Malware Analysis Report

2025-01-03 09:07

Sample ID 240620-l1gmts1fna
Target 04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118
SHA256 8de5f43a095574772166b89af93dbaf9af5176d8c3d95b62705be868ec9fd621
Tags
bootkit evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8de5f43a095574772166b89af93dbaf9af5176d8c3d95b62705be868ec9fd621

Threat Level: Known bad

The file 04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

bootkit evasion persistence

Modifies firewall policy service

Adds policy Run key to start application

Boot or Logon Autostart Execution: Active Setup

Adds Run key to start application

Writes to the Master Boot Record (MBR)

Suspicious use of SetThreadContext

Unsigned PE

Modifies registry key

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-20 09:59

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 09:59

Reported

2024-06-20 10:02

Platform

win7-20240611-en

Max time kernel

148s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\MDQO2V8RMY.exe = "C:\\Users\\Admin\\AppData\\Roaming\\MDQO2V8RMY.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Adobe = "C:\\Users\\Admin\\AppData\\Roaming\\MDQO2V8RMY.exe" C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FD3CA27D-7BAB-DADB-BEAC-34CBBDFBED4D} C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FD3CA27D-7BAB-DADB-BEAC-34CBBDFBED4D}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\MDQO2V8RMY.exe" C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{FD3CA27D-7BAB-DADB-BEAC-34CBBDFBED4D} C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Active Setup\Installed Components\{FD3CA27D-7BAB-DADB-BEAC-34CBBDFBED4D}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\MDQO2V8RMY.exe" C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe = "C:\\Users\\Admin\\AppData\\Roaming\\MDQO2V8RMY.exe" C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe = "C:\\Users\\Admin\\AppData\\Roaming\\MDQO2V8RMY.exe" C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2488 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 2488 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 2488 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 2488 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 2488 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 2488 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 2488 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 2488 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 2488 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 2056 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 2056 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 2056 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 2056 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 2056 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 2056 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 2056 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 2056 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 2716 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3016 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3016 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3016 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2728 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2728 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2728 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2728 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2604 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2604 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2604 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2604 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2864 wrote to memory of 2584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2864 wrote to memory of 2584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2864 wrote to memory of 2584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2864 wrote to memory of 2584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\MDQO2V8RMY.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\MDQO2V8RMY.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\MDQO2V8RMY.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\MDQO2V8RMY.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 123.no-ip.info udp
US 8.8.8.8:53 1123.no-ip.info udp
US 8.8.8.8:53 2123.no-ip.info udp
US 8.8.8.8:53 3123.no-ip.info udp
ES 94.73.33.36:3080 3123.no-ip.info tcp
US 8.8.8.8:53 4123.no-ip.info udp
US 8.8.8.8:53 5123.no-ip.info udp
US 8.8.8.8:53 6123.no-ip.info udp
US 8.8.8.8:53 7123.no-ip.info udp
US 78.159.140.203:3080 7123.no-ip.info tcp
US 8.8.8.8:53 8123.no-ip.info udp

Files

memory/2488-0-0x0000000000400000-0x00000000004AD000-memory.dmp

memory/2056-7-0x0000000000400000-0x0000000000474000-memory.dmp

memory/2056-5-0x0000000000400000-0x0000000000474000-memory.dmp

memory/2056-13-0x0000000000400000-0x0000000000474000-memory.dmp

memory/2056-16-0x0000000000400000-0x0000000000474000-memory.dmp

memory/2056-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2056-3-0x0000000000400000-0x0000000000474000-memory.dmp

memory/2716-21-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2716-19-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2716-23-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2716-33-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2056-32-0x0000000000400000-0x0000000000474000-memory.dmp

memory/2716-39-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2716-40-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2716-41-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2716-42-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2716-44-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2716-45-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2716-48-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2716-49-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2716-50-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2716-52-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2716-53-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2716-54-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2716-56-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2716-57-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2716-58-0x0000000000400000-0x0000000000470000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 09:59

Reported

2024-06-20 10:02

Platform

win10v2004-20240611-en

Max time kernel

148s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\MDQO2V8RMY.exe = "C:\\Users\\Admin\\AppData\\Roaming\\MDQO2V8RMY.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Adobe = "C:\\Users\\Admin\\AppData\\Roaming\\MDQO2V8RMY.exe" C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD3CA27D-7BAB-DADB-BEAC-34CBBDFBED4D}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\MDQO2V8RMY.exe" C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{FD3CA27D-7BAB-DADB-BEAC-34CBBDFBED4D} C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{FD3CA27D-7BAB-DADB-BEAC-34CBBDFBED4D}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\MDQO2V8RMY.exe" C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD3CA27D-7BAB-DADB-BEAC-34CBBDFBED4D} C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe = "C:\\Users\\Admin\\AppData\\Roaming\\MDQO2V8RMY.exe" C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe = "C:\\Users\\Admin\\AppData\\Roaming\\MDQO2V8RMY.exe" C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1724 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 1724 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 1724 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 1724 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 1724 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 1724 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 1724 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 1724 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 1300 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 1300 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 1300 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 1300 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 1300 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 1300 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 1300 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 1300 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe
PID 5012 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2068 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2068 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2068 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3516 wrote to memory of 3968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3516 wrote to memory of 3968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3516 wrote to memory of 3968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2876 wrote to memory of 4440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2876 wrote to memory of 4440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2876 wrote to memory of 4440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5008 wrote to memory of 952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5008 wrote to memory of 952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5008 wrote to memory of 952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\MDQO2V8RMY.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\MDQO2V8RMY.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\MDQO2V8RMY.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\MDQO2V8RMY.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\04f785bd8dd89d747231999af9e4fcd6_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
NL 23.62.61.152:443 www.bing.com tcp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 152.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 123.no-ip.info udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 123.no-ip.info udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 1123.no-ip.info udp
US 8.8.8.8:53 2123.no-ip.info udp
US 8.8.8.8:53 97.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 3123.no-ip.info udp
ES 94.73.33.36:3080 3123.no-ip.info tcp
US 8.8.8.8:53 4123.no-ip.info udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 5123.no-ip.info udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 6123.no-ip.info udp
US 8.8.8.8:53 7123.no-ip.info udp
US 78.159.140.203:3080 7123.no-ip.info tcp
US 8.8.8.8:53 8123.no-ip.info udp
US 8.8.8.8:53 171.117.168.52.in-addr.arpa udp

Files

memory/1724-0-0x0000000000400000-0x00000000004AD000-memory.dmp

memory/1300-3-0x0000000000400000-0x0000000000474000-memory.dmp

memory/1300-5-0x0000000000400000-0x0000000000474000-memory.dmp

memory/5012-8-0x0000000000400000-0x0000000000470000-memory.dmp

memory/5012-11-0x0000000000400000-0x0000000000470000-memory.dmp

memory/1300-16-0x0000000000400000-0x0000000000474000-memory.dmp

memory/5012-20-0x0000000000400000-0x0000000000470000-memory.dmp

memory/5012-21-0x0000000000400000-0x0000000000470000-memory.dmp

memory/5012-24-0x0000000000400000-0x0000000000470000-memory.dmp

memory/5012-28-0x0000000000400000-0x0000000000470000-memory.dmp

memory/5012-33-0x0000000000400000-0x0000000000470000-memory.dmp

memory/5012-40-0x0000000000400000-0x0000000000470000-memory.dmp

memory/5012-43-0x0000000000400000-0x0000000000470000-memory.dmp

memory/5012-46-0x0000000000400000-0x0000000000470000-memory.dmp

memory/5012-50-0x0000000000400000-0x0000000000470000-memory.dmp

memory/5012-56-0x0000000000400000-0x0000000000470000-memory.dmp

memory/5012-60-0x0000000000400000-0x0000000000470000-memory.dmp

memory/5012-63-0x0000000000400000-0x0000000000470000-memory.dmp