Malware Analysis Report

2024-11-13 13:42

Sample ID 240516-j5anzaca72
Target 4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118
SHA256 c826d112cbfa6ac5f2950113046c40a0aa00bc1595a0f2019d108df02b99b0a4
Tags
dcrat infostealer persistence rat upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c826d112cbfa6ac5f2950113046c40a0aa00bc1595a0f2019d108df02b99b0a4

Threat Level: Known bad

The file 4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

dcrat infostealer persistence rat upx

DcRat

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

UPX packed file

Drops startup file

Adds Run key to start application

Looks up external IP address via web service

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-16 08:14

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-16 08:14

Reported

2024-05-16 08:17

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118.exe"

Signatures

DcRat

rat infostealer dcrat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\AVvht7K88OJxvVRxYaye.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkpHst32.lnk C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Winlog.lnk C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\AVvht7K88OJxvVRxYaye.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d3dx32 = "C:\\Users\\Admin\\AppData\\Roaming\\System.lnk" C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\AVvht7K88OJxvVRxYaye.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 448 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118.exe C:\Windows\SysWOW64\WScript.exe
PID 448 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118.exe C:\Windows\SysWOW64\WScript.exe
PID 448 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118.exe C:\Windows\SysWOW64\WScript.exe
PID 1404 wrote to memory of 1768 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1404 wrote to memory of 1768 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1404 wrote to memory of 1768 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1768 wrote to memory of 4200 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\AVvht7K88OJxvVRxYaye.exe
PID 1768 wrote to memory of 4200 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\AVvht7K88OJxvVRxYaye.exe
PID 1768 wrote to memory of 4200 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\AVvht7K88OJxvVRxYaye.exe
PID 4200 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Roaming\AVvht7K88OJxvVRxYaye.exe C:\Windows\SysWOW64\WScript.exe
PID 4200 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Roaming\AVvht7K88OJxvVRxYaye.exe C:\Windows\SysWOW64\WScript.exe
PID 4200 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Roaming\AVvht7K88OJxvVRxYaye.exe C:\Windows\SysWOW64\WScript.exe
PID 2104 wrote to memory of 1584 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2104 wrote to memory of 1584 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2104 wrote to memory of 1584 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1584 wrote to memory of 2620 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\kasperskiy.exe
PID 1584 wrote to memory of 2620 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\kasperskiy.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\FM1GV0nwV6NBGMhpkFkspN3EXmNiKp.vbs"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\rDsNawCN4GJP9CexwTN1QKqyWf0dob.bat" "

C:\Users\Admin\AppData\Roaming\AVvht7K88OJxvVRxYaye.exe

AVvht7K88OJxvVRxYaye.exe -p1eee374ad5fc54c69c3297f577d8316beeaaed85

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\System.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\fV2k5DsZiGZrbZzOAu29ftdemcCJJ1.bat" "

C:\Users\Admin\AppData\Roaming\kasperskiy.exe

"C:\Users\Admin\AppData\Roaming\kasperskiy.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.107.113:443 www.bing.com tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 113.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 loshadka1337.000webhostapp.com udp
US 145.14.144.8:80 loshadka1337.000webhostapp.com tcp
US 145.14.144.8:80 loshadka1337.000webhostapp.com tcp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.186.192:80 ipinfo.io tcp
US 8.8.8.8:53 8.144.14.145.in-addr.arpa udp
US 8.8.8.8:53 192.186.117.34.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 145.14.144.8:80 loshadka1337.000webhostapp.com tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 145.14.144.8:80 loshadka1337.000webhostapp.com tcp
US 145.14.144.8:80 loshadka1337.000webhostapp.com tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 145.14.144.8:80 loshadka1337.000webhostapp.com tcp
IE 52.111.236.23:443 tcp
US 145.14.144.8:80 loshadka1337.000webhostapp.com tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 145.14.144.8:80 loshadka1337.000webhostapp.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 145.14.144.8:80 loshadka1337.000webhostapp.com tcp
US 8.8.8.8:53 loshadka1337.000webhostapp.com udp
US 145.14.144.174:80 loshadka1337.000webhostapp.com tcp
US 8.8.8.8:53 174.144.14.145.in-addr.arpa udp
US 145.14.144.174:80 loshadka1337.000webhostapp.com tcp

Files

memory/448-0-0x0000000000400000-0x00000000004BE000-memory.dmp

memory/448-1-0x00000000771D2000-0x00000000771D3000-memory.dmp

memory/448-2-0x00000000771D3000-0x00000000771D4000-memory.dmp

memory/448-13-0x0000000000400000-0x00000000004BE000-memory.dmp

C:\Users\Admin\AppData\Roaming\FM1GV0nwV6NBGMhpkFkspN3EXmNiKp.vbs

MD5 5253157db7b043f538a1f416835f254c
SHA1 f83c5e3f6133b92ffe2e8f8c6c05d95efe434414
SHA256 5b632746488d9fa873ac24438337bf4db9653c2bac58a5038ff81e13b460448a
SHA512 4709a2d6829fdecdfdbb02421bcd92ec1df7c842eb0565d63bdcc121fe7c1eb11d032f62f07d4a4125b2a8412a5703084aa42c54de9ba0f12a151e4c6adf19f1

C:\Users\Admin\AppData\Roaming\rDsNawCN4GJP9CexwTN1QKqyWf0dob.bat

MD5 a0c2c81f8c81da5f49ab2835e468a304
SHA1 9041173a0baa1a6e840f2fbc0a76ab01726292b6
SHA256 3e280177c9acc9a20336f14086bb1fed8ce63eacf8f4aae08015538b0ee76168
SHA512 9835061782b222becd2b9128d97789844916f4ec76a987d95885733c3c9c80769f6aa3f8d74a3295e0528556d0958188df7394d6e7828371f6c4bd413aafa7ae

C:\Users\Admin\AppData\Roaming\AVvht7K88OJxvVRxYaye.exe

MD5 07deb9adc1b5c6b6c0654c589b593b2a
SHA1 d636fcdece4747ea544554799e65f9d8e9ae2b41
SHA256 06b4ab5add1e394b089c9552bc4e2ad742093af6129d927cf38206d9f9d9297d
SHA512 97249b09693073f449f6981493c9f92543085ae0033c8759d22e6aee93e049656d2cd87a53fb90b4db81ccb38dde88a26ce3f47e1c70ab164dbd509a13a245c1

C:\Users\Admin\AppData\Roaming\System.vbe

MD5 3889b1a5f010ce2cdae701aa12e12748
SHA1 888f40b996c0cf3312de3fdfff2e30b8e6576c85
SHA256 9fea306141dd85b2876bb7cbb2b2abfd724854f72bd27ceef82803fc8219d035
SHA512 f8622c460cd50c7b33f58b711ddf442d3f9906ccd74fdaffd5deafc1340aa159b15eea2b18490243dc1779fef6bc10e8edf17f383745efe745378a82d9a760bd

C:\Users\Admin\AppData\Roaming\fV2k5DsZiGZrbZzOAu29ftdemcCJJ1.bat

MD5 1cc1057e91edd02ce3af9a6a193b2520
SHA1 842f11d646906fe671970a51bebc645200af733b
SHA256 5903cb7ab21cccf29725cac35a4db516c5d586f3a9bea52b4335f80d91b48eef
SHA512 9e966d6de171230c7d8156a587960dedabfb46d3430155f421ee5befcf77577217c99190f74c565ba07a502bcc69e65bc6568b12700345618be2cb16ba68a73c

C:\Users\Admin\AppData\Roaming\System.lnk

MD5 42c77986a8b408f34c91db316226baa2
SHA1 5d84a29c78bed4615ba34153f1619199d0881065
SHA256 9110629e8e63b4c39b1510a67f102af5f849693d296ff063b869ccc0c51a429d
SHA512 cd550f69793b6fe06a9a1bbe7bd652536dbcb1d3c4e468fb5b31b7e35dadbf89c36cbe745bcba4f2358a4c6b9d6e78dda9bf4fd704868f7e5ad86833a9d9a766

C:\Users\Admin\AppData\Roaming\kasperskiy.exe

MD5 ecf4b9b54c43151ea020b003e1db2fc9
SHA1 441252d8a0bb62cae18c692c3e52e876485c404b
SHA256 3eedee6c55f3c66b94413397fdf4b4fda05e7706bf9ba99df1090508986180a2
SHA512 b79a66f95c33f2bceca6f8319130dd6f9fa6807ed11eb9139ef8e5bcc604917925fb6f8f33dfc54aae3e1c1681216be5551a266f8344a8c71846f724544c975d

memory/2620-36-0x000001DD8D7E0000-0x000001DD8D9D4000-memory.dmp

C:\Users\Admin\AppData\Roaming\vmcheck32.dll

MD5 0c62f61d9b8c9a9d88924b59f00fa804
SHA1 8c918348c04b7f9c514b0d3d0b9d30700ac2e41e
SHA256 f07a6667289d38a1aa11e85a92c4d3de74b28b80e17af777f9f6a2e370b2af16
SHA512 a29c75ed94c6fb70108fe1ed4b8aa96867f4ff2cc27e9cb4b7ec3dfd5fb34e64fc4b957c0e306709fe7c38aea0330ad4e40cfdfa5c491f022c3277d87411d056

memory/2620-39-0x000001DDA7FF0000-0x000001DDA8066000-memory.dmp

memory/2620-40-0x000001DD8F710000-0x000001DD8F72E000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-16 08:14

Reported

2024-05-16 08:17

Platform

win7-20240220-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118.exe"

Signatures

DcRat

rat infostealer dcrat

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Winlog.lnk C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkpHst32.lnk C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\AVvht7K88OJxvVRxYaye.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\d3dx32 = "C:\\Users\\Admin\\AppData\\Roaming\\System.lnk" C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\kasperskiy.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1708 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118.exe C:\Windows\SysWOW64\WScript.exe
PID 1708 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118.exe C:\Windows\SysWOW64\WScript.exe
PID 1708 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118.exe C:\Windows\SysWOW64\WScript.exe
PID 1708 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118.exe C:\Windows\SysWOW64\WScript.exe
PID 2564 wrote to memory of 2720 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2564 wrote to memory of 2720 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2564 wrote to memory of 2720 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2564 wrote to memory of 2720 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2796 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\AVvht7K88OJxvVRxYaye.exe
PID 2720 wrote to memory of 2796 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\AVvht7K88OJxvVRxYaye.exe
PID 2720 wrote to memory of 2796 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\AVvht7K88OJxvVRxYaye.exe
PID 2720 wrote to memory of 2796 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\AVvht7K88OJxvVRxYaye.exe
PID 2796 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Roaming\AVvht7K88OJxvVRxYaye.exe C:\Windows\SysWOW64\WScript.exe
PID 2796 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Roaming\AVvht7K88OJxvVRxYaye.exe C:\Windows\SysWOW64\WScript.exe
PID 2796 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Roaming\AVvht7K88OJxvVRxYaye.exe C:\Windows\SysWOW64\WScript.exe
PID 2796 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Roaming\AVvht7K88OJxvVRxYaye.exe C:\Windows\SysWOW64\WScript.exe
PID 3000 wrote to memory of 1980 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3000 wrote to memory of 1980 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3000 wrote to memory of 1980 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3000 wrote to memory of 1980 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1980 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\kasperskiy.exe
PID 1980 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\kasperskiy.exe
PID 1980 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\kasperskiy.exe
PID 1980 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\kasperskiy.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\4a2902958e01cc91f2e71736e0de83aa_JaffaCakes118.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\FM1GV0nwV6NBGMhpkFkspN3EXmNiKp.vbs"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\rDsNawCN4GJP9CexwTN1QKqyWf0dob.bat" "

C:\Users\Admin\AppData\Roaming\AVvht7K88OJxvVRxYaye.exe

AVvht7K88OJxvVRxYaye.exe -p1eee374ad5fc54c69c3297f577d8316beeaaed85

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\System.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\fV2k5DsZiGZrbZzOAu29ftdemcCJJ1.bat" "

C:\Users\Admin\AppData\Roaming\kasperskiy.exe

"C:\Users\Admin\AppData\Roaming\kasperskiy.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 loshadka1337.000webhostapp.com udp
US 145.14.144.12:80 loshadka1337.000webhostapp.com tcp
US 145.14.144.12:80 loshadka1337.000webhostapp.com tcp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.186.192:80 ipinfo.io tcp
US 145.14.144.12:80 loshadka1337.000webhostapp.com tcp
US 145.14.144.12:80 loshadka1337.000webhostapp.com tcp
US 145.14.144.12:80 loshadka1337.000webhostapp.com tcp
US 145.14.144.12:80 loshadka1337.000webhostapp.com tcp
US 145.14.144.12:80 loshadka1337.000webhostapp.com tcp
US 145.14.144.12:80 loshadka1337.000webhostapp.com tcp
US 145.14.144.12:80 loshadka1337.000webhostapp.com tcp
US 8.8.8.8:53 loshadka1337.000webhostapp.com udp
US 145.14.144.42:80 loshadka1337.000webhostapp.com tcp

Files

memory/1708-0-0x0000000000400000-0x00000000004BE000-memory.dmp

memory/1708-1-0x0000000076FB0000-0x0000000076FB1000-memory.dmp

memory/1708-11-0x0000000000400000-0x00000000004BE000-memory.dmp

C:\Users\Admin\AppData\Roaming\FM1GV0nwV6NBGMhpkFkspN3EXmNiKp.vbs

MD5 5253157db7b043f538a1f416835f254c
SHA1 f83c5e3f6133b92ffe2e8f8c6c05d95efe434414
SHA256 5b632746488d9fa873ac24438337bf4db9653c2bac58a5038ff81e13b460448a
SHA512 4709a2d6829fdecdfdbb02421bcd92ec1df7c842eb0565d63bdcc121fe7c1eb11d032f62f07d4a4125b2a8412a5703084aa42c54de9ba0f12a151e4c6adf19f1

C:\Users\Admin\AppData\Roaming\rDsNawCN4GJP9CexwTN1QKqyWf0dob.bat

MD5 a0c2c81f8c81da5f49ab2835e468a304
SHA1 9041173a0baa1a6e840f2fbc0a76ab01726292b6
SHA256 3e280177c9acc9a20336f14086bb1fed8ce63eacf8f4aae08015538b0ee76168
SHA512 9835061782b222becd2b9128d97789844916f4ec76a987d95885733c3c9c80769f6aa3f8d74a3295e0528556d0958188df7394d6e7828371f6c4bd413aafa7ae

\Users\Admin\AppData\Roaming\AVvht7K88OJxvVRxYaye.exe

MD5 07deb9adc1b5c6b6c0654c589b593b2a
SHA1 d636fcdece4747ea544554799e65f9d8e9ae2b41
SHA256 06b4ab5add1e394b089c9552bc4e2ad742093af6129d927cf38206d9f9d9297d
SHA512 97249b09693073f449f6981493c9f92543085ae0033c8759d22e6aee93e049656d2cd87a53fb90b4db81ccb38dde88a26ce3f47e1c70ab164dbd509a13a245c1

C:\Users\Admin\AppData\Roaming\System.vbe

MD5 3889b1a5f010ce2cdae701aa12e12748
SHA1 888f40b996c0cf3312de3fdfff2e30b8e6576c85
SHA256 9fea306141dd85b2876bb7cbb2b2abfd724854f72bd27ceef82803fc8219d035
SHA512 f8622c460cd50c7b33f58b711ddf442d3f9906ccd74fdaffd5deafc1340aa159b15eea2b18490243dc1779fef6bc10e8edf17f383745efe745378a82d9a760bd

C:\Users\Admin\AppData\Roaming\fV2k5DsZiGZrbZzOAu29ftdemcCJJ1.bat

MD5 1cc1057e91edd02ce3af9a6a193b2520
SHA1 842f11d646906fe671970a51bebc645200af733b
SHA256 5903cb7ab21cccf29725cac35a4db516c5d586f3a9bea52b4335f80d91b48eef
SHA512 9e966d6de171230c7d8156a587960dedabfb46d3430155f421ee5befcf77577217c99190f74c565ba07a502bcc69e65bc6568b12700345618be2cb16ba68a73c

C:\Users\Admin\AppData\Roaming\System.lnk

MD5 c2c6568d9deea7955d7ecc1b9b313a5b
SHA1 cd5fe4740f63e8d454738c4158db6b7bd58ec9b9
SHA256 106fd8f17fcb58360a02215baf7c562ca1a572fb41d109ced27138086ff1133e
SHA512 26366914e439c74a2a3d9d6a340e34e9a98cfec08833404683bcc050dd1ea66d612e8b91fc8d8cf7181911154edeb52e8b97333f20c139b447814e5e7b4a2735

\Users\Admin\AppData\Roaming\kasperskiy.exe

MD5 ecf4b9b54c43151ea020b003e1db2fc9
SHA1 441252d8a0bb62cae18c692c3e52e876485c404b
SHA256 3eedee6c55f3c66b94413397fdf4b4fda05e7706bf9ba99df1090508986180a2
SHA512 b79a66f95c33f2bceca6f8319130dd6f9fa6807ed11eb9139ef8e5bcc604917925fb6f8f33dfc54aae3e1c1681216be5551a266f8344a8c71846f724544c975d

memory/2776-36-0x0000000000370000-0x0000000000564000-memory.dmp

C:\Users\Admin\AppData\Roaming\vmcheck32.dll

MD5 0c62f61d9b8c9a9d88924b59f00fa804
SHA1 8c918348c04b7f9c514b0d3d0b9d30700ac2e41e
SHA256 f07a6667289d38a1aa11e85a92c4d3de74b28b80e17af777f9f6a2e370b2af16
SHA512 a29c75ed94c6fb70108fe1ed4b8aa96867f4ff2cc27e9cb4b7ec3dfd5fb34e64fc4b957c0e306709fe7c38aea0330ad4e40cfdfa5c491f022c3277d87411d056