\Admin\secinit\sdchange.exe" /sc minute /mo 1 /F

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 235.4.20.104.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 214.64.18.2.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/3404-0-0x0000000000410000-0x000000000041C000-memory.dmp

memory/4380-4-0x0000000001180000-0x0000000001181000-memory.dmp

memory/3404-5-0x00000000744F2000-0x00000000744F3000-memory.dmp

memory/3404-6-0x00000000744F0000-0x0000000074AA1000-memory.dmp

memory/3404-7-0x00000000744F0000-0x0000000074AA1000-memory.dmp

memory/3404-10-0x00000000744F2000-0x00000000744F3000-memory.dmp

memory/3404-11-0x00000000744F0000-0x0000000074AA1000-memory.dmp

C:\Users\Admin\secinit\sdchange.exe

MD5 6943e12bb5bab651347dacf97dc43efb
SHA1 47bb740149c7ba89d45843d98a1b2ec6159bb38d
SHA256 9aa217a1855e8014c67aedbb473cfef1cf769122f1f2a0ef8d54bee937856d5a
SHA512 11a25f990abc9b5e279225fe14b52af45ae4d047dc5bbc1f63d1fd099c024d3d97453547d2cfed50bee76efa8b8c9c1b61a31c6019bb3ba6328ddb7caacdb052

memory/4368-14-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\RegAsm.exe.log

MD5 9f893d94b017a0684012d50319c9ffbe
SHA1 140cc2cb6b2520ba4f9a1f666a5f679853472793
SHA256 8a7cb420c82edf1bb2c7bdfef52091e5169fabaecc370e120985e91406fcbbec
SHA512 4b7df94d3622b82d852b0f532d7fd810ca2113d7b737ec417023d5b2142e9e79414a06d22647d73f8bc114f8e871a3a741a479b0aba48892f9078975ec78acba