Malware Analysis Report

2024-10-19 07:12

Sample ID 240506-zw4tfsbb7w
Target 1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118
SHA256 120893883361e2381a0c10fc432fb304e4943df88e23bcbaead4738944a6bf55
Tags
nanocore evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

120893883361e2381a0c10fc432fb304e4943df88e23bcbaead4738944a6bf55

Threat Level: Known bad

The file 1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger persistence spyware stealer trojan

NanoCore

Checks computer location settings

Loads dropped DLL

Drops startup file

Executes dropped EXE

Drops desktop.ini file(s)

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

NTFS ADS

Suspicious behavior: GetForegroundWindowSpam

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-06 21:04

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-06 21:04

Reported

2024-05-06 21:07

Platform

win7-20240221-en

Max time kernel

141s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.exe.lnk C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\tmp.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Host = "C:\\Program Files (x86)\\DHCP Host\\dhcphost.exe" C:\Users\Admin\AppData\Roaming\tmp.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\tmp.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\DHCP Host\dhcphost.exe C:\Users\Admin\AppData\Roaming\tmp.exe N/A
File opened for modification C:\Program Files (x86)\DHCP Host\dhcphost.exe C:\Users\Admin\AppData\Roaming\tmp.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Windowsx64\Explorer.exe:Zone.Identifier C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\tmp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tmp.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2884 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2852 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2852 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2852 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2852 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2884 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\tmp.exe
PID 2884 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\tmp.exe
PID 2884 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\tmp.exe
PID 2884 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\tmp.exe
PID 2884 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe
PID 2884 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe
PID 2884 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe
PID 2884 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe
PID 2884 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe
PID 2884 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe
PID 2884 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe
PID 2884 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe
PID 2884 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe
PID 2568 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Roaming\tmp.exe C:\Windows\SysWOW64\schtasks.exe
PID 2568 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Roaming\tmp.exe C:\Windows\SysWOW64\schtasks.exe
PID 2568 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Roaming\tmp.exe C:\Windows\SysWOW64\schtasks.exe
PID 2568 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Roaming\tmp.exe C:\Windows\SysWOW64\schtasks.exe
PID 2568 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Roaming\tmp.exe C:\Windows\SysWOW64\schtasks.exe
PID 2568 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Roaming\tmp.exe C:\Windows\SysWOW64\schtasks.exe
PID 2568 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Roaming\tmp.exe C:\Windows\SysWOW64\schtasks.exe
PID 2568 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Roaming\tmp.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe"

C:\Windows\SysWOW64\reg.exe

reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windowsx64\Explorer.exe.lnk" /f

C:\Users\Admin\AppData\Roaming\tmp.exe

"C:\Users\Admin\AppData\Roaming\tmp.exe"

C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DHCP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp119D.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DHCP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp124A.tmp"

Network

Country Destination Domain Proto
US 192.227.90.76:54984 tcp
US 192.227.90.76:54984 tcp
US 192.227.90.76:54984 tcp
US 8.8.8.8:53 senatorojugo.ddns.net udp
US 8.8.4.4:53 senatorojugo.ddns.net udp
US 8.8.8.8:53 senatorojugo.ddns.net udp
US 8.8.8.8:53 senatorojugo.ddns.net udp
US 8.8.4.4:53 senatorojugo.ddns.net udp
US 8.8.8.8:53 senatorojugo.ddns.net udp
US 8.8.4.4:53 senatorojugo.ddns.net udp
US 192.227.90.76:54984 tcp
US 192.227.90.76:54984 tcp
US 192.227.90.76:54984 tcp
US 8.8.8.8:53 senatorojugo.ddns.net udp
US 8.8.4.4:53 senatorojugo.ddns.net udp
US 8.8.8.8:53 senatorojugo.ddns.net udp
US 8.8.4.4:53 senatorojugo.ddns.net udp
US 8.8.8.8:53 senatorojugo.ddns.net udp
US 8.8.4.4:53 senatorojugo.ddns.net udp
US 192.227.90.76:54984 tcp
US 192.227.90.76:54984 tcp

Files

memory/2884-0-0x00000000744E1000-0x00000000744E2000-memory.dmp

memory/2884-1-0x00000000744E0000-0x0000000074A8B000-memory.dmp

memory/2884-2-0x00000000744E0000-0x0000000074A8B000-memory.dmp

C:\Users\Admin\AppData\Roaming\Windowsx64\Explorer.exe

MD5 1e5bf711537ee7a229050e4a4ff7ade1
SHA1 772a5a81572b4bfb038b1102cc02dbd2f9e27a2f
SHA256 120893883361e2381a0c10fc432fb304e4943df88e23bcbaead4738944a6bf55
SHA512 15d4fbddb93a06aceda44fd3ad6cf7563b03d72cd3bb71b31e5db366a4efa44533647beca6f267307a624c8058067a9b48067445d2cd7a34f5d3bedb252c1cc7

C:\Users\Admin\AppData\Roaming\tmp.exe

MD5 f957426141d1d300f6b2b20221a6aa4e
SHA1 c815d6213a7e648c38501c85cf90dbea6dde34d2
SHA256 c84be4223a716573794704753a0abf2d85a087ea395b21dc2fa9bee77fcb5bac
SHA512 a93cd14785ee081a074944f27c36e35e297b68b2af48f52d47148a0fca7b8eb4b726a89b4668b9f792ca109cbfbf9df3dd2467afc6802e6226f48a64c142f911

memory/2568-28-0x00000000744E0000-0x0000000074A8B000-memory.dmp

memory/2792-32-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2792-30-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2568-33-0x00000000744E0000-0x0000000074A8B000-memory.dmp

memory/2792-27-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2568-35-0x00000000744E0000-0x0000000074A8B000-memory.dmp

memory/2792-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2792-25-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2792-24-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2792-23-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2792-22-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp119D.tmp

MD5 8a9b76989a8413172cff53ca3e745a3e
SHA1 0ddb9676d5ccbf8e4daf1cb5416207610724aaf0
SHA256 d5efff1ebc2bef62244c2d3b4301e68db613c18c1cbefdb31008672a55bb7515
SHA512 2d1d276ef7d6f54b722b91b856b3974372bad7fb9058ce30afffb3820ddef466f9a2e63efc743a4391f053c2da7b216741fc534af9552d509dda99fc4d355eeb

C:\Users\Admin\AppData\Local\Temp\tmp124A.tmp

MD5 0479d5f304ef2d7e3c15fb24a99f88c1
SHA1 8edbb1450a656fac5f5e96779ffe440ee8c1aec9
SHA256 112557c2b2d0c669a3b115129dc32f005341e965330fa8f2ad3e5de1926594bc
SHA512 537e8d87e5cd975f0e69bb145f81d6e9d7b0d82eed143ac351304ea38577137386a51fdb7357ec6d641eb04ff5f51e249bba2db8a4b5bf2934d561394a4a3f15

memory/2884-42-0x00000000744E0000-0x0000000074A8B000-memory.dmp

memory/2568-43-0x00000000744E0000-0x0000000074A8B000-memory.dmp

memory/2568-44-0x00000000744E0000-0x0000000074A8B000-memory.dmp

memory/2568-45-0x00000000744E0000-0x0000000074A8B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-06 21:04

Reported

2024-05-06 21:07

Platform

win10v2004-20240419-en

Max time kernel

142s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.exe.lnk C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\tmp.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Service = "C:\\Program Files (x86)\\DDP Service\\ddpsv.exe" C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\DDP Service\ddpsv.exe C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\DDP Service\ddpsv.exe C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\assembly C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe N/A
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Windowsx64\Explorer.exe:Zone.Identifier C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 340 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 340 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 340 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4000 wrote to memory of 1136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4000 wrote to memory of 1136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4000 wrote to memory of 1136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 340 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\tmp.exe
PID 340 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\tmp.exe
PID 340 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\tmp.exe
PID 340 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe
PID 340 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe
PID 340 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe
PID 340 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe
PID 340 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe
PID 340 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe
PID 340 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe
PID 340 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe
PID 2832 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2832 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2832 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2832 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2832 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2832 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe"

C:\Windows\SysWOW64\reg.exe

reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windowsx64\Explorer.exe.lnk" /f

C:\Users\Admin\AppData\Roaming\tmp.exe

"C:\Users\Admin\AppData\Roaming\tmp.exe"

C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1e5bf711537ee7a229050e4a4ff7ade1_JaffaCakes118.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp46BD.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp46FD.tmp"

Network

Country Destination Domain Proto
US 192.227.90.76:54984 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 99.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.72:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 72.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 192.227.90.76:54984 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 192.227.90.76:54984 tcp
US 8.8.8.8:53 senatorojugo.ddns.net udp
US 8.8.4.4:53 senatorojugo.ddns.net udp
US 8.8.8.8:53 senatorojugo.ddns.net udp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 senatorojugo.ddns.net udp
US 8.8.4.4:53 senatorojugo.ddns.net udp
US 8.8.8.8:53 senatorojugo.ddns.net udp
US 8.8.4.4:53 senatorojugo.ddns.net udp
US 8.8.8.8:53 senatorojugo.ddns.net udp
US 192.227.90.76:54984 tcp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 51.15.97.104.in-addr.arpa udp
US 192.227.90.76:54984 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 192.227.90.76:54984 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 senatorojugo.ddns.net udp
US 8.8.4.4:53 senatorojugo.ddns.net udp
US 8.8.8.8:53 senatorojugo.ddns.net udp
US 8.8.8.8:53 senatorojugo.ddns.net udp
US 8.8.4.4:53 senatorojugo.ddns.net udp
US 8.8.8.8:53 senatorojugo.ddns.net udp
US 8.8.4.4:53 senatorojugo.ddns.net udp
US 8.8.8.8:53 senatorojugo.ddns.net udp
US 192.227.90.76:54984 tcp
US 192.227.90.76:54984 tcp

Files

memory/340-0-0x00000000746A2000-0x00000000746A3000-memory.dmp

memory/340-1-0x00000000746A0000-0x0000000074C51000-memory.dmp

memory/340-2-0x00000000746A0000-0x0000000074C51000-memory.dmp

C:\Users\Admin\AppData\Roaming\Windowsx64\Explorer.exe

MD5 1e5bf711537ee7a229050e4a4ff7ade1
SHA1 772a5a81572b4bfb038b1102cc02dbd2f9e27a2f
SHA256 120893883361e2381a0c10fc432fb304e4943df88e23bcbaead4738944a6bf55
SHA512 15d4fbddb93a06aceda44fd3ad6cf7563b03d72cd3bb71b31e5db366a4efa44533647beca6f267307a624c8058067a9b48067445d2cd7a34f5d3bedb252c1cc7

C:\Users\Admin\AppData\Roaming\tmp.exe

MD5 f957426141d1d300f6b2b20221a6aa4e
SHA1 c815d6213a7e648c38501c85cf90dbea6dde34d2
SHA256 c84be4223a716573794704753a0abf2d85a087ea395b21dc2fa9bee77fcb5bac
SHA512 a93cd14785ee081a074944f27c36e35e297b68b2af48f52d47148a0fca7b8eb4b726a89b4668b9f792ca109cbfbf9df3dd2467afc6802e6226f48a64c142f911

memory/2832-20-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1424-21-0x00000000746A0000-0x0000000074C51000-memory.dmp

memory/1424-22-0x00000000746A0000-0x0000000074C51000-memory.dmp

memory/1424-23-0x00000000746A0000-0x0000000074C51000-memory.dmp

memory/2832-25-0x00000000746A0000-0x0000000074C51000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp46BD.tmp

MD5 302e84aaa764d16a7b7871a3fa45702b
SHA1 c8ffd468093c8f87b2c8fe26401b8493778a0964
SHA256 64558ba0636f1bc5cbdce995e2d8916638a306a1ae1480d7416cec11f2e307a5
SHA512 5d9a6b4526057be238366117b2e1c0c85f077f9f500725e28d80b4233c3993fc6ec9713801bec5cf0b5b6777a5b6fde8d377a3ecf9fcebc8fd2eb1a768fe6075

C:\Users\Admin\AppData\Local\Temp\tmp46FD.tmp

MD5 93d357e6194c8eb8d0616a9f592cc4bf
SHA1 5cc3a3d95d82cb88f65cb6dc6c188595fa272808
SHA256 a18de0ef2102d2546c7afd07ad1d7a071a0e59aff0868cf3937a145f24feb713
SHA512 4df079387f6a76e0deb96ab4c11f6cffa62a8b42dc4970e885dab10351fade2d9e933663c141b76409657f85f1bf9dbb533d92dce52dc62598aafc4793743f7f

memory/2832-31-0x00000000746A0000-0x0000000074C51000-memory.dmp

memory/2832-33-0x00000000746A0000-0x0000000074C51000-memory.dmp

memory/1424-35-0x00000000746A0000-0x0000000074C51000-memory.dmp

memory/340-37-0x00000000746A0000-0x0000000074C51000-memory.dmp

memory/2832-38-0x00000000746A0000-0x0000000074C51000-memory.dmp