Malware Analysis Report

2025-01-03 09:24

Sample ID 240620-rvlmgssdjd
Target 06d798549154c28be78ce9f4074585c9_JaffaCakes118
SHA256 ad9b48bb70a715e82d4a7c133101400c38c7efac78ae82738cbcaba81f6c58a9
Tags
bootkit persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

ad9b48bb70a715e82d4a7c133101400c38c7efac78ae82738cbcaba81f6c58a9

Threat Level: Shows suspicious behavior

The file 06d798549154c28be78ce9f4074585c9_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

bootkit persistence

Executes dropped EXE

Loads dropped DLL

Writes to the Master Boot Record (MBR)

Adds Run key to start application

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-20 14:30

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 14:30

Reported

2024-06-20 14:33

Platform

win7-20240611-en

Max time kernel

143s

Max time network

134s

Command Line

"C:\Users\Admin\AppData\Local\Temp\06d798549154c28be78ce9f4074585c9_JaffaCakes118.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE N/A
N/A N/A C:\Windows\wowmap.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\06d798549154c28be78ce9f4074585c9_JaffaCakes118.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE N/A
File opened for modification \??\PhysicalDrive0 C:\Windows\wowmap.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\2LIOS0X4.txt C:\Windows\wowmap.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\2LIOS0X4.txt C:\Windows\wowmap.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Windows\wowmap.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\GUOCYOKl.BAT C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE N/A
File created C:\Windows\wowmap.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE N/A
File opened for modification C:\Windows\wowmap.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" C:\Windows\wowmap.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad C:\Windows\wowmap.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{355B5DC4-8A01-4DEB-80FD-F65FDDBE239D}\WpadNetworkName = "Network 3" C:\Windows\wowmap.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Windows\wowmap.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\wowmap.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{355B5DC4-8A01-4DEB-80FD-F65FDDBE239D}\1a-47-e2-10-05-74 C:\Windows\wowmap.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-47-e2-10-05-74\WpadDecisionTime = f0f9b17d1ec3da01 C:\Windows\wowmap.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" C:\Windows\wowmap.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" C:\Windows\wowmap.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\wowmap.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\wowmap.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{355B5DC4-8A01-4DEB-80FD-F65FDDBE239D} C:\Windows\wowmap.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{355B5DC4-8A01-4DEB-80FD-F65FDDBE239D}\WpadDecisionReason = "1" C:\Windows\wowmap.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{355B5DC4-8A01-4DEB-80FD-F65FDDBE239D}\WpadDecision = "0" C:\Windows\wowmap.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-47-e2-10-05-74 C:\Windows\wowmap.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\wowmap.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\wowmap.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\wowmap.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\wowmap.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{355B5DC4-8A01-4DEB-80FD-F65FDDBE239D}\WpadDecisionTime = f0f9b17d1ec3da01 C:\Windows\wowmap.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-47-e2-10-05-74\WpadDecisionReason = "1" C:\Windows\wowmap.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-47-e2-10-05-74\WpadDecision = "0" C:\Windows\wowmap.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Windows\wowmap.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\wowmap.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\wowmap.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\wowmap.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2840 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\06d798549154c28be78ce9f4074585c9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE
PID 2840 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\06d798549154c28be78ce9f4074585c9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE
PID 2840 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\06d798549154c28be78ce9f4074585c9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE
PID 2840 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\06d798549154c28be78ce9f4074585c9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE
PID 2476 wrote to memory of 812 N/A C:\Windows\wowmap.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2476 wrote to memory of 812 N/A C:\Windows\wowmap.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2476 wrote to memory of 812 N/A C:\Windows\wowmap.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2476 wrote to memory of 812 N/A C:\Windows\wowmap.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 1712 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE C:\Windows\SysWOW64\cmd.exe
PID 1712 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE C:\Windows\SysWOW64\cmd.exe
PID 1712 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE C:\Windows\SysWOW64\cmd.exe
PID 1712 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\06d798549154c28be78ce9f4074585c9_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\06d798549154c28be78ce9f4074585c9_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE

C:\Windows\wowmap.exe

C:\Windows\wowmap.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

"C:\Program Files\Internet Explorer\IEXPLORE.EXE"

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Windows\GUOCYOKl.BAT

Network

Country Destination Domain Proto
US 8.8.8.8:53 free.7host05.com udp
NL 95.211.219.65:80 free.7host05.com tcp
NL 95.211.219.65:80 free.7host05.com tcp
NL 95.211.219.65:80 free.7host05.com tcp
NL 95.211.219.65:80 free.7host05.com tcp

Files

\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE

MD5 5956b1c78eaec57f148472e7066cedfe
SHA1 dbca650c8541ee49f1b5f3bd80047c75a0555ec3
SHA256 b38b59422075efcb463f44551b4e404a64530db264f2c2de7e451da5e32eaec7
SHA512 46b43493d8182f9c8411dc3c8209b1e03b90297dff41997313f84d7a4594ad099854cf0ba13743ef6225ebffaba3fca1c5d96ed1d3dc932a9d3143c9bc7eb69d

memory/2840-9-0x0000000000A10000-0x0000000000B04000-memory.dmp

memory/2840-8-0x0000000000A10000-0x0000000000B04000-memory.dmp

memory/1712-11-0x0000000000400000-0x00000000004F4000-memory.dmp

memory/1712-12-0x0000000001D60000-0x0000000001DA3000-memory.dmp

memory/1712-16-0x0000000001C90000-0x0000000001C91000-memory.dmp

memory/1712-15-0x00000000001D0000-0x00000000001D1000-memory.dmp

memory/1712-14-0x0000000000260000-0x0000000000261000-memory.dmp

memory/1712-13-0x0000000001CB0000-0x0000000001CB1000-memory.dmp

memory/1712-18-0x0000000001D50000-0x0000000001D53000-memory.dmp

memory/1712-17-0x0000000001D10000-0x0000000001D11000-memory.dmp

memory/1712-58-0x00000000025E0000-0x00000000025E1000-memory.dmp

memory/1712-57-0x00000000025F0000-0x00000000025F1000-memory.dmp

memory/1712-56-0x0000000002600000-0x0000000002601000-memory.dmp

memory/1712-55-0x00000000025C0000-0x00000000025C1000-memory.dmp

memory/1712-54-0x00000000025D0000-0x00000000025D1000-memory.dmp

memory/1712-53-0x00000000025A0000-0x00000000025A1000-memory.dmp

memory/1712-52-0x00000000025B0000-0x00000000025B1000-memory.dmp

memory/1712-51-0x0000000002580000-0x0000000002581000-memory.dmp

memory/1712-50-0x0000000002590000-0x0000000002591000-memory.dmp

memory/1712-49-0x0000000002560000-0x0000000002561000-memory.dmp

memory/1712-48-0x0000000002570000-0x0000000002571000-memory.dmp

memory/1712-47-0x0000000002540000-0x0000000002541000-memory.dmp

memory/1712-46-0x0000000002550000-0x0000000002551000-memory.dmp

memory/1712-45-0x0000000002520000-0x0000000002521000-memory.dmp

memory/1712-44-0x0000000002530000-0x0000000002531000-memory.dmp

memory/1712-43-0x0000000002500000-0x0000000002501000-memory.dmp

memory/1712-42-0x0000000002510000-0x0000000002511000-memory.dmp

memory/1712-41-0x00000000023E0000-0x00000000023E1000-memory.dmp

memory/1712-40-0x00000000023F0000-0x00000000023F1000-memory.dmp

memory/1712-39-0x00000000023C0000-0x00000000023C1000-memory.dmp

memory/1712-38-0x00000000023D0000-0x00000000023D1000-memory.dmp

memory/1712-37-0x00000000023A0000-0x00000000023A1000-memory.dmp

memory/1712-36-0x00000000023B0000-0x00000000023B1000-memory.dmp

memory/1712-35-0x0000000002380000-0x0000000002381000-memory.dmp

memory/1712-34-0x0000000002390000-0x0000000002391000-memory.dmp

memory/1712-33-0x0000000002360000-0x0000000002361000-memory.dmp

memory/1712-32-0x0000000002370000-0x0000000002371000-memory.dmp

memory/1712-31-0x0000000002340000-0x0000000002341000-memory.dmp

memory/1712-30-0x0000000002350000-0x0000000002351000-memory.dmp

memory/1712-29-0x0000000002010000-0x0000000002011000-memory.dmp

memory/1712-28-0x0000000002330000-0x0000000002331000-memory.dmp

memory/1712-27-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

memory/1712-26-0x0000000002000000-0x0000000002001000-memory.dmp

memory/1712-25-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

memory/1712-24-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

memory/1712-23-0x0000000001FA0000-0x0000000001FA1000-memory.dmp

memory/1712-22-0x0000000001D30000-0x0000000001D31000-memory.dmp

memory/1712-21-0x0000000001D20000-0x0000000001D21000-memory.dmp

memory/1712-20-0x0000000001F90000-0x0000000001F91000-memory.dmp

memory/1712-59-0x0000000002630000-0x0000000002631000-memory.dmp

memory/1712-62-0x0000000002640000-0x0000000002641000-memory.dmp

memory/1712-61-0x0000000002650000-0x0000000002651000-memory.dmp

memory/1712-60-0x0000000002620000-0x0000000002621000-memory.dmp

memory/1712-19-0x0000000001D40000-0x0000000001D41000-memory.dmp

memory/1712-77-0x00000000031B0000-0x00000000031B1000-memory.dmp

memory/1712-78-0x00000000031E0000-0x00000000031E1000-memory.dmp

memory/1712-91-0x00000000032B0000-0x00000000032B1000-memory.dmp

memory/1712-90-0x0000000003290000-0x0000000003291000-memory.dmp

memory/1712-89-0x0000000003270000-0x0000000003271000-memory.dmp

memory/1712-88-0x0000000003280000-0x0000000003281000-memory.dmp

memory/1712-87-0x0000000003250000-0x0000000003251000-memory.dmp

memory/1712-86-0x0000000003260000-0x0000000003261000-memory.dmp

memory/1712-85-0x0000000003230000-0x0000000003231000-memory.dmp

memory/1712-84-0x0000000003240000-0x0000000003241000-memory.dmp

memory/1712-83-0x0000000003210000-0x0000000003211000-memory.dmp

memory/1712-82-0x0000000003220000-0x0000000003221000-memory.dmp

memory/1712-81-0x00000000031F0000-0x00000000031F1000-memory.dmp

memory/1712-80-0x0000000003200000-0x0000000003201000-memory.dmp

memory/1712-79-0x00000000031D0000-0x00000000031D1000-memory.dmp

memory/1712-76-0x00000000031C0000-0x00000000031C1000-memory.dmp

memory/1712-71-0x00000000027E0000-0x00000000027E1000-memory.dmp

memory/1712-69-0x0000000002680000-0x0000000002681000-memory.dmp

memory/1712-66-0x0000000002670000-0x0000000002671000-memory.dmp

memory/1712-75-0x0000000003190000-0x0000000003191000-memory.dmp

memory/1712-74-0x00000000031A0000-0x00000000031A1000-memory.dmp

memory/1712-73-0x0000000003170000-0x0000000003171000-memory.dmp

memory/1712-72-0x0000000003180000-0x0000000003181000-memory.dmp

memory/1712-70-0x0000000003160000-0x0000000003161000-memory.dmp

memory/1712-68-0x0000000002690000-0x0000000002691000-memory.dmp

memory/1712-67-0x0000000002660000-0x0000000002661000-memory.dmp

memory/1712-97-0x00000000032E0000-0x00000000032E1000-memory.dmp

memory/1712-96-0x00000000032C0000-0x00000000032C1000-memory.dmp

memory/1712-95-0x00000000032A0000-0x00000000032A1000-memory.dmp

memory/1712-94-0x00000000032F0000-0x00000000032F1000-memory.dmp

memory/1712-93-0x0000000003300000-0x0000000003301000-memory.dmp

memory/1712-92-0x00000000032D0000-0x00000000032D1000-memory.dmp

memory/1712-99-0x0000000003310000-0x0000000003311000-memory.dmp

memory/1712-98-0x0000000003320000-0x0000000003321000-memory.dmp

memory/2476-101-0x0000000000400000-0x00000000004F4000-memory.dmp

memory/1712-102-0x0000000000400000-0x00000000004F4000-memory.dmp

memory/2476-104-0x0000000000290000-0x00000000002D3000-memory.dmp

memory/1712-103-0x0000000001D60000-0x0000000001DA3000-memory.dmp

C:\Windows\GUOCYOKl.BAT

MD5 f76abc9f135f91db5e13f4f0e6e9c4c9
SHA1 6a92d6d71946eb32f50f350b65313e495630d0ce
SHA256 87d2a6832c8431fac2a0cb3661ad3bb85c078754480b7b4c5087dfa6e476b448
SHA512 e2ec636ea8f48f9e7918260274cc528d530198f91b070cbf324bf1e84d11e56102388d071c5fbe7982cf1ef42b571476a06e2368dcdc8a50fcc3adf029b3e8a5

memory/1712-115-0x0000000001D60000-0x0000000001DA3000-memory.dmp

memory/1712-114-0x0000000000400000-0x00000000004F4000-memory.dmp

memory/2476-119-0x0000000000400000-0x00000000004F4000-memory.dmp

memory/2476-121-0x0000000000290000-0x00000000002D3000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 14:30

Reported

2024-06-20 14:33

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\06d798549154c28be78ce9f4074585c9_JaffaCakes118.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE N/A
N/A N/A C:\Windows\wowmap.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\06d798549154c28be78ce9f4074585c9_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\wowmap.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE N/A
File opened for modification C:\Windows\wowmap.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE N/A
File created C:\Windows\GUOCYOKl.BAT C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\wowmap.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\wowmap.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\wowmap.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\wowmap.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\wowmap.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\wowmap.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\wowmap.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\06d798549154c28be78ce9f4074585c9_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\06d798549154c28be78ce9f4074585c9_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE

C:\Windows\wowmap.exe

C:\Windows\wowmap.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

"C:\Program Files\Internet Explorer\IEXPLORE.EXE"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Windows\GUOCYOKl.BAT

Network

Country Destination Domain Proto
US 8.8.8.8:53 free.7host05.com udp
US 8.8.8.8:53 free.7host05.com udp
US 8.8.8.8:53 free.7host05.com udp
US 8.8.8.8:53 free.7host05.com udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE

MD5 5956b1c78eaec57f148472e7066cedfe
SHA1 dbca650c8541ee49f1b5f3bd80047c75a0555ec3
SHA256 b38b59422075efcb463f44551b4e404a64530db264f2c2de7e451da5e32eaec7
SHA512 46b43493d8182f9c8411dc3c8209b1e03b90297dff41997313f84d7a4594ad099854cf0ba13743ef6225ebffaba3fca1c5d96ed1d3dc932a9d3143c9bc7eb69d

memory/3044-5-0x0000000000400000-0x00000000004F4000-memory.dmp

memory/3044-8-0x00000000007D0000-0x00000000007D1000-memory.dmp

memory/3044-51-0x00000000029B0000-0x00000000029B1000-memory.dmp

memory/3044-50-0x00000000029D0000-0x00000000029D1000-memory.dmp

memory/3044-49-0x00000000029E0000-0x00000000029E1000-memory.dmp

memory/3044-48-0x00000000029A0000-0x00000000029A1000-memory.dmp

memory/3044-47-0x0000000002850000-0x0000000002851000-memory.dmp

memory/3044-46-0x0000000002860000-0x0000000002861000-memory.dmp

memory/3044-45-0x0000000002830000-0x0000000002831000-memory.dmp

memory/3044-44-0x0000000002840000-0x0000000002841000-memory.dmp

memory/3044-43-0x0000000002810000-0x0000000002811000-memory.dmp

memory/3044-42-0x0000000002820000-0x0000000002821000-memory.dmp

memory/3044-41-0x00000000027E0000-0x00000000027E1000-memory.dmp

memory/3044-40-0x00000000027F0000-0x00000000027F1000-memory.dmp

memory/3044-39-0x00000000027C0000-0x00000000027C1000-memory.dmp

memory/3044-38-0x00000000027D0000-0x00000000027D1000-memory.dmp

memory/3044-37-0x00000000027A0000-0x00000000027A1000-memory.dmp

memory/3044-36-0x00000000027B0000-0x00000000027B1000-memory.dmp

memory/3044-35-0x0000000002680000-0x0000000002681000-memory.dmp

memory/3044-34-0x0000000002690000-0x0000000002691000-memory.dmp

memory/3044-33-0x0000000002660000-0x0000000002661000-memory.dmp

memory/3044-32-0x0000000002670000-0x0000000002671000-memory.dmp

memory/3044-31-0x0000000002640000-0x0000000002641000-memory.dmp

memory/3044-30-0x0000000002650000-0x0000000002651000-memory.dmp

memory/3044-29-0x0000000002620000-0x0000000002621000-memory.dmp

memory/3044-28-0x0000000002630000-0x0000000002631000-memory.dmp

memory/3044-27-0x0000000002600000-0x0000000002601000-memory.dmp

memory/3044-26-0x0000000002610000-0x0000000002611000-memory.dmp

memory/3044-25-0x00000000025E0000-0x00000000025E1000-memory.dmp

memory/3044-24-0x00000000025F0000-0x00000000025F1000-memory.dmp

memory/3044-23-0x00000000025C0000-0x00000000025C1000-memory.dmp

memory/3044-22-0x00000000025D0000-0x00000000025D1000-memory.dmp

memory/3044-21-0x0000000002590000-0x0000000002591000-memory.dmp

memory/3044-20-0x00000000025A0000-0x00000000025A1000-memory.dmp

memory/3044-19-0x0000000002570000-0x0000000002571000-memory.dmp

memory/3044-18-0x0000000002580000-0x0000000002581000-memory.dmp

memory/3044-17-0x0000000002540000-0x0000000002541000-memory.dmp

memory/3044-16-0x0000000002500000-0x0000000002501000-memory.dmp

memory/3044-15-0x00000000024F0000-0x00000000024F1000-memory.dmp

memory/3044-14-0x0000000002530000-0x0000000002531000-memory.dmp

memory/3044-13-0x0000000002510000-0x0000000002511000-memory.dmp

memory/3044-12-0x0000000002520000-0x0000000002523000-memory.dmp

memory/3044-11-0x00000000024E0000-0x00000000024E1000-memory.dmp

memory/3044-10-0x0000000002390000-0x0000000002391000-memory.dmp

memory/3044-9-0x00000000007C0000-0x00000000007C1000-memory.dmp

memory/3044-7-0x00000000024C0000-0x00000000024C1000-memory.dmp

memory/3044-6-0x0000000002300000-0x0000000002343000-memory.dmp

memory/3044-90-0x0000000002F70000-0x0000000002F71000-memory.dmp

memory/3044-89-0x0000000002F50000-0x0000000002F51000-memory.dmp

memory/3044-88-0x0000000002F60000-0x0000000002F61000-memory.dmp

memory/3044-87-0x0000000002F40000-0x0000000002F41000-memory.dmp

memory/3044-86-0x0000000002F20000-0x0000000002F21000-memory.dmp

memory/3044-85-0x0000000002F30000-0x0000000002F31000-memory.dmp

memory/3044-84-0x0000000002F00000-0x0000000002F01000-memory.dmp

memory/3044-83-0x0000000002F10000-0x0000000002F11000-memory.dmp

memory/3044-82-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

memory/3044-81-0x0000000002EF0000-0x0000000002EF1000-memory.dmp

memory/3044-80-0x0000000002EC0000-0x0000000002EC1000-memory.dmp

memory/3044-79-0x0000000002ED0000-0x0000000002ED1000-memory.dmp

memory/3044-78-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

memory/3044-77-0x0000000002EB0000-0x0000000002EB1000-memory.dmp

memory/3044-76-0x0000000002E80000-0x0000000002E81000-memory.dmp

memory/3044-75-0x0000000002E90000-0x0000000002E91000-memory.dmp

memory/3044-74-0x0000000002E60000-0x0000000002E61000-memory.dmp

memory/3044-73-0x0000000002E70000-0x0000000002E71000-memory.dmp

memory/3044-72-0x0000000002E40000-0x0000000002E41000-memory.dmp

memory/3044-71-0x0000000002E50000-0x0000000002E51000-memory.dmp

memory/3044-70-0x0000000002E20000-0x0000000002E21000-memory.dmp

memory/3044-69-0x0000000002E30000-0x0000000002E31000-memory.dmp

memory/3044-68-0x0000000002E00000-0x0000000002E01000-memory.dmp

memory/3044-67-0x0000000002E10000-0x0000000002E11000-memory.dmp

memory/3044-66-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

memory/3044-65-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

memory/3044-64-0x0000000002A80000-0x0000000002A81000-memory.dmp

memory/3044-63-0x0000000002A90000-0x0000000002A91000-memory.dmp

memory/3044-62-0x0000000002A60000-0x0000000002A61000-memory.dmp

memory/3044-61-0x0000000002A70000-0x0000000002A71000-memory.dmp

memory/3044-60-0x0000000002A40000-0x0000000002A41000-memory.dmp

memory/3044-59-0x0000000002A50000-0x0000000002A51000-memory.dmp

memory/3044-58-0x0000000002A20000-0x0000000002A21000-memory.dmp

memory/3044-57-0x0000000002A30000-0x0000000002A31000-memory.dmp

memory/3044-56-0x0000000002A00000-0x0000000002A01000-memory.dmp

memory/3044-55-0x0000000002A10000-0x0000000002A11000-memory.dmp

memory/3044-54-0x00000000029C0000-0x00000000029C1000-memory.dmp

memory/3044-92-0x0000000002F80000-0x0000000002F81000-memory.dmp

memory/3044-91-0x0000000002F90000-0x0000000002F91000-memory.dmp

memory/4736-95-0x0000000000820000-0x0000000000863000-memory.dmp

memory/3044-98-0x0000000000400000-0x00000000004F4000-memory.dmp

memory/3044-99-0x0000000002300000-0x0000000002343000-memory.dmp

C:\Windows\GUOCYOKl.BAT

MD5 f76abc9f135f91db5e13f4f0e6e9c4c9
SHA1 6a92d6d71946eb32f50f350b65313e495630d0ce
SHA256 87d2a6832c8431fac2a0cb3661ad3bb85c078754480b7b4c5087dfa6e476b448
SHA512 e2ec636ea8f48f9e7918260274cc528d530198f91b070cbf324bf1e84d11e56102388d071c5fbe7982cf1ef42b571476a06e2368dcdc8a50fcc3adf029b3e8a5

memory/4736-101-0x0000000000400000-0x00000000004F4000-memory.dmp

memory/4736-102-0x0000000000400000-0x00000000004F4000-memory.dmp

memory/4736-103-0x0000000000820000-0x0000000000863000-memory.dmp

memory/4736-107-0x0000000000400000-0x00000000004F4000-memory.dmp