Malware Analysis Report

2024-08-06 14:44

Sample ID 240622-vgq7lavgkg
Target 030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118
SHA256 cc639b3020aa0456adfa4fd5377a9516785177f4ce390ec0f879b057232da189
Tags
nanocore evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

cc639b3020aa0456adfa4fd5377a9516785177f4ce390ec0f879b057232da189

Threat Level: Known bad

The file 030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger persistence spyware stealer trojan

NanoCore

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Drops file in Program Files directory

Program crash

Unsigned PE

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-22 16:57

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-22 16:57

Reported

2024-06-22 17:00

Platform

win7-20240508-en

Max time kernel

145s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ARP Host = "C:\\Program Files (x86)\\ARP Host\\arphost.exe" C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2232 set thread context of 2032 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\ARP Host\arphost.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\ARP Host\arphost.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2232 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe
PID 2232 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe
PID 2232 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe
PID 2232 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe
PID 2232 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe
PID 2232 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe
PID 2232 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe
PID 2232 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe
PID 2232 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe
PID 2032 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2032 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2032 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2032 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2032 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2032 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2032 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2032 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2232 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Windows\SysWOW64\WerFault.exe
PID 2232 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Windows\SysWOW64\WerFault.exe
PID 2232 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Windows\SysWOW64\WerFault.exe
PID 2232 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "ARP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp26E2.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "ARP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp280B.tmp"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 1996

Network

Country Destination Domain Proto
US 8.8.8.8:53 hz.instapoller.info udp
US 8.8.8.8:53 rocketx.fun udp
US 8.8.4.4:53 hz.instapoller.info udp
US 8.8.8.8:53 hz.instapoller.info udp
US 8.8.8.8:53 hz.instapoller.info udp
US 8.8.4.4:53 hz.instapoller.info udp
US 8.8.8.8:53 hz.instapoller.info udp
US 8.8.8.8:53 hz.instapoller.info udp
US 8.8.4.4:53 hz.instapoller.info udp
US 8.8.8.8:53 hz.instapoller.info udp
US 8.8.8.8:53 hz.instapoller.info udp
US 8.8.4.4:53 hz.instapoller.info udp
US 8.8.8.8:53 hz.instapoller.info udp

Files

memory/2232-0-0x0000000073F1E000-0x0000000073F1F000-memory.dmp

memory/2232-1-0x0000000000E10000-0x0000000000F50000-memory.dmp

memory/2032-2-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2032-12-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2032-10-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2032-8-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2032-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2032-5-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2032-4-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2032-3-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2032-13-0x0000000073F10000-0x00000000745FE000-memory.dmp

memory/2232-15-0x0000000073F10000-0x00000000745FE000-memory.dmp

memory/2032-17-0x0000000073F10000-0x00000000745FE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp26E2.tmp

MD5 b95f34f11d793e63efe61fa1841e5a23
SHA1 717ae476eb628039a2dd40ecc7dd5862e928b117
SHA256 91b84cdc397a04f44f47fc251ea82f17868e8acf6c51c82e9f5e96b62d67e18a
SHA512 f29bf9226dabfffb40b170f23a4a3ffedb4ef87af230d6b04473bde087b4b135bbf335b4dff3ded8dc806b7cd97ae02a92c314909c276213fb084996bb4f1e8f

C:\Users\Admin\AppData\Local\Temp\tmp280B.tmp

MD5 447ab194ab36cb1d20078d80e502b1b2
SHA1 a947b3b2c91d7c50bb8d39bd4fc91a0d0cc5b1c0
SHA256 8d5304b20b7d7dea223ce2738e5668054250d57bf6bed86b305b69924bd472f5
SHA512 49ddc557f7f6635627eea9bf0fa12a14b7b13edb235ed560ee0044a7f87fe27b686ff878d347d0273d92eb0b318b8c2bca85c0fbf42d586ed7d7da39eac6a327

memory/2032-23-0x0000000000470000-0x000000000047A000-memory.dmp

memory/2032-24-0x0000000000BC0000-0x0000000000BDE000-memory.dmp

memory/2032-25-0x00000000005C0000-0x00000000005CA000-memory.dmp

memory/2232-26-0x0000000073F1E000-0x0000000073F1F000-memory.dmp

memory/2032-27-0x0000000073F10000-0x00000000745FE000-memory.dmp

memory/2232-28-0x0000000073F10000-0x00000000745FE000-memory.dmp

memory/2032-29-0x0000000073F10000-0x00000000745FE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-22 16:57

Reported

2024-06-22 17:00

Platform

win10v2004-20240508-en

Max time kernel

93s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Host = "C:\\Program Files (x86)\\DDP Host\\ddphost.exe" C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2816 set thread context of 4880 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\DDP Host\ddphost.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\DDP Host\ddphost.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2816 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe
PID 2816 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe
PID 2816 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe
PID 2816 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe
PID 2816 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe
PID 2816 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe
PID 2816 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe
PID 2816 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe
PID 4880 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 4880 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 4880 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 4880 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 4880 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 4880 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\030dc8219015d70f0c7dfcedc33b2220_JaffaCakes118.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2816 -ip 2816

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DDP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp50EF.tmp"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 3936

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DDP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5322.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 rocketx.fun udp
US 76.76.21.164:80 rocketx.fun tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 164.21.76.76.in-addr.arpa udp
US 8.8.8.8:53 hz.instapoller.info udp
US 199.59.243.226:8888 hz.instapoller.info tcp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 226.243.59.199.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
IE 52.111.236.23:443 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/2816-0-0x00000000746CE000-0x00000000746CF000-memory.dmp

memory/2816-1-0x0000000000ED0000-0x0000000001010000-memory.dmp

memory/2816-2-0x0000000005E80000-0x0000000006424000-memory.dmp

memory/4880-3-0x0000000000400000-0x0000000000438000-memory.dmp

memory/4880-5-0x00000000746C0000-0x0000000074E70000-memory.dmp

memory/4880-4-0x00000000057C0000-0x0000000005852000-memory.dmp

memory/4880-6-0x0000000005860000-0x00000000058FC000-memory.dmp

memory/2816-7-0x00000000746C0000-0x0000000074E70000-memory.dmp

memory/4880-8-0x0000000005780000-0x000000000578A000-memory.dmp

memory/4880-9-0x00000000746C0000-0x0000000074E70000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp50EF.tmp

MD5 b95f34f11d793e63efe61fa1841e5a23
SHA1 717ae476eb628039a2dd40ecc7dd5862e928b117
SHA256 91b84cdc397a04f44f47fc251ea82f17868e8acf6c51c82e9f5e96b62d67e18a
SHA512 f29bf9226dabfffb40b170f23a4a3ffedb4ef87af230d6b04473bde087b4b135bbf335b4dff3ded8dc806b7cd97ae02a92c314909c276213fb084996bb4f1e8f

C:\Users\Admin\AppData\Local\Temp\tmp5322.tmp

MD5 2271642ca970891700e3f48439739ed8
SHA1 cd472df2349f7db9e1e460d0ee28acd97b8a8793
SHA256 7aba66abbcb0b13455609174db23aed495a9adbef0e0acd28baa9c92445eda68
SHA512 4669a4ef8ec28cdb852ffc1401576b1bf9a9d837797d7d92bc88c18b3097404f36854e50167b309706fef400cabc43c876569ce2797ba85eb169a2783b8fe807

memory/4880-17-0x0000000006830000-0x000000000683A000-memory.dmp

memory/4880-18-0x00000000068C0000-0x00000000068DE000-memory.dmp

memory/4880-19-0x0000000006A00000-0x0000000006A0A000-memory.dmp

memory/2816-20-0x00000000746C0000-0x0000000074E70000-memory.dmp

memory/4880-21-0x00000000746C0000-0x0000000074E70000-memory.dmp

memory/4880-22-0x00000000746C0000-0x0000000074E70000-memory.dmp