Malware Analysis Report

2024-08-06 14:49

Sample ID 240616-q2csgszbjq
Target b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118
SHA256 12a061b82ef5bc4becaee8f9069db0375fb461302107dd4d53dc85522df8c8e8
Tags
nanocore evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

12a061b82ef5bc4becaee8f9069db0375fb461302107dd4d53dc85522df8c8e8

Threat Level: Known bad

The file b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger persistence spyware stealer trojan

NanoCore

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Drops file in Program Files directory

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-16 13:45

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-16 13:45

Reported

2024-06-16 13:47

Platform

win7-20240221-en

Max time kernel

149s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\sys-win32 = "C:\\Users\\Admin\\Documents\\husLtxWv.exe" C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\sys-win32 = "C:\\Users\\Admin\\Documents\\husLtxWv.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Host = "C:\\Program Files (x86)\\DHCP Host\\dhcphost.exe" C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2972 set thread context of 2436 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\DHCP Host\dhcphost.exe C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\DHCP Host\dhcphost.exe C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2972 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2972 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2972 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2972 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2520 wrote to memory of 2720 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2520 wrote to memory of 2720 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2520 wrote to memory of 2720 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2520 wrote to memory of 2720 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2972 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe
PID 2972 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe
PID 2972 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe
PID 2972 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe
PID 2972 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe
PID 2972 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe
PID 2972 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe
PID 2972 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe
PID 2972 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe
PID 2972 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2972 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2972 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2972 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2904 wrote to memory of 1932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2904 wrote to memory of 1932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2904 wrote to memory of 1932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2904 wrote to memory of 1932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2436 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2436 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2436 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2436 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2436 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2436 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2436 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2436 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ihgmqhbb.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES148B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC147A.tmp"

C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "sys-win32" /t REG_SZ /d "C:\Users\Admin\Documents\husLtxWv.exe

C:\Windows\SysWOW64\reg.exe

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "sys-win32" /t REG_SZ /d "C:\Users\Admin\Documents\husLtxWv.exe

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DHCP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1738.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DHCP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp17E5.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 customcheats.ddns.net udp

Files

memory/2972-0-0x0000000074D51000-0x0000000074D52000-memory.dmp

memory/2972-1-0x0000000074D50000-0x00000000752FB000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\ihgmqhbb.cmdline

MD5 4d88bf5dc3bd1a8fc5153a1d9f7bf406
SHA1 a170e9c988483e3e26f709907a002339092841ef
SHA256 5493cbda6b711c0ac322ae280d567d5aab33333ced74de9dafe42f64f010677d
SHA512 c068b30c1e24e887f1a6bc542998fe1ed694f9d8983a14ae0784c7de7f2700c0461c206524efb59c3fcdce39999cbba033d500229eb2baa36f4af814dbcbb5c4

\??\c:\Users\Admin\AppData\Local\Temp\tmp13F2.tmp.txt

MD5 6d6a9c939c4fbd3a0a5acf50fddd698a
SHA1 f939adfd1bf55acaa78183ce6a1a564038c1bf18
SHA256 43f3e409c96f4bc9da682ea2aad22d9b6620801be756bbca9c21461334e9f08b
SHA512 a29879fa44e672243fc87f3c85c304a50e5b295279b93ea746db3be1212f621657d50ca4bbb1c648190ebc073d106fb63ec9ffc991073333d6d98a90533f66e7

\??\c:\Users\Admin\AppData\Local\Temp\CSC147A.tmp

MD5 1322f7993537e544b4d20bc42b6cc184
SHA1 216fb57a1a49c36e30aab082b4a10b5976436bd8
SHA256 ad84d36ef3d5424bedce7e7f4e71945bb77192529e7b21655b17629c6004664c
SHA512 418697e21ffce5fe64247208153448550412f72e4f51a5f3850b2a5a03bc3fdff15a7abb0c96e9ae3422c6d4e9dd28d17b2adf4be6f52aaf480b64aad0405d80

memory/2520-28-0x0000000074D50000-0x00000000752FB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RES148B.tmp

MD5 eb42624af69f3e061f67ce53c3cef773
SHA1 5e9d30e464c67758d97c198126bad2c51f62c260
SHA256 0420e360c0b714a0e410017cd0ace4d2bc734b9561dc58587cca16f724b47876
SHA512 54f2a5ba42fd45e81c8cd903f12737dccfc31b0a07c86172d9d6a2e09863276a6a9c8ad252cd5832844d19e6cddee101a14852218ded6906558a9037f09b2248

C:\Users\Admin\AppData\Local\Temp\ihgmqhbb.dll

MD5 ee1d677c5edf5c691d55f6521765688e
SHA1 6f01f9f6d17b4f131bd1b0a15d8d9837574ac895
SHA256 fa3916ff5db2556c053d8f4d3919612c64e147a0fa9742c85a4c3aca4721398e
SHA512 579755361eb760a5d05ea7b6004f656e5ec6456e5ba5e48c525e307ff25034a1fc97a27c79a8dae0ee312b83a6905c0f5dac97959d80a91f713b951f1539f582

memory/2520-32-0x0000000074D50000-0x00000000752FB000-memory.dmp

memory/2436-35-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2436-37-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2436-39-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2436-42-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2436-45-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2436-51-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2436-49-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2436-44-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2436-53-0x0000000074D50000-0x00000000752FB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1738.tmp

MD5 42bc0023717e491e02198d0e8623120b
SHA1 dccfa7ee27ec1bcbab72caf9797cdf8573044b5a
SHA256 d5c63bc7fb2c21004ca5abcbfaf9082e5d03897835a0a8b4367f783d370d9b87
SHA512 911fafa162da9b984d075817bb0e00be6369839a260851bcea16b6b615145390558c9635c2f38b64a9ac9503c59fd6beb7b12c35c578173381c2d75299568e7d

C:\Users\Admin\AppData\Local\Temp\tmp17E5.tmp

MD5 0479d5f304ef2d7e3c15fb24a99f88c1
SHA1 8edbb1450a656fac5f5e96779ffe440ee8c1aec9
SHA256 112557c2b2d0c669a3b115129dc32f005341e965330fa8f2ad3e5de1926594bc
SHA512 537e8d87e5cd975f0e69bb145f81d6e9d7b0d82eed143ac351304ea38577137386a51fdb7357ec6d641eb04ff5f51e249bba2db8a4b5bf2934d561394a4a3f15

memory/2972-61-0x0000000074D50000-0x00000000752FB000-memory.dmp

memory/2436-62-0x0000000074D50000-0x00000000752FB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-16 13:45

Reported

2024-06-16 13:47

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sys-win32 = "C:\\Users\\Admin\\Documents\\Jvtiucby.exe" C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sys-win32 = "C:\\Users\\Admin\\Documents\\Jvtiucby.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMTP Subsystem = "C:\\Program Files (x86)\\SMTP Subsystem\\smtpss.exe" C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 380 set thread context of 3236 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\SMTP Subsystem\smtpss.exe C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\SMTP Subsystem\smtpss.exe C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 380 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 380 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 380 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 4936 wrote to memory of 4296 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4936 wrote to memory of 4296 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4936 wrote to memory of 4296 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 380 wrote to memory of 3236 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe
PID 380 wrote to memory of 3236 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe
PID 380 wrote to memory of 3236 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe
PID 380 wrote to memory of 3236 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe
PID 380 wrote to memory of 3236 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe
PID 380 wrote to memory of 3236 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe
PID 380 wrote to memory of 3236 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe
PID 380 wrote to memory of 3236 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe
PID 380 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 380 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 380 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2140 wrote to memory of 532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2140 wrote to memory of 532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2140 wrote to memory of 532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3236 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 3236 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 3236 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 3236 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 3236 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 3236 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\saxynhyy.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9C0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9BF.tmp"

C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b3cfebdcb947eb0e4535ae55139ed7f7_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "sys-win32" /t REG_SZ /d "C:\Users\Admin\Documents\Jvtiucby.exe

C:\Windows\SysWOW64\reg.exe

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "sys-win32" /t REG_SZ /d "C:\Users\Admin\Documents\Jvtiucby.exe

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "SMTP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1102.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "SMTP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp122C.tmp"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 customcheats.ddns.net udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 172.217.16.234:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 216.239.32.29:80 pki.goog tcp
US 8.8.8.8:53 234.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 29.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 customcheats.ddns.net udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 customcheats.ddns.net udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 customcheats.ddns.net udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 customcheats.ddns.net udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 customcheats.ddns.net udp
US 8.8.8.8:53 customcheats.ddns.net udp
US 8.8.8.8:53 216.131.50.23.in-addr.arpa udp
US 8.8.8.8:53 customcheats.ddns.net udp
US 8.8.8.8:53 customcheats.ddns.net udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 customcheats.ddns.net udp
US 8.8.8.8:53 customcheats.ddns.net udp
US 8.8.8.8:53 customcheats.ddns.net udp
US 8.8.8.8:53 customcheats.ddns.net udp
US 8.8.8.8:53 customcheats.ddns.net udp
US 8.8.8.8:53 customcheats.ddns.net udp
US 8.8.8.8:53 27.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 customcheats.ddns.net udp

Files

memory/380-0-0x0000000074DE2000-0x0000000074DE3000-memory.dmp

memory/380-1-0x0000000074DE0000-0x0000000075391000-memory.dmp

memory/380-2-0x0000000074DE0000-0x0000000075391000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\saxynhyy.cmdline

MD5 5ba5431548d75afa20217cff80f6af7c
SHA1 22c571966e3b9046a989d2240af9024939489b5d
SHA256 242a586b88404e8a3ba3d652f9943be34d5ba19324266cd5c2d311330f0cc4c8
SHA512 a254dc152ff314150a28ec567e8c4b3fb2e2bbcb5cce53532556adc83c497acf4719d4065540e6140eebfbe83bc2855711cc847c172100e7b3aac3334d558ad6

\??\c:\Users\Admin\AppData\Local\Temp\tmp589.tmp.txt

MD5 6d6a9c939c4fbd3a0a5acf50fddd698a
SHA1 f939adfd1bf55acaa78183ce6a1a564038c1bf18
SHA256 43f3e409c96f4bc9da682ea2aad22d9b6620801be756bbca9c21461334e9f08b
SHA512 a29879fa44e672243fc87f3c85c304a50e5b295279b93ea746db3be1212f621657d50ca4bbb1c648190ebc073d106fb63ec9ffc991073333d6d98a90533f66e7

memory/4936-13-0x0000000074DE0000-0x0000000075391000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\CSC9BF.tmp

MD5 1161ad963640292238f67a27844e4a7c
SHA1 70743adfacd3bb2cbf0f1f7df460dd4c785838bd
SHA256 d536620bb4a130b27b8810cc631b5878ffec8b32029c5ab031d9acc1ec275578
SHA512 6d2991758936f5075496a555663f57099ef8723ee360c7ff78dd9346a1b2975a117de3f16024a7b3c5ae966105d1b84a581b646f4e2a110440cf0b919750c493

C:\Users\Admin\AppData\Local\Temp\RES9C0.tmp

MD5 e972dee36cb45b6d909b8b7f610b53f2
SHA1 06fb7f5bb454522688c0b03f4dc5c84a569b5b67
SHA256 41f53976a7e671bc3a33b988d4818d91b70ba07aced4c76b5968a67e155a2557
SHA512 013912317416439edd34b5991be772b6d256cfbe1cfdbb0df41019c50032ea824c43452599f0ced88254a51ada21e356aa096ff65a8557c80413503596dc9ab4

memory/4936-20-0x0000000074DE0000-0x0000000075391000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\saxynhyy.dll

MD5 655794ea5757b5de139ec1e6b4a52ff8
SHA1 47522834b92686ce49eabc9d7f46bc7dd9017168
SHA256 22782ac885f35cffdbee970b13848edc1ea6ba6c6fec5842e59f5f185d43fc90
SHA512 090226e28565ad9164e6f9026e62f48bebbe486349d3247d3dd4e45dee175cc959b14be830cad3a11da8a22ff2f1dba8e2c19f538d1d117eda8719d2a75fe312

memory/3236-24-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3236-25-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3236-23-0x0000000000400000-0x0000000000424000-memory.dmp

memory/3236-28-0x0000000074DE0000-0x0000000075391000-memory.dmp

memory/3236-29-0x0000000074DE0000-0x0000000075391000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1102.tmp

MD5 42bc0023717e491e02198d0e8623120b
SHA1 dccfa7ee27ec1bcbab72caf9797cdf8573044b5a
SHA256 d5c63bc7fb2c21004ca5abcbfaf9082e5d03897835a0a8b4367f783d370d9b87
SHA512 911fafa162da9b984d075817bb0e00be6369839a260851bcea16b6b615145390558c9635c2f38b64a9ac9503c59fd6beb7b12c35c578173381c2d75299568e7d

C:\Users\Admin\AppData\Local\Temp\tmp122C.tmp

MD5 0339b45ef206f4becc88be0d65e24b9e
SHA1 6503a1851f4ccd8c80a31f96bd7ae40d962c9fad
SHA256 3d568a47a8944a47f4aed6982755ac7ff7dda469cc1c81c213ecaa5d89de1f83
SHA512 c98f4513db34d50510dd986e0d812545c442bd5bef26932032b165759627fab4e00c95fe907ab3416a8a1042bfa77aa516c479f1ff7d1ec2f21ae66df8f72551

memory/380-37-0x0000000074DE2000-0x0000000074DE3000-memory.dmp

memory/380-38-0x0000000074DE0000-0x0000000075391000-memory.dmp

memory/380-39-0x0000000074DE0000-0x0000000075391000-memory.dmp

memory/3236-40-0x0000000074DE0000-0x0000000075391000-memory.dmp