Malware Analysis Report

2024-10-16 06:46

Sample ID 240616-qz3wwsvgkd
Target b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118
SHA256 4ee01f54514aae11d011595f23e50dad0027f43bdd2261be3a758219759d3894
Tags
evasion persistence themida
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4ee01f54514aae11d011595f23e50dad0027f43bdd2261be3a758219759d3894

Threat Level: Known bad

The file b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

evasion persistence themida

Modifies WinLogon for persistence

Modifies Installed Components in the registry

Adds policy Run key to start application

Executes dropped EXE

Loads dropped DLL

Identifies Wine through registry keys

Themida packer

Modifies WinLogon

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

AutoIT Executable

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Runs net.exe

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-16 13:42

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-16 13:42

Reported

2024-06-16 13:45

Platform

win7-20240611-en

Max time kernel

150s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" C:\Windows\SysWOW64\fservice.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" C:\Windows\SysWOW64\fservice.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" C:\Windows\services.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" C:\Windows\SysWOW64\fservice.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\fservice.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" C:\Windows\SysWOW64\fservice.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\services.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" C:\Windows\services.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\fservice.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" C:\Windows\SysWOW64\fservice.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" C:\Windows\SysWOW64\fservice.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\fservice.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y} C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" C:\Windows\SysWOW64\fservice.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ C:\Windows\services.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ C:\Windows\SysWOW64\fservice.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ C:\Windows\SysWOW64\fservice.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" C:\Windows\services.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y} C:\Windows\SysWOW64\fservice.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" C:\Windows\SysWOW64\fservice.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y} C:\Windows\SysWOW64\fservice.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y} C:\Windows\SysWOW64\fservice.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ C:\Windows\SysWOW64\fservice.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" C:\Windows\SysWOW64\fservice.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\SOFTWARE\WINE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
Key opened \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Wine C:\Windows\SysWOW64\fservice.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Wine C:\Windows\SysWOW64\fservice.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Wine C:\Windows\SysWOW64\fservice.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\SOFTWARE\WINE C:\Windows\services.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Wine C:\Windows\services.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
Key opened \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\SOFTWARE\WINE C:\Windows\SysWOW64\fservice.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\SOFTWARE\WINE C:\Windows\SysWOW64\fservice.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Wine C:\Windows\SysWOW64\fservice.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Dmar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Dmar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Dmar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-GGU8A.tmp\SmartyUninstaller.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-GGU8A.tmp\SmartyUninstaller.tmp N/A
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Dmar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSURFP~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSURFP~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSURFP~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSURFP~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSURFP~1.EXE N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\Dmar.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ C:\Windows\SysWOW64\fservice.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ C:\Windows\SysWOW64\fservice.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ C:\Windows\SysWOW64\fservice.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ C:\Windows\services.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\fservice.exe-up.txt C:\Windows\SysWOW64\fservice.exe N/A
File opened for modification C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File created C:\Windows\SysWOW64\fservice.exe-up.txt C:\Windows\SysWOW64\fservice.exe N/A
File opened for modification C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File opened for modification C:\Windows\SysWOW64\fservice.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
File created C:\Windows\SysWOW64\fservice.exe-up.txt C:\Windows\SysWOW64\fservice.exe N/A
File created C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File created C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File created C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File created C:\Windows\SysWOW64\winkey.dll C:\Windows\services.exe N/A
File created C:\Windows\SysWOW64\fservice.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
File opened for modification C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File created C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File created C:\Windows\SysWOW64\fservice.exe-up.txt C:\Windows\SysWOW64\fservice.exe N/A
File created C:\Windows\SysWOW64\reginv.dll C:\Windows\services.exe N/A
File opened for modification C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File created C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Windows\services.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\system\sservice.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
File opened for modification C:\Windows\system\sservice.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
File created C:\Windows\system\sservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File created C:\Windows\system\sservice.exe C:\Windows\services.exe N/A
File created C:\Windows\services.exe C:\Windows\SysWOW64\fservice.exe N/A
File created C:\Windows\services.exe-up.txt C:\Windows\services.exe N/A
File opened for modification C:\Windows\system\sservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File created C:\Windows\system\sservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File opened for modification C:\Windows\system\sservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File opened for modification C:\Windows\services.exe C:\Windows\SysWOW64\fservice.exe N/A
File opened for modification C:\Windows\system\sservice.exe C:\Windows\services.exe N/A
File created C:\Windows\system\sservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File opened for modification C:\Windows\system\sservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File created C:\Windows\system\sservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File opened for modification C:\Windows\system\sservice.exe C:\Windows\SysWOW64\fservice.exe N/A

Enumerates physical storage devices

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-GGU8A.tmp\SmartyUninstaller.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSURFP~1.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2056 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Dmar.exe
PID 2056 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Dmar.exe
PID 2056 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Dmar.exe
PID 2056 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Dmar.exe
PID 2056 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Dmar.exe
PID 2056 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Dmar.exe
PID 2056 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Dmar.exe
PID 2056 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe
PID 2056 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe
PID 2056 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe
PID 2056 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe
PID 2056 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe
PID 2056 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe
PID 2056 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe
PID 2692 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe C:\Users\Admin\AppData\Local\Temp\is-GGU8A.tmp\SmartyUninstaller.tmp
PID 2692 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe C:\Users\Admin\AppData\Local\Temp\is-GGU8A.tmp\SmartyUninstaller.tmp
PID 2692 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe C:\Users\Admin\AppData\Local\Temp\is-GGU8A.tmp\SmartyUninstaller.tmp
PID 2692 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe C:\Users\Admin\AppData\Local\Temp\is-GGU8A.tmp\SmartyUninstaller.tmp
PID 2692 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe C:\Users\Admin\AppData\Local\Temp\is-GGU8A.tmp\SmartyUninstaller.tmp
PID 2692 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe C:\Users\Admin\AppData\Local\Temp\is-GGU8A.tmp\SmartyUninstaller.tmp
PID 2692 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe C:\Users\Admin\AppData\Local\Temp\is-GGU8A.tmp\SmartyUninstaller.tmp
PID 2608 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Dmar.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE
PID 2608 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Dmar.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE
PID 2608 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Dmar.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE
PID 2608 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Dmar.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE
PID 2608 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Dmar.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE
PID 2608 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Dmar.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE
PID 2608 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Dmar.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE
PID 2632 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE C:\Windows\SysWOW64\fservice.exe
PID 2632 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE C:\Windows\SysWOW64\fservice.exe
PID 2632 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE C:\Windows\SysWOW64\fservice.exe
PID 2632 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE C:\Windows\SysWOW64\fservice.exe
PID 2632 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE C:\Windows\SysWOW64\fservice.exe
PID 2632 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE C:\Windows\SysWOW64\fservice.exe
PID 2632 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE C:\Windows\SysWOW64\fservice.exe
PID 1500 wrote to memory of 2804 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe
PID 1500 wrote to memory of 2804 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe
PID 1500 wrote to memory of 2804 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe
PID 1500 wrote to memory of 2804 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe
PID 1500 wrote to memory of 2804 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe
PID 1500 wrote to memory of 2804 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe
PID 1500 wrote to memory of 2804 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe
PID 2804 wrote to memory of 1952 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe
PID 2804 wrote to memory of 1952 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe
PID 2804 wrote to memory of 1952 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe
PID 2804 wrote to memory of 1952 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe
PID 2804 wrote to memory of 1952 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe
PID 2804 wrote to memory of 1952 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe
PID 2804 wrote to memory of 1952 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe
PID 1952 wrote to memory of 1568 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe
PID 1952 wrote to memory of 1568 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe
PID 1952 wrote to memory of 1568 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe
PID 1952 wrote to memory of 1568 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe
PID 1952 wrote to memory of 1568 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe
PID 1952 wrote to memory of 1568 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe
PID 1952 wrote to memory of 1568 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe
PID 1568 wrote to memory of 2940 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe
PID 1568 wrote to memory of 2940 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe
PID 1568 wrote to memory of 2940 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe
PID 1568 wrote to memory of 2940 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe
PID 1568 wrote to memory of 2940 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe
PID 1568 wrote to memory of 2940 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe
PID 1568 wrote to memory of 2940 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe
PID 2940 wrote to memory of 1156 N/A C:\Windows\services.exe C:\Windows\SysWOW64\NET.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\Dmar.exe

C:\Users\Admin\AppData\Local\Temp/Dmar.exe

C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe

C:\Users\Admin\AppData\Local\Temp/SmartyUninstaller.exe

C:\Users\Admin\AppData\Local\Temp\is-GGU8A.tmp\SmartyUninstaller.tmp

"C:\Users\Admin\AppData\Local\Temp\is-GGU8A.tmp\SmartyUninstaller.tmp" /SL5="$90120,4017788,75776,C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE

C:\Windows\SysWOW64\fservice.exe

C:\Windows\system32\fservice.exe

C:\Windows\SysWOW64\fservice.exe

C:\Windows\system32\fservice.exe

C:\Windows\SysWOW64\fservice.exe

C:\Windows\system32\fservice.exe

C:\Windows\SysWOW64\fservice.exe

C:\Windows\system32\fservice.exe

C:\Windows\services.exe

C:\Windows\services.exe -XP

C:\Windows\SysWOW64\NET.exe

NET STOP srservice

C:\Windows\SysWOW64\NET.exe

NET STOP navapsvc

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 STOP srservice

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 STOP navapsvc

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSURFP~1.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSURFP~1.EXE

Network

Country Destination Domain Proto
US 8.8.8.8:53 dmar-07.tripod.com udp
US 209.202.252.105:80 dmar-07.tripod.com tcp

Files

memory/2056-0-0x0000000000400000-0x00000000004B5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Dmar.exe

MD5 3938cba9438cd40daab979bd9e81ce88
SHA1 f9cc27d6bfdd68285699ff027c7cf0bd8199c362
SHA256 9e13dde68a74d17cbf34cf7a1d5cd0e0559ce74f81030577448a9bc5e2aec5df
SHA512 ef7fac2a45bf720a0417e0044a63c930edc96f207edfb769abaa89d94b24c1a3c70528b5497a7a28fe1cb66409aaec027a31da686ecd551736383213cda8371b

memory/2692-21-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2692-24-0x0000000000401000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe

MD5 b24fa9644e9c09e9fca780d57653d84b
SHA1 dcecac4282771e3c798cac03b29ee743afc92411
SHA256 d3e0cee5db0ad8b47ba9ccebe6ff91cbfbeec0b747619862defd3bb1006ec218
SHA512 6d721ab0406d8e925c2e5cb46413e35289111c525c0beb4c13b5a13cdd08080e7022c050cb5156928992e6357a47b147b5aefadfe2f056ca6781e831998c1dea

C:\Users\Admin\AppData\Local\Temp\is-GGU8A.tmp\SmartyUninstaller.tmp

MD5 b64bb04bc9af1d71c0a0ed1c4047371a
SHA1 08ff8492ead3f4e63c5dcd7dd13ba97d62e1984b
SHA256 c7df91a6c0eec837f6b180e116cb251d045279566d57388b7e9ec195bddf30b5
SHA512 d9359d5c2cdbe8d7ea09d0deb48bf04870acbdc8e3554a4f625a2697e99c3a87a28b558efd56e9cf587398145b83c5e70b9198a9962c94eaff3dd1ce926a5777

\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE

MD5 f7b512e507d5348a95dc85e67c547afc
SHA1 dd4faf742f47b69748281d9ef45f675c56c69e8f
SHA256 fc376e297a5aa20f056d0f200700e038cb724d32166c74d6a7baea0e5bffb610
SHA512 146c75817eaf6763912283369be9a46be895011a2f5d484bc37f6593bb8a111db654c63b6d03a34bbc09280afffccb3ff6bae788ed6bdcb974a40dc01f95ec56

memory/2608-45-0x0000000003320000-0x00000000038FA000-memory.dmp

memory/2632-46-0x0000000000400000-0x00000000009DA000-memory.dmp

memory/2632-47-0x0000000001070000-0x000000000164A000-memory.dmp

memory/2608-48-0x0000000003320000-0x00000000038FA000-memory.dmp

\Windows\SysWOW64\fservice.exe

MD5 a74d6ec466ca70f058a3d33f68db54c9
SHA1 ff7460c6dbeccfae9812434589f355c0b69133f6
SHA256 8324f4e4c69150687aaa0d76e91c75215b4547fd027c76dff629b522e0cf626d
SHA512 9daca5564b9fb54f56712476a61bdab15be9c097fa1a45d0270570bde599f2382dfc15503b29c4892a85229b62f5db9db1dd8a65bb13e86cd6cc32ae6a598d8c

memory/2632-54-0x0000000005D30000-0x000000000630A000-memory.dmp

memory/2632-63-0x0000000005D30000-0x000000000630A000-memory.dmp

memory/1500-64-0x0000000000400000-0x00000000009DA000-memory.dmp

memory/1500-70-0x0000000005B90000-0x000000000616A000-memory.dmp

memory/2804-71-0x0000000001140000-0x000000000171A000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-6AULR.tmp\_isetup\_shfoldr.dll

MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

memory/2804-79-0x0000000000400000-0x00000000009DA000-memory.dmp

memory/2804-84-0x0000000005C30000-0x000000000620A000-memory.dmp

memory/1952-85-0x0000000000400000-0x00000000009DA000-memory.dmp

memory/1952-86-0x00000000011A0000-0x000000000177A000-memory.dmp

memory/1952-91-0x0000000005C90000-0x000000000626A000-memory.dmp

\Windows\SysWOW64\winkey.dll

MD5 43e7d9b875c921ba6be38d45540fb9dd
SHA1 f22a73fc0d4aa3ea6c0b8f61d974b028f308acc4
SHA256 f1b2b0abe844e6ba812c7f8709a463a7f6c56fa6ac38d376a0739cc3469f795b
SHA512 2e74e23c0875b69b82319391c392132f28f4eb45aa412805130382498ae48969a06a2b3a7528b626fa7d7ddb6b006f19f0ef8d73cf73cb9a0c0df44a21077622

\Windows\SysWOW64\reginv.dll

MD5 d4a3f90e159ffbcbc4f9740de4b7f171
SHA1 0542f5d1e2c23dca8d90766b3a8537dc3880e5c9
SHA256 2200dd5f83d2fb8c5d3994206a4fa9ff34b4cbfe56ed39a9a03c954cf45d8f77
SHA512 5493beb50b5f7d8ec52f32718d01696916ae173456005d0c1294ce695161ce5004aff58ee3892bf5db0f9b23720146a6d3ae8ffbcbbd81f84d894fdc8cf75a94

memory/1952-115-0x0000000000400000-0x00000000009DA000-memory.dmp

memory/2632-124-0x0000000000400000-0x00000000009DA000-memory.dmp

memory/1500-122-0x0000000000400000-0x00000000009DA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSURFP~1.EXE

MD5 d8063aa061c7933f07a060a5c40eaed3
SHA1 a9e963c294006cc3232ea402c74bfaacf88fa10b
SHA256 729eb605410cd02af76518f104f607f8fc9ee1251a51e02410d485b44e06e5b3
SHA512 aec39cdd330b796f6abb09cc3cb22994f5307ecc0bc7e6f3acdc151109cce47539d0092d891a18ad3fe8be803ab28016d7225bd9174e3e993d2cc5d53bf450a3

memory/1568-112-0x0000000000400000-0x00000000009DA000-memory.dmp

\Users\Admin\AppData\Local\Temp\nsjAB01.tmp\LangDLL.dll

MD5 8e806ea2e205dc508a2fb5adda3419db
SHA1 21beab4e309b139fdcca7dd708df8dbbfd2dd5a3
SHA256 86a55734b8802051bbbd0e8c9c506d0ca985bc5c99113e99b309469046133937
SHA512 6b362bdadd6801ceb6106485015a4ae6d227dc04c1397a730ac8fd44b00649876ee7cbd0d7690b41dcaa8451c94e9f5838daa9fbc21f7306740de89667468cc1

memory/2804-119-0x0000000000400000-0x00000000009DA000-memory.dmp

memory/2632-110-0x0000000000400000-0x00000000009DA000-memory.dmp

memory/2664-107-0x0000000000400000-0x00000000004BB000-memory.dmp

memory/2692-106-0x0000000000400000-0x000000000041A000-memory.dmp

\Users\Admin\AppData\Local\Temp\nsjAB01.tmp\System.dll

MD5 b9f430f71c7144d8ff4ab94be2785aa6
SHA1 c5c1e153caff7ad1d221a9acc8bbb831f05ccb05
SHA256 b496e81a74ce871236abcd096fb9a6b210b456bebaa7464fa844b3241e51a655
SHA512 c7ce431b6a1493fd7d1fe1b1c823ad22b582c43c8eb2fb6a471c648dd9df9953277c89932c66afd598d43ea36f4a8602e84cd175115266943071cbc8ce204099

\Users\Admin\AppData\Local\Temp\nsjAB01.tmp\nsDialogs.dll

MD5 7823fc560926dcd8741de6f0b900083f
SHA1 93dc0a704bc0b8f90668548e36daf459be0ae10a
SHA256 ca869d6c6752aa4a8a6c874a694b543442992d7e854d0c48a1b60bca01a8c8c6
SHA512 c79509cd306638ea9badec64ed9f7d0690e46fcab7ac77f25134065b628e76d2812f2d874ea2cc4283685c567b613a39d27b9fc4a6de2d4b9d30131f3161c4e9

memory/2940-151-0x0000000000400000-0x00000000009DA000-memory.dmp

memory/2940-155-0x0000000000400000-0x00000000009DA000-memory.dmp

memory/2940-157-0x0000000000400000-0x00000000009DA000-memory.dmp

memory/2940-160-0x0000000000400000-0x00000000009DA000-memory.dmp

memory/2940-163-0x0000000000400000-0x00000000009DA000-memory.dmp

memory/2940-167-0x0000000000400000-0x00000000009DA000-memory.dmp

memory/2940-169-0x0000000000400000-0x00000000009DA000-memory.dmp

memory/2940-172-0x0000000000400000-0x00000000009DA000-memory.dmp

memory/2940-175-0x0000000000400000-0x00000000009DA000-memory.dmp

memory/2940-178-0x0000000000400000-0x00000000009DA000-memory.dmp

memory/2940-181-0x0000000000400000-0x00000000009DA000-memory.dmp

memory/2940-184-0x0000000000400000-0x00000000009DA000-memory.dmp

memory/2940-187-0x0000000000400000-0x00000000009DA000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-16 13:42

Reported

2024-06-16 13:45

Platform

win10v2004-20240611-en

Max time kernel

143s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y} C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\WINE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
Key opened \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\Dmar.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\fservice.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
File opened for modification C:\Windows\SysWOW64\fservice.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\system\sservice.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
File opened for modification C:\Windows\system\sservice.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1644 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Dmar.exe
PID 1644 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Dmar.exe
PID 1644 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Dmar.exe
PID 1644 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe
PID 1644 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe
PID 1644 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe
PID 776 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe C:\Users\Admin\AppData\Local\Temp\is-C0MDV.tmp\SmartyUninstaller.tmp
PID 776 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe C:\Users\Admin\AppData\Local\Temp\is-C0MDV.tmp\SmartyUninstaller.tmp
PID 776 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe C:\Users\Admin\AppData\Local\Temp\is-C0MDV.tmp\SmartyUninstaller.tmp
PID 2112 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\Dmar.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE
PID 2112 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\Dmar.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE
PID 2112 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\Dmar.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE
PID 2112 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\Dmar.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSURFP~1.EXE
PID 2112 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\Dmar.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSURFP~1.EXE
PID 2112 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Local\Temp\Dmar.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSURFP~1.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b3cdd4862673adafc68ed0bf7714a013_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\Dmar.exe

C:\Users\Admin\AppData\Local\Temp/Dmar.exe

C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe

C:\Users\Admin\AppData\Local\Temp/SmartyUninstaller.exe

C:\Users\Admin\AppData\Local\Temp\is-C0MDV.tmp\SmartyUninstaller.tmp

"C:\Users\Admin\AppData\Local\Temp\is-C0MDV.tmp\SmartyUninstaller.tmp" /SL5="$501C8,4017788,75776,C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSURFP~1.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSURFP~1.EXE

Network

Country Destination Domain Proto
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

memory/1644-0-0x0000000000400000-0x00000000004B5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\aut345E.tmp

MD5 3938cba9438cd40daab979bd9e81ce88
SHA1 f9cc27d6bfdd68285699ff027c7cf0bd8199c362
SHA256 9e13dde68a74d17cbf34cf7a1d5cd0e0559ce74f81030577448a9bc5e2aec5df
SHA512 ef7fac2a45bf720a0417e0044a63c930edc96f207edfb769abaa89d94b24c1a3c70528b5497a7a28fe1cb66409aaec027a31da686ecd551736383213cda8371b

C:\Users\Admin\AppData\Local\Temp\SmartyUninstaller.exe

MD5 b24fa9644e9c09e9fca780d57653d84b
SHA1 dcecac4282771e3c798cac03b29ee743afc92411
SHA256 d3e0cee5db0ad8b47ba9ccebe6ff91cbfbeec0b747619862defd3bb1006ec218
SHA512 6d721ab0406d8e925c2e5cb46413e35289111c525c0beb4c13b5a13cdd08080e7022c050cb5156928992e6357a47b147b5aefadfe2f056ca6781e831998c1dea

memory/776-23-0x0000000000401000-0x000000000040B000-memory.dmp

memory/776-20-0x0000000000400000-0x000000000041A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-C0MDV.tmp\SmartyUninstaller.tmp

MD5 b64bb04bc9af1d71c0a0ed1c4047371a
SHA1 08ff8492ead3f4e63c5dcd7dd13ba97d62e1984b
SHA256 c7df91a6c0eec837f6b180e116cb251d045279566d57388b7e9ec195bddf30b5
SHA512 d9359d5c2cdbe8d7ea09d0deb48bf04870acbdc8e3554a4f625a2697e99c3a87a28b558efd56e9cf587398145b83c5e70b9198a9962c94eaff3dd1ce926a5777

memory/4316-29-0x0000000000400000-0x00000000004BB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TMSERV~1.EXE

MD5 f7b512e507d5348a95dc85e67c547afc
SHA1 dd4faf742f47b69748281d9ef45f675c56c69e8f
SHA256 fc376e297a5aa20f056d0f200700e038cb724d32166c74d6a7baea0e5bffb610
SHA512 146c75817eaf6763912283369be9a46be895011a2f5d484bc37f6593bb8a111db654c63b6d03a34bbc09280afffccb3ff6bae788ed6bdcb974a40dc01f95ec56

memory/2984-35-0x0000000000400000-0x00000000009DA000-memory.dmp

memory/2984-36-0x0000000000400000-0x00000000009DA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSURFP~1.EXE

MD5 d8063aa061c7933f07a060a5c40eaed3
SHA1 a9e963c294006cc3232ea402c74bfaacf88fa10b
SHA256 729eb605410cd02af76518f104f607f8fc9ee1251a51e02410d485b44e06e5b3
SHA512 aec39cdd330b796f6abb09cc3cb22994f5307ecc0bc7e6f3acdc151109cce47539d0092d891a18ad3fe8be803ab28016d7225bd9174e3e993d2cc5d53bf450a3

C:\Users\Admin\AppData\Local\Temp\nsh3EB1.tmp\LangDLL.dll

MD5 8e806ea2e205dc508a2fb5adda3419db
SHA1 21beab4e309b139fdcca7dd708df8dbbfd2dd5a3
SHA256 86a55734b8802051bbbd0e8c9c506d0ca985bc5c99113e99b309469046133937
SHA512 6b362bdadd6801ceb6106485015a4ae6d227dc04c1397a730ac8fd44b00649876ee7cbd0d7690b41dcaa8451c94e9f5838daa9fbc21f7306740de89667468cc1

C:\Users\Admin\AppData\Local\Temp\nsh3EB1.tmp\System.dll

MD5 b9f430f71c7144d8ff4ab94be2785aa6
SHA1 c5c1e153caff7ad1d221a9acc8bbb831f05ccb05
SHA256 b496e81a74ce871236abcd096fb9a6b210b456bebaa7464fa844b3241e51a655
SHA512 c7ce431b6a1493fd7d1fe1b1c823ad22b582c43c8eb2fb6a471c648dd9df9953277c89932c66afd598d43ea36f4a8602e84cd175115266943071cbc8ce204099

C:\Users\Admin\AppData\Local\Temp\nsh3EB1.tmp\nsDialogs.dll

MD5 7823fc560926dcd8741de6f0b900083f
SHA1 93dc0a704bc0b8f90668548e36daf459be0ae10a
SHA256 ca869d6c6752aa4a8a6c874a694b543442992d7e854d0c48a1b60bca01a8c8c6
SHA512 c79509cd306638ea9badec64ed9f7d0690e46fcab7ac77f25134065b628e76d2812f2d874ea2cc4283685c567b613a39d27b9fc4a6de2d4b9d30131f3161c4e9

memory/776-61-0x0000000000400000-0x000000000041A000-memory.dmp

memory/4316-62-0x0000000000400000-0x00000000004BB000-memory.dmp

memory/4316-69-0x0000000000400000-0x00000000004BB000-memory.dmp