Malware Analysis Report

2025-01-22 12:50

Sample ID 240521-vkl22scd43
Target 64119aa0b6a3110f625b073170593df6_JaffaCakes118
SHA256 270cbd6409f932367cc6953dce42d9aee89f66d722a4cf6196cadf7401217937
Tags
vmprotect execution persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

270cbd6409f932367cc6953dce42d9aee89f66d722a4cf6196cadf7401217937

Threat Level: Likely malicious

The file 64119aa0b6a3110f625b073170593df6_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

vmprotect execution persistence

Creates new service(s)

Drops startup file

VMProtect packed file

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Launches sc.exe

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-21 17:02

Signatures

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-21 17:02

Reported

2024-05-21 17:05

Platform

win7-20231129-en

Max time kernel

149s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe"

Signatures

Creates new service(s)

persistence execution

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\abc.vbs C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification \??\c:\windows\SysWOW64\Com\vsx.vbs C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\Program Files\windows nt\6411.dll C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
File opened for modification \??\c:\Program Files\common files\64119.dll C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
File opened for modification \??\c:\Program Files\internet explorer\64119a.dll C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2060 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2140 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2140 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2140 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2140 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2160 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2160 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2160 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2160 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c sc Create WebCliant binPath= "cmd /c start C:\Users\Admin\AppData\Roaming\Microsoft\Windows\desktop.vbs" type= own type= interact start= auto

C:\Windows\SysWOW64\cmd.exe

cmd /c sc Create ChannelRent binPath= "cmd /c start c:\windows\system32\Com\vsx.vbs" type= own type= interact start= auto

C:\Windows\SysWOW64\sc.exe

sc Create ChannelRent binPath= "cmd /c start c:\windows\system32\Com\vsx.vbs" type= own type= interact start= auto

C:\Windows\SysWOW64\sc.exe

sc Create WebCliant binPath= "cmd /c start C:\Users\Admin\AppData\Roaming\Microsoft\Windows\desktop.vbs" type= own type= interact start= auto

Network

N/A

Files

memory/2060-0-0x0000000000400000-0x000000000058F000-memory.dmp

memory/2060-1-0x0000000000400000-0x000000000058F000-memory.dmp

memory/2060-3-0x0000000000400000-0x000000000058F000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-21 17:02

Reported

2024-05-21 17:05

Platform

win10v2004-20240226-en

Max time kernel

151s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe"

Signatures

Creates new service(s)

persistence execution

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\abc.vbs C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification \??\c:\windows\SysWOW64\Com\vsx.vbs C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\Program Files\windows nt\6411.dll C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
File opened for modification \??\c:\Program Files\common files\64119.dll C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
File opened for modification \??\c:\Program Files\internet explorer\64119a.dll C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2240 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2612 wrote to memory of 2072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2680 wrote to memory of 3896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2612 wrote to memory of 2072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2612 wrote to memory of 2072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2680 wrote to memory of 3896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2680 wrote to memory of 3896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c sc Create WebCliant binPath= "cmd /c start C:\Users\Admin\AppData\Roaming\Microsoft\Windows\desktop.vbs" type= own type= interact start= auto

C:\Windows\SysWOW64\cmd.exe

cmd /c sc Create ChannelRent binPath= "cmd /c start c:\windows\system32\Com\vsx.vbs" type= own type= interact start= auto

C:\Windows\SysWOW64\sc.exe

sc Create WebCliant binPath= "cmd /c start C:\Users\Admin\AppData\Roaming\Microsoft\Windows\desktop.vbs" type= own type= interact start= auto

C:\Windows\SysWOW64\sc.exe

sc Create ChannelRent binPath= "cmd /c start c:\windows\system32\Com\vsx.vbs" type= own type= interact start= auto

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
GB 23.44.234.16:80 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 56.94.73.104.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 168.253.116.51.in-addr.arpa udp

Files

memory/2240-0-0x0000000000400000-0x000000000058F000-memory.dmp

memory/2240-1-0x0000000000516000-0x0000000000517000-memory.dmp

memory/2240-2-0x0000000000400000-0x000000000058F000-memory.dmp

memory/2240-4-0x0000000000400000-0x000000000058F000-memory.dmp