Malware Analysis Report

2024-08-06 13:46

Sample ID 240521-scs5aahh5z
Target 63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118
SHA256 dd3079431259f85345c35fe1a440b12354520b1ee0cab2daeab3ce6480f94da0
Tags
azorult evasion infostealer persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

dd3079431259f85345c35fe1a440b12354520b1ee0cab2daeab3ce6480f94da0

Threat Level: Known bad

The file 63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

azorult evasion infostealer persistence trojan

Modifies WinLogon for persistence

Azorult

Modifies visiblity of hidden/system files in Explorer

Modifies Installed Components in the registry

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

AutoIT Executable

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Defense Evasion
TA0005
Modify Registry
T1112
Hide Artifacts
T1564
Hidden Files and Directories
T1564.001
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-21 14:59

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-21 14:59

Reported

2024-05-21 15:01

Platform

win7-20240221-en

Max time kernel

150s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe"

Signatures

Azorult

trojan infostealer azorult

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  N/A
N/A N/A C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
N/A N/A \??\c:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  N/A
N/A N/A C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2308 set thread context of 2456 N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  \??\c:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A
File opened for modification C:\Windows\system\udsys.exe \??\c:\windows\system\explorer.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 832 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 
PID 832 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 
PID 832 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 
PID 832 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 
PID 832 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 832 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 832 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 832 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 2308 wrote to memory of 2456 N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  \??\c:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 
PID 2308 wrote to memory of 2456 N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  \??\c:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 
PID 2308 wrote to memory of 2456 N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  \??\c:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 
PID 2308 wrote to memory of 2456 N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  \??\c:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 
PID 2308 wrote to memory of 2456 N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  \??\c:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 
PID 2308 wrote to memory of 2456 N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  \??\c:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 
PID 2172 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 2172 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 2172 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 2172 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 2580 wrote to memory of 2480 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2580 wrote to memory of 2480 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2580 wrote to memory of 2480 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2580 wrote to memory of 2480 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2480 wrote to memory of 2420 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2480 wrote to memory of 2420 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2480 wrote to memory of 2420 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2480 wrote to memory of 2420 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2420 wrote to memory of 2436 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2420 wrote to memory of 2436 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2420 wrote to memory of 2436 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2420 wrote to memory of 2436 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2420 wrote to memory of 2260 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2420 wrote to memory of 2260 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2420 wrote to memory of 2260 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2420 wrote to memory of 2260 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2420 wrote to memory of 2820 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2420 wrote to memory of 2820 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2420 wrote to memory of 2820 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2420 wrote to memory of 2820 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2420 wrote to memory of 1760 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2420 wrote to memory of 1760 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2420 wrote to memory of 1760 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2420 wrote to memory of 1760 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe

Processes

C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe"

\??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 

c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 

C:\Users\Admin\AppData\Local\icsys.icn.exe

C:\Users\Admin\AppData\Local\icsys.icn.exe

\??\c:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 

"c:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe "

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\SysWOW64\at.exe

at 15:01 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 15:02 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 15:03 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

Country Destination Domain Proto
FR 151.106.27.237:80 tcp
FR 151.106.27.237:80 tcp
FR 151.106.27.237:80 tcp

Files

memory/832-0-0x0000000000400000-0x000000000043E000-memory.dmp

\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 

MD5 6f8fdab50b949b040bd2411806845324
SHA1 f8fd4829bd5a7da2c99b1d26fe73a80dbee1f1dc
SHA256 24cede566cb189bd625b7a3c83213cd33f31c37c8a5d32c32519ce3276a85379
SHA512 634ac1e3abcabf2a1ced0ee00535f736305c564724ab3b576230f996c07fd2ae705578bf7123c555eaf79557fa090c9aac84ad24575e539d488c948752589f21

\Users\Admin\AppData\Local\icsys.icn.exe

MD5 7673a2465dec560e731bb44e82d39f8f
SHA1 2b142f2d1f78eec71f1d8303fda4507346a723e7
SHA256 41fba11bf233d46f9c36d5d885db0d275d1cb992f133c2cb443d093b23f53508
SHA512 6a00ce1a9d84d7730805838f9575e04a3fbd0905d62b2816e942b48628b260310eb3e313dcdf7eaa51ad257a4a31b5fc83d0633bc1d9e545dc0dba63bbfdc7e1

memory/2172-20-0x0000000000400000-0x000000000043E000-memory.dmp

memory/832-18-0x0000000001F00000-0x0000000001F3E000-memory.dmp

memory/832-17-0x0000000001F00000-0x0000000001F3E000-memory.dmp

memory/2456-38-0x0000000000080000-0x00000000000A0000-memory.dmp

memory/2456-32-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2456-26-0x0000000000080000-0x00000000000A0000-memory.dmp

memory/2456-24-0x0000000000080000-0x00000000000A0000-memory.dmp

\Windows\system\explorer.exe

MD5 a16c81761e65983b69fab5a9e94d6dc6
SHA1 e6f22176f36a02eb0e2bdc2c739d23f8467efb85
SHA256 bfe4205961bacc438942b00ddc838e4e8ab04a266d45d1f6adc03ff2838d6be1
SHA512 8932753a7d9a848e995efbee5cd6463f3e81e969157241b1d896c773f6b166d3904137033c0946b74d56a4707fbbdb0662a53c203aa7682e5bf24bcd83b1e8f6

memory/2172-44-0x0000000002730000-0x000000000276E000-memory.dmp

memory/2172-50-0x0000000002730000-0x000000000276E000-memory.dmp

\Windows\system\spoolsv.exe

MD5 63edbc514f959bba85dd696734f4d5f7
SHA1 c14e9ee9126608a3e7716abfb099c8a8d72ec121
SHA256 0480cf928d340d57158353f77749700ea62dfb06909c84bbb5f46a681b866118
SHA512 ec21ef9790f923698055da5327f951f4958e09116522a5ed992f71d56124ab86790570777b4075ab038e4a62548ee853b23017d0c1bd1bf662cd8a0745034621

memory/2580-63-0x00000000026C0000-0x00000000026FE000-memory.dmp

\Windows\system\svchost.exe

MD5 683a8aaed3d1315b06f06d3bbcd22d93
SHA1 c0a97093a1672fab00bb733aecff8e6d2675584c
SHA256 cf753d7c08adc781c6fe0cd46cc14d5f57dae859b7bbc3cb5bcd436d835da277
SHA512 4c26f64ea5512c1bdbbda34a908e0d30a41e833e6461de43c7be68701c15d81c34edef21ed0263efba0a21e17c024244bee4ff0a1522c33b7f2cfeb83c4a5183

memory/2420-86-0x0000000002550000-0x000000000258E000-memory.dmp

memory/2436-89-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2480-91-0x0000000000400000-0x000000000043E000-memory.dmp

memory/832-94-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2172-93-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 210ba9da684819ed1c755f104840ba27
SHA1 77d6c5c018c53adcb06fd4f91019bad195901656
SHA256 e01508e06fd5051519b56da34eff139c624028512064dd4f4bbd0f4e3808fb1d
SHA512 455eae41ed5b9255d620a08cc3225bba6772c3f57decd974076e1879243190d62d4c9a83a9c69e2a99bc2c47388eed54f573f75bad743333847517112c382aed

\??\PIPE\atsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-21 14:59

Reported

2024-05-21 15:01

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe"

Signatures

Azorult

trojan infostealer azorult

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  N/A
N/A N/A C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 548 set thread context of 4268 N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  \??\c:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A
File opened for modification C:\Windows\system\udsys.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4900 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 
PID 4900 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 
PID 4900 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 
PID 4900 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 4900 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 4900 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 1040 wrote to memory of 4276 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 1040 wrote to memory of 4276 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 1040 wrote to memory of 4276 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 4276 wrote to memory of 3056 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 4276 wrote to memory of 3056 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 4276 wrote to memory of 3056 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 3056 wrote to memory of 1888 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 3056 wrote to memory of 1888 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 3056 wrote to memory of 1888 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 1888 wrote to memory of 4524 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 1888 wrote to memory of 4524 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 1888 wrote to memory of 4524 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 548 wrote to memory of 4268 N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  \??\c:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 
PID 548 wrote to memory of 4268 N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  \??\c:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 
PID 548 wrote to memory of 4268 N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  \??\c:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 
PID 548 wrote to memory of 4268 N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  \??\c:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 
PID 548 wrote to memory of 4268 N/A \??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe  \??\c:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 
PID 1888 wrote to memory of 4896 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1888 wrote to memory of 4896 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1888 wrote to memory of 4896 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1888 wrote to memory of 3616 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1888 wrote to memory of 3616 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1888 wrote to memory of 3616 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1888 wrote to memory of 3816 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1888 wrote to memory of 3816 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1888 wrote to memory of 3816 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe

Processes

C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_JaffaCakes118.exe"

\??\c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 

c:\users\admin\appdata\local\temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 

C:\Users\Admin\AppData\Local\icsys.icn.exe

C:\Users\Admin\AppData\Local\icsys.icn.exe

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

\??\c:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 

"c:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe "

C:\Windows\SysWOW64\at.exe

at 15:01 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 15:02 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 15:03 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
FR 151.106.27.237:80 tcp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
FR 151.106.27.237:80 tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.16.208.104.in-addr.arpa udp

Files

memory/4900-0-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\63b4fa12cceff44442c51e7bc4d0b9e0_jaffacakes118.exe 

MD5 6f8fdab50b949b040bd2411806845324
SHA1 f8fd4829bd5a7da2c99b1d26fe73a80dbee1f1dc
SHA256 24cede566cb189bd625b7a3c83213cd33f31c37c8a5d32c32519ce3276a85379
SHA512 634ac1e3abcabf2a1ced0ee00535f736305c564724ab3b576230f996c07fd2ae705578bf7123c555eaf79557fa090c9aac84ad24575e539d488c948752589f21

C:\Users\Admin\AppData\Local\icsys.icn.exe

MD5 7673a2465dec560e731bb44e82d39f8f
SHA1 2b142f2d1f78eec71f1d8303fda4507346a723e7
SHA256 41fba11bf233d46f9c36d5d885db0d275d1cb992f133c2cb443d093b23f53508
SHA512 6a00ce1a9d84d7730805838f9575e04a3fbd0905d62b2816e942b48628b260310eb3e313dcdf7eaa51ad257a4a31b5fc83d0633bc1d9e545dc0dba63bbfdc7e1

memory/1040-12-0x0000000000400000-0x000000000043E000-memory.dmp

\??\c:\windows\system\explorer.exe

MD5 295562413bb66b8a049af4cb5451215a
SHA1 a2a1201f8b358336c09f1a5304b7525fa539ffbb
SHA256 8b079ef26ab34b93a8abc88c649873c44cede92079fe1cd75f983c9bc0aabe41
SHA512 de9a98f6f762f4eae42823f2aeb422f8e1a4e8f6ee41d7a7c0cc5cbf60f85ba85d1a6e467e87f5d7b89d5c301600e67dce64ce30113baa25fff925b96341ac66

C:\Windows\System\spoolsv.exe

MD5 39adff4fddba4f4f40111fcdbc93be57
SHA1 75055048ca7c45d9abf62d6b7c4c5e7f5eb5964a
SHA256 3c4a65039ab9a043865e98b8f2558edebe83913301d6539c2a3d49d30d48537a
SHA512 74aeedf27006fff6b2e0b850a46bd5d1e39d81977b111587ff58c5a7e5bf50f16054a44980c096601894d166dac3adf2795d0648f10046ebea7e3126ef4aa1c7

C:\Windows\System\svchost.exe

MD5 d3b7ce2674677327bb26a767c2713aee
SHA1 503ade8d378ae476a0f80972afc69567b5c33a44
SHA256 156910df884f9c5122e75ef7214824cddefeb080a0607a808786ba9235e1fefc
SHA512 7993aeb5a48242e65d415adaed8d84e6a317bd2bddc833c48b707ed43297a1a1259b2739cdbb663366e4e728a6b2280c8e1cfce312da33e88b582817cfacbf76

memory/4524-43-0x0000000000400000-0x000000000043E000-memory.dmp

memory/4524-45-0x0000000000400000-0x000000000043E000-memory.dmp

memory/3056-48-0x0000000000400000-0x000000000043E000-memory.dmp

memory/1040-49-0x0000000000400000-0x000000000043E000-memory.dmp

memory/4268-51-0x0000000000400000-0x0000000000420000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 88d9dcf12fafbcc68305c6ffebb3c0cd
SHA1 4a02cbb53e83b88354e954600d92514d09509215
SHA256 e4c8dcf405259aca2d3304db8905067fdf1350593e687fb1a875a47ec2f6e67c
SHA512 1b3cf8a420d5f7a98aae73eb095d04ea3d8f680076762c220fe242712ca5e350a924b75978f1a08e7620a8309747a5b93671a543a9cd9e6cb74153d2b703b842

memory/4900-50-0x0000000000400000-0x000000000043E000-memory.dmp

memory/4268-58-0x0000000000400000-0x0000000000420000-memory.dmp