Malware Analysis Report

2024-08-06 15:22

Sample ID 240519-yaastaec8t
Target 5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118
SHA256 2816241bc95bb7ed310224e6f8597d6665f98a51ac4a17d2372c427aa9b0cf68
Tags
nanocore evasion keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2816241bc95bb7ed310224e6f8597d6665f98a51ac4a17d2372c427aa9b0cf68

Threat Level: Known bad

The file 5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger spyware stealer trojan

Modifies Windows Defender Real-time Protection settings

NanoCore

Checks computer location settings

Windows security modification

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Create or Modify System Process
T1543
Windows Service
T1543.003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Modify Registry
T1112
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-19 19:34

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-19 19:34

Reported

2024-05-19 19:37

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe N/A

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3972 set thread context of 1284 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3972 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3972 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3972 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3972 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 3972 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 3972 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 3972 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 3972 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 3972 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 3972 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 3972 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 3972 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 3972 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 3972 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1284 wrote to memory of 4972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe C:\Windows\SysWOW64\schtasks.exe
PID 1284 wrote to memory of 4972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe C:\Windows\SysWOW64\schtasks.exe
PID 1284 wrote to memory of 4972 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell" Get-MpPreference -verbose

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bKXKhtysqSdsa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5AE1.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DPI Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5E8B.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 bornsinner.myq-see.com udp
BE 2.17.107.121:443 www.bing.com tcp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 121.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 15.173.189.20.in-addr.arpa udp

Files

memory/3972-0-0x0000000074842000-0x0000000074843000-memory.dmp

memory/3972-1-0x0000000074840000-0x0000000074DF1000-memory.dmp

memory/3972-2-0x0000000074840000-0x0000000074DF1000-memory.dmp

memory/752-3-0x00000000722FE000-0x00000000722FF000-memory.dmp

memory/752-4-0x0000000004B70000-0x0000000004BA6000-memory.dmp

memory/752-6-0x00000000051E0000-0x0000000005808000-memory.dmp

memory/752-5-0x00000000722F0000-0x0000000072AA0000-memory.dmp

memory/752-7-0x00000000722F0000-0x0000000072AA0000-memory.dmp

memory/752-8-0x00000000051A0000-0x00000000051C2000-memory.dmp

memory/752-9-0x0000000005A00000-0x0000000005A66000-memory.dmp

memory/752-10-0x0000000005A70000-0x0000000005AD6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xbvv05td.vl0.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/752-20-0x0000000005BE0000-0x0000000005F34000-memory.dmp

memory/752-21-0x00000000060C0000-0x00000000060DE000-memory.dmp

memory/752-22-0x00000000060F0000-0x000000000613C000-memory.dmp

memory/752-23-0x00000000070B0000-0x00000000070E2000-memory.dmp

memory/752-24-0x000000006E770000-0x000000006E7BC000-memory.dmp

memory/752-37-0x00000000722F0000-0x0000000072AA0000-memory.dmp

memory/752-36-0x00000000070F0000-0x0000000007193000-memory.dmp

memory/752-35-0x0000000006680000-0x000000000669E000-memory.dmp

memory/752-34-0x00000000722F0000-0x0000000072AA0000-memory.dmp

memory/752-39-0x0000000007400000-0x000000000741A000-memory.dmp

memory/752-38-0x0000000007A50000-0x00000000080CA000-memory.dmp

memory/752-40-0x0000000004E20000-0x0000000004E2A000-memory.dmp

memory/752-41-0x00000000076A0000-0x0000000007736000-memory.dmp

memory/752-42-0x0000000007620000-0x0000000007631000-memory.dmp

memory/752-43-0x0000000007650000-0x000000000765E000-memory.dmp

memory/752-44-0x0000000007660000-0x0000000007674000-memory.dmp

memory/752-45-0x0000000007760000-0x000000000777A000-memory.dmp

memory/752-46-0x0000000007740000-0x0000000007748000-memory.dmp

memory/752-49-0x00000000722F0000-0x0000000072AA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp5AE1.tmp

MD5 ba384db1c404d2d77dab4477bf81ae30
SHA1 81a46ae99344843a7159cc099da25c2479b29d98
SHA256 54590e0997d2a1ce867769750115ed414b7341687680f65ee03fda2c1afbe4ca
SHA512 ae7e26b4963b0146b806602e5784368d4e74affef103dd1d09265ddf1f09ca8f1d2b0ec37fec1333269d8924e3d07a553dd1fd049cf2b43270d54c419f669ba9

memory/1284-55-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1284-59-0x0000000074840000-0x0000000074DF1000-memory.dmp

memory/3972-58-0x0000000074840000-0x0000000074DF1000-memory.dmp

memory/1284-57-0x0000000074842000-0x0000000074843000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp5E8B.tmp

MD5 40b11ef601fb28f9b2e69d36857bf2ec
SHA1 b6454020ad2ceed193f4792b77001d0bd741b370
SHA256 c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512 e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5

memory/1284-64-0x0000000074840000-0x0000000074DF1000-memory.dmp

memory/1284-65-0x0000000074842000-0x0000000074843000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-19 19:34

Reported

2024-05-19 19:37

Platform

win7-20231129-en

Max time kernel

148s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe N/A

NanoCore

keylogger trojan stealer spyware nanocore

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1936 set thread context of 2856 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1936 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1936 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1936 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1936 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1936 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1936 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1936 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1936 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1936 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1936 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1936 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1936 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1936 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1936 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1936 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1936 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1936 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1936 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1936 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1936 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1936 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1936 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1936 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1936 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1936 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1936 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1936 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 2856 wrote to memory of 1904 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe C:\Windows\SysWOW64\schtasks.exe
PID 2856 wrote to memory of 1904 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe C:\Windows\SysWOW64\schtasks.exe
PID 2856 wrote to memory of 1904 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe C:\Windows\SysWOW64\schtasks.exe
PID 2856 wrote to memory of 1904 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\5b169b166b37a1632dfdb10b4807b4a8_JaffaCakes118.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell" Get-MpPreference -verbose

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bKXKhtysqSdsa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1304.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "TCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp14E8.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp
US 8.8.8.8:53 bornsinner.myq-see.com udp
US 208.91.197.132:3941 bornsinner.myq-see.com tcp

Files

memory/1936-0-0x0000000074AD1000-0x0000000074AD2000-memory.dmp

memory/1936-1-0x0000000074AD0000-0x000000007507B000-memory.dmp

memory/1936-2-0x0000000074AD0000-0x000000007507B000-memory.dmp

memory/3040-5-0x0000000074AD0000-0x000000007507B000-memory.dmp

memory/3040-6-0x0000000074AD0000-0x000000007507B000-memory.dmp

memory/3040-7-0x0000000074AD0000-0x000000007507B000-memory.dmp

memory/3040-8-0x0000000074AD0000-0x000000007507B000-memory.dmp

memory/3040-9-0x0000000074AD0000-0x000000007507B000-memory.dmp

memory/3040-10-0x0000000074AD0000-0x000000007507B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1304.tmp

MD5 61967f64a955abf073203d954c7264c5
SHA1 ea05d5b0e7fedc52a26e08eff80c779b1054be09
SHA256 0e095f1ba173425b7e280bffb6f1ffe87585af71e4bf5d133aadd54c47688c4d
SHA512 74c1ad5740d2533c5935dc850a895a0dd7fd170c4d3cf0e9ba3981f4477a4052593c8289ef2941c397693b6446ff7effaf6c94288e3e419a0282344437236023

memory/2856-27-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2856-26-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2856-16-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1936-28-0x0000000074AD0000-0x000000007507B000-memory.dmp

memory/2856-25-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2856-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2856-22-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2856-20-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2856-18-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1936-29-0x0000000074AD0000-0x000000007507B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp14E8.tmp

MD5 40b11ef601fb28f9b2e69d36857bf2ec
SHA1 b6454020ad2ceed193f4792b77001d0bd741b370
SHA256 c51e12d18cc664425f6711d8ae2507068884c7057092cfa11884100e1e9d49e1
SHA512 e3c5bcc714cbfca4b8058ddcddf231dcefa69c15881ce3f8123e59ed45cfb5da052b56e1945dcf8dc7f800d62f9a4eecb82bca69a66a1530787aeffeb15e2bd5