Malware Analysis Report

2024-10-19 07:12

Sample ID 240505-m88xqagb6z
Target 1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118
SHA256 22c1b6ff6835e90dbb3773779e25a637dbc147ac28ec5dd23b76a2e3eb9e5d3c
Tags
nanocore evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

22c1b6ff6835e90dbb3773779e25a637dbc147ac28ec5dd23b76a2e3eb9e5d3c

Threat Level: Known bad

The file 1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger persistence spyware stealer trojan

NanoCore

Checks computer location settings

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Drops file in Program Files directory

Enumerates physical storage devices

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-05 11:09

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-05 11:09

Reported

2024-05-05 11:11

Platform

win7-20240221-en

Max time kernel

145s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NAS Host = "C:\\Program Files (x86)\\NAS Host\\nashost.exe" C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\NAS Host\nashost.exe C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\NAS Host\nashost.exe C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2016 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2016 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2016 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2016 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2016 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe
PID 2016 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe
PID 2016 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe
PID 2016 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe
PID 2016 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe
PID 2016 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe
PID 2016 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe
PID 2016 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe
PID 2016 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Update\Windows" /XML "C:\Users\Admin\AppData\Local\Temp\1764451695.xml"

C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp

Files

memory/2016-0-0x0000000074091000-0x0000000074092000-memory.dmp

memory/2016-1-0x0000000074090000-0x000000007463B000-memory.dmp

memory/2016-2-0x0000000074090000-0x000000007463B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1764451695.xml

MD5 77ffe506c7aaaa94ddd4f27cf164b3e4
SHA1 53f9012560666473d2f499416c6d4ae6e3a51d73
SHA256 2f035b32e562dc774875d211cf395b9695df37c6a94a6a26d26a53bc80fa366e
SHA512 56991ec615d9da5ea399fbf87a0cb17ee61aad4cc56fdf6e43847e0179653645a32ef2c8151fcd76dc701dedd4e4dfff9ae8314da30f0cb13585b540a966adb7

memory/2716-14-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2716-31-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2016-32-0x0000000074090000-0x000000007463B000-memory.dmp

memory/2716-29-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2716-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2716-24-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2716-21-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2716-18-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2716-16-0x0000000000400000-0x0000000000438000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-05 11:09

Reported

2024-05-05 11:11

Platform

win10v2004-20240419-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WPA Service = "C:\\Program Files (x86)\\WPA Service\\wpasvc.exe" C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\WPA Service\wpasvc.exe C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\WPA Service\wpasvc.exe C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4900 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 4900 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 4900 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 4900 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe
PID 4900 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe
PID 4900 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe
PID 4900 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe
PID 4900 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe
PID 4900 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe
PID 4900 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe
PID 4900 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Update\Windows" /XML "C:\Users\Admin\AppData\Local\Temp\1659327424.xml"

C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.168:443 www.bing.com tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 168.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 49.15.97.104.in-addr.arpa udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp
US 8.8.4.4:53 aje.ddns.net udp
US 8.8.8.8:53 aje.ddns.net udp

Files

memory/4900-0-0x00000000745E2000-0x00000000745E3000-memory.dmp

memory/4900-1-0x00000000745E0000-0x0000000074B91000-memory.dmp

memory/4900-2-0x00000000745E0000-0x0000000074B91000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1659327424.xml

MD5 3daa16777c96e35ffd5e54faf9d947ad
SHA1 e2405260313c9d04aa975f70b407c3abd726b265
SHA256 aec32495009762a5576ab2054f0434d9512177d7b9a09b4de68b7ebbe8cfe0f0
SHA512 17aedfd6349427c3925eb90417e1de14144a49b876709a6169fbe534071867bca40180e5f913b02c56537f53af9d768f6f50b6ffdd5cd8f5bf8150ef1c338667

memory/1856-9-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\1764b9bbfae2fb51e5d429b38ab2a608_JaffaCakes118.exe.log

MD5 1754173b0ed4624c61fcf04f894e5bb6
SHA1 2fbf7999a2e14f19c9aeb1ac0e58b8a3859368b1
SHA256 19e1f5731300f62cc4bb6eac90e96b7ff5de1bf8c13a434f1a7e38ee6927d757
SHA512 63ae7b7da19c5b65ce73565042cf7386c8d53ab6645b901a9f684d5039e28addd91938d8d61cec153b675e80c25d92fae62bff53edf19914643c94f3a56db710

memory/1856-8-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1856-7-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1856-15-0x00000000745E0000-0x0000000074B91000-memory.dmp

memory/4900-14-0x00000000745E0000-0x0000000074B91000-memory.dmp

memory/1856-13-0x00000000745E0000-0x0000000074B91000-memory.dmp

memory/1856-18-0x00000000745E0000-0x0000000074B91000-memory.dmp

memory/1856-19-0x00000000745E0000-0x0000000074B91000-memory.dmp

memory/1856-20-0x00000000745E0000-0x0000000074B91000-memory.dmp