Malware Analysis Report

2024-10-19 07:12

Sample ID 240506-fnk7lach43
Target 1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118
SHA256 676fe2646ff710578e7597e7876a7bac3f9189b044bd74c09d01a5cc8643d4e3
Tags
nanocore evasion keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

676fe2646ff710578e7597e7876a7bac3f9189b044bd74c09d01a5cc8643d4e3

Threat Level: Known bad

The file 1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger spyware stealer trojan

NanoCore

Executes dropped EXE

Checks computer location settings

Checks whether UAC is enabled

AutoIT Executable

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-06 05:01

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-06 05:01

Reported

2024-05-06 05:03

Platform

win7-20240221-en

Max time kernel

147s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\windows\Regsm001.exe N/A
N/A N/A C:\Users\Admin\windows\Regsm001.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2812 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2812 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2812 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2812 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2812 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2812 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2812 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2812 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2812 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2812 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2812 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2812 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2812 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 3064 wrote to memory of 2640 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 3064 wrote to memory of 2640 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 3064 wrote to memory of 2640 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 3064 wrote to memory of 2640 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2780 wrote to memory of 680 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\windows\Regsm001.exe
PID 2780 wrote to memory of 680 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\windows\Regsm001.exe
PID 2780 wrote to memory of 680 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\windows\Regsm001.exe
PID 2780 wrote to memory of 680 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\windows\Regsm001.exe
PID 680 wrote to memory of 1660 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\SysWOW64\schtasks.exe
PID 680 wrote to memory of 1660 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\SysWOW64\schtasks.exe
PID 680 wrote to memory of 1660 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\SysWOW64\schtasks.exe
PID 680 wrote to memory of 1660 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\SysWOW64\schtasks.exe
PID 680 wrote to memory of 1920 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 680 wrote to memory of 1920 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 680 wrote to memory of 1920 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 680 wrote to memory of 1920 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 680 wrote to memory of 1920 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 680 wrote to memory of 1920 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 680 wrote to memory of 1920 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 680 wrote to memory of 1920 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 680 wrote to memory of 1920 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2780 wrote to memory of 940 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\windows\Regsm001.exe
PID 2780 wrote to memory of 940 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\windows\Regsm001.exe
PID 2780 wrote to memory of 940 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\windows\Regsm001.exe
PID 2780 wrote to memory of 940 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\windows\Regsm001.exe
PID 940 wrote to memory of 1772 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\SysWOW64\schtasks.exe
PID 940 wrote to memory of 1772 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\SysWOW64\schtasks.exe
PID 940 wrote to memory of 1772 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\SysWOW64\schtasks.exe
PID 940 wrote to memory of 1772 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\SysWOW64\schtasks.exe
PID 940 wrote to memory of 2676 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 940 wrote to memory of 2676 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 940 wrote to memory of 2676 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 940 wrote to memory of 2676 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 940 wrote to memory of 2676 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 940 wrote to memory of 2676 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 940 wrote to memory of 2676 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 940 wrote to memory of 2676 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 940 wrote to memory of 2676 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn Regsm001 /tr "C:\Users\Admin\windows\Regsm001.exe" /sc minute /mo 1 /F

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE060.tmp"

C:\Windows\system32\taskeng.exe

taskeng.exe {3A847D2B-00B1-4C64-B155-35031B1BD3B7} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]

C:\Users\Admin\windows\Regsm001.exe

C:\Users\Admin\windows\Regsm001.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn Regsm001 /tr "C:\Users\Admin\windows\Regsm001.exe" /sc minute /mo 1 /F

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Users\Admin\windows\Regsm001.exe

C:\Users\Admin\windows\Regsm001.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn Regsm001 /tr "C:\Users\Admin\windows\Regsm001.exe" /sc minute /mo 1 /F

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp
N/A 127.0.0.1:4782 tcp
N/A 127.0.0.1:4782 tcp
N/A 127.0.0.1:4782 tcp
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp
N/A 127.0.0.1:4782 tcp
N/A 127.0.0.1:4782 tcp
N/A 127.0.0.1:4782 tcp
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp
N/A 127.0.0.1:4782 tcp
N/A 127.0.0.1:4782 tcp
N/A 127.0.0.1:4782 tcp
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp
N/A 127.0.0.1:4782 tcp
N/A 127.0.0.1:4782 tcp
N/A 127.0.0.1:4782 tcp
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp

Files

memory/2812-1-0x0000000000220000-0x0000000000221000-memory.dmp

memory/3064-3-0x0000000000400000-0x0000000000438000-memory.dmp

memory/3064-10-0x0000000000400000-0x0000000000438000-memory.dmp

memory/3064-9-0x0000000000400000-0x0000000000438000-memory.dmp

memory/3064-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/3064-2-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpE060.tmp

MD5 c6f0625bf4c1cdfb699980c9243d3b22
SHA1 43de1fe580576935516327f17b5da0c656c72851
SHA256 8dfc4e937f0b2374e3ced25fce344b0731cf44b8854625b318d50ece2da8f576
SHA512 9ef2dbd4142ad0e1e6006929376ecb8011e7ffc801ee2101e906787d70325ad82752df65839de9972391fa52e1e5974ec1a5c7465a88aa56257633ebb7d70969

C:\Users\Admin\windows\Regsm001.exe

MD5 1ae326db57b33cc93e2b1b99b9e552ab
SHA1 658f48da751b7e1f6e23b7b70ceee2b6a2f3c1aa
SHA256 676fe2646ff710578e7597e7876a7bac3f9189b044bd74c09d01a5cc8643d4e3
SHA512 a4c4db0a1d31e307f138415f6c946e21909ea23c11ee1db60d128ee1d49df8340f9d9c0b40650a3a8bf92c7423e7c694ebe4da5526d4d86d1c72bc9eb36c511f

memory/1920-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2676-31-0x0000000000090000-0x00000000000C8000-memory.dmp

memory/2676-37-0x0000000000090000-0x00000000000C8000-memory.dmp

memory/2676-36-0x0000000000090000-0x00000000000C8000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-06 05:01

Reported

2024-05-06 05:03

Platform

win10v2004-20240419-en

Max time kernel

145s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation C:\Users\Admin\windows\Regsm001.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation C:\Users\Admin\windows\Regsm001.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\windows\Regsm001.exe N/A
N/A N/A C:\Users\Admin\windows\Regsm001.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4092 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 4092 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 4092 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 4092 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4092 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4092 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4092 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 4092 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2612 wrote to memory of 4176 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2612 wrote to memory of 4176 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 2612 wrote to memory of 4176 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\SysWOW64\schtasks.exe
PID 1260 wrote to memory of 2576 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\SysWOW64\schtasks.exe
PID 1260 wrote to memory of 2576 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\SysWOW64\schtasks.exe
PID 1260 wrote to memory of 2576 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\SysWOW64\schtasks.exe
PID 1260 wrote to memory of 2788 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 2788 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 2788 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 2788 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 1260 wrote to memory of 2788 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2424 wrote to memory of 3776 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\SysWOW64\schtasks.exe
PID 2424 wrote to memory of 3776 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\SysWOW64\schtasks.exe
PID 2424 wrote to memory of 3776 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\SysWOW64\schtasks.exe
PID 2424 wrote to memory of 3880 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2424 wrote to memory of 3880 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2424 wrote to memory of 3880 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2424 wrote to memory of 3880 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
PID 2424 wrote to memory of 3880 N/A C:\Users\Admin\windows\Regsm001.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1ae326db57b33cc93e2b1b99b9e552ab_JaffaCakes118.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn Regsm001 /tr "C:\Users\Admin\windows\Regsm001.exe" /sc minute /mo 1 /F

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DHCP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp9A4C.tmp"

C:\Users\Admin\windows\Regsm001.exe

C:\Users\Admin\windows\Regsm001.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn Regsm001 /tr "C:\Users\Admin\windows\Regsm001.exe" /sc minute /mo 1 /F

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

C:\Users\Admin\windows\Regsm001.exe

C:\Users\Admin\windows\Regsm001.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn Regsm001 /tr "C:\Users\Admin\windows\Regsm001.exe" /sc minute /mo 1 /F

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp
US 8.8.8.8:53 25.69.169.192.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 139.53.16.96.in-addr.arpa udp
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp
N/A 127.0.0.1:4782 tcp
N/A 127.0.0.1:4782 tcp
N/A 127.0.0.1:4782 tcp
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 51.15.97.104.in-addr.arpa udp
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp
N/A 127.0.0.1:4782 tcp
N/A 127.0.0.1:4782 tcp
N/A 127.0.0.1:4782 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp
N/A 127.0.0.1:4782 tcp
N/A 127.0.0.1:4782 tcp
N/A 127.0.0.1:4782 tcp
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp
US 8.8.8.8:53 mybackups.duckdns.org udp
US 192.169.69.25:4782 mybackups.duckdns.org tcp
N/A 127.0.0.1:4782 tcp
N/A 127.0.0.1:4782 tcp

Files

memory/4092-1-0x00000000011A0000-0x00000000011A1000-memory.dmp

memory/2612-2-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2612-7-0x00000000754F2000-0x00000000754F3000-memory.dmp

memory/2612-8-0x00000000754F0000-0x0000000075AA1000-memory.dmp

memory/2612-9-0x00000000754F0000-0x0000000075AA1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp9A4C.tmp

MD5 c6f0625bf4c1cdfb699980c9243d3b22
SHA1 43de1fe580576935516327f17b5da0c656c72851
SHA256 8dfc4e937f0b2374e3ced25fce344b0731cf44b8854625b318d50ece2da8f576
SHA512 9ef2dbd4142ad0e1e6006929376ecb8011e7ffc801ee2101e906787d70325ad82752df65839de9972391fa52e1e5974ec1a5c7465a88aa56257633ebb7d70969

memory/2612-14-0x00000000754F2000-0x00000000754F3000-memory.dmp

memory/2612-15-0x00000000754F0000-0x0000000075AA1000-memory.dmp

C:\Users\Admin\windows\Regsm001.exe

MD5 1ae326db57b33cc93e2b1b99b9e552ab
SHA1 658f48da751b7e1f6e23b7b70ceee2b6a2f3c1aa
SHA256 676fe2646ff710578e7597e7876a7bac3f9189b044bd74c09d01a5cc8643d4e3
SHA512 a4c4db0a1d31e307f138415f6c946e21909ea23c11ee1db60d128ee1d49df8340f9d9c0b40650a3a8bf92c7423e7c694ebe4da5526d4d86d1c72bc9eb36c511f

memory/2788-18-0x00000000003C0000-0x00000000003F8000-memory.dmp

memory/3880-25-0x00000000001C0000-0x00000000001F8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\RegAsm.exe.log

MD5 5b4789d01bb4d7483b71e1a35bce6a8b
SHA1 de083f2131c9a763c0d1810c97a38732146cffbf
SHA256 e248cef9500ed6e0c9f99d72a2a6a36955a5f0cfc0725748ef25a733cc8282f6
SHA512 357e18ef30430e4b9cc4f2569b9735b1cd12f934c83162e4de78ac29ba9703b63ddb624ccc22afd5a5868f6e9d91a3c64581846abac22e9625f5b2e3d80b3ede