Malware Analysis Report

2024-10-23 20:50

Sample ID 240623-p41fws1cpa
Target 061a8d9824446f45d5112cbdd803f173_JaffaCakes118
SHA256 da61cd60682f6d7b95972d59830d9ac6d39690d1de4047f4768b0bfc572b78fa
Tags
njrat pwtknew1 evasion persistence privilege_escalation trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

da61cd60682f6d7b95972d59830d9ac6d39690d1de4047f4768b0bfc572b78fa

Threat Level: Known bad

The file 061a8d9824446f45d5112cbdd803f173_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

njrat pwtknew1 evasion persistence privilege_escalation trojan

njRAT/Bladabindi

Modifies Windows Firewall

Loads dropped DLL

Drops startup file

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Event Triggered Execution: Netsh Helper DLL

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-23 12:53

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-23 12:53

Reported

2024-06-23 12:56

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\pwtk.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\25181c9f909bd4441f2b53785cd683a2.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\25181c9f909bd4441f2b53785cd683a2.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\25181c9f909bd4441f2b53785cd683a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\javaupdate.exe\" .." C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\25181c9f909bd4441f2b53785cd683a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\javaupdate.exe\" .." C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\huecheats.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4088 set thread context of 2648 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 1880 set thread context of 1480 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\huecheats.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\huecheats.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\huecheats.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\huecheats.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\huecheats.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\huecheats.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\huecheats.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2064 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 2064 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 2064 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 2064 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\huecheats.exe
PID 2064 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\huecheats.exe
PID 4088 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 4088 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 4088 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 4088 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 4088 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 4088 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 4088 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 4088 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 2648 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 2648 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 2648 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 1880 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 1880 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 1880 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 1880 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 1880 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 1880 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 1880 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 1880 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 1480 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Windows\SysWOW64\netsh.exe
PID 1480 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Windows\SysWOW64\netsh.exe
PID 1480 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\pwtk.exe

"C:\Users\Admin\AppData\Roaming\pwtk.exe"

C:\Users\Admin\AppData\Roaming\huecheats.exe

"C:\Users\Admin\AppData\Roaming\huecheats.exe"

C:\Users\Admin\AppData\Roaming\pwtk.exe

"{path}"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3124,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\javaupdate.exe

"C:\Users\Admin\AppData\Local\Temp\javaupdate.exe"

C:\Users\Admin\AppData\Local\Temp\javaupdate.exe

"{path}"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\javaupdate.exe" "javaupdate.exe" ENABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
DE 159.89.16.194:37237 udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 194.16.89.159.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 pwtk02.ddns.net udp
US 8.8.8.8:53 pwtk02.ddns.net udp
US 8.8.8.8:53 pwtk02.ddns.net udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 pwtk02.ddns.net udp
US 8.8.8.8:53 pwtk02.ddns.net udp
US 8.8.8.8:53 pwtk02.ddns.net udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 pwtk02.ddns.net udp
US 8.8.8.8:53 pwtk02.ddns.net udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 pwtk02.ddns.net udp
US 8.8.8.8:53 pwtk02.ddns.net udp
US 8.8.8.8:53 pwtk02.ddns.net udp
US 8.8.8.8:53 pwtk02.ddns.net udp
US 8.8.8.8:53 pwtk02.ddns.net udp
US 8.8.8.8:53 pwtk02.ddns.net udp
US 8.8.8.8:53 pwtk02.ddns.net udp
US 8.8.8.8:53 pwtk02.ddns.net udp
US 8.8.8.8:53 pwtk02.ddns.net udp
US 8.8.8.8:53 pwtk02.ddns.net udp
US 8.8.8.8:53 pwtk02.ddns.net udp
US 8.8.8.8:53 pwtk02.ddns.net udp
US 8.8.8.8:53 pwtk02.ddns.net udp
US 8.8.8.8:53 pwtk02.ddns.net udp

Files

C:\Users\Admin\AppData\Roaming\pwtk.exe

MD5 0cf4d99ef9305450bc818fc7ce941e91
SHA1 13d217d800e9003f458f340d72305e7672996ec7
SHA256 172bf347e03f7acb22546dd068ac7e9a49e7882bdc30f4e170e28c9ba4119883
SHA512 43a755aa165518024326b41cf5c1bbdc1b3ebd2fb2012fcaac5ecb162b14de901b128590c13fed58c8c5e74153a9191f97f73d535ab73f9d8c49a57d5a42249c

C:\Users\Admin\AppData\Roaming\huecheats.exe

MD5 03670a3264a00379a2e6497c0cc84660
SHA1 f8be2b1dbf5f22777e6bfff45e250bccd90f6eb8
SHA256 77cd28421b67137b653eb7722bb5879690530027aea63ba94746cda16524a906
SHA512 54fcb14598c542af6697ed1741caa319dfb34d2b4ba1c666b651795101789a83b39ef71d501860867129e8132212b64c186dd1697c3d0bca61d41702a9b3aed9

memory/4088-19-0x000000007258E000-0x000000007258F000-memory.dmp

memory/4088-22-0x0000000000E60000-0x0000000000E70000-memory.dmp

memory/4088-23-0x0000000005D30000-0x00000000062D4000-memory.dmp

memory/4088-24-0x00000000057C0000-0x00000000057CC000-memory.dmp

memory/4088-25-0x00000000058D0000-0x000000000596C000-memory.dmp

memory/2648-26-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2596-29-0x00007FFDF26F0000-0x00007FFDF26F2000-memory.dmp

memory/2596-30-0x00007FFDF2700000-0x00007FFDF2702000-memory.dmp

memory/2596-31-0x00007FFDF07C0000-0x00007FFDF07C2000-memory.dmp

memory/2596-32-0x00007FFDF07D0000-0x00007FFDF07D2000-memory.dmp

memory/2596-33-0x00007FFDF0230000-0x00007FFDF0232000-memory.dmp

memory/2596-34-0x00007FFDF0240000-0x00007FFDF0242000-memory.dmp

memory/2596-35-0x00007FFDF2710000-0x00007FFDF2712000-memory.dmp

memory/2596-36-0x00007FFDF2720000-0x00007FFDF2722000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\pwtk.exe.log

MD5 98eea38457c9976c0ec48b5a70964041
SHA1 281ec6ada096be89ade13852ca86edfe42ffe3c1
SHA256 4a7455429d6f3c7390f97bc406d0bcc7d64ddff6bee5ffa9e88c5a75f806bfcf
SHA512 adb7bb4e1434d743932890aede4daa55c6e9f091415292775313dd172949fbd415f124c97e017a8204aab530b6184f196ab5cce005781b0853ffccc620f07530

memory/2596-59-0x00000143249A0000-0x0000014324AB5000-memory.dmp

memory/1480-61-0x0000000005970000-0x0000000005A02000-memory.dmp

memory/1480-62-0x00000000058D0000-0x00000000058DA000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-23 12:53

Reported

2024-06-23 12:56

Platform

win7-20240419-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\25181c9f909bd4441f2b53785cd683a2.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\25181c9f909bd4441f2b53785cd683a2.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\25181c9f909bd4441f2b53785cd683a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\javaupdate.exe\" .." C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\25181c9f909bd4441f2b53785cd683a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\javaupdate.exe\" .." C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\huecheats.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1796 set thread context of 3044 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 2004 set thread context of 2480 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\huecheats.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\huecheats.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\huecheats.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\huecheats.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2068 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 2068 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 2068 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 2068 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 2068 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 2068 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 2068 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 2068 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\huecheats.exe
PID 2068 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\huecheats.exe
PID 2068 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\huecheats.exe
PID 2068 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\huecheats.exe
PID 1796 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 1796 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 1796 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 1796 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 1796 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 1796 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 1796 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 1796 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 1796 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 1796 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 1796 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 1796 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Roaming\pwtk.exe
PID 3044 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 3044 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 3044 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 3044 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 3044 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 3044 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 3044 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Roaming\pwtk.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 2004 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 2004 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 2004 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 2004 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 2004 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 2004 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 2004 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 2004 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 2004 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 2004 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 2004 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 2004 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
PID 2480 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Windows\SysWOW64\netsh.exe
PID 2480 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Windows\SysWOW64\netsh.exe
PID 2480 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Windows\SysWOW64\netsh.exe
PID 2480 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\javaupdate.exe C:\Windows\SysWOW64\netsh.exe
PID 2748 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Roaming\huecheats.exe C:\Windows\system32\WerFault.exe
PID 2748 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Roaming\huecheats.exe C:\Windows\system32\WerFault.exe
PID 2748 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Roaming\huecheats.exe C:\Windows\system32\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\pwtk.exe

"C:\Users\Admin\AppData\Roaming\pwtk.exe"

C:\Users\Admin\AppData\Roaming\huecheats.exe

"C:\Users\Admin\AppData\Roaming\huecheats.exe"

C:\Users\Admin\AppData\Roaming\pwtk.exe

"{path}"

C:\Users\Admin\AppData\Local\Temp\javaupdate.exe

"C:\Users\Admin\AppData\Local\Temp\javaupdate.exe"

C:\Users\Admin\AppData\Local\Temp\javaupdate.exe

"{path}"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\javaupdate.exe" "javaupdate.exe" ENABLE

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2748 -s 280

Network

Country Destination Domain Proto
DE 159.89.16.194:37235 udp
US 8.8.8.8:53 pwtk02.ddns.net udp

Files

\Users\Admin\AppData\Roaming\pwtk.exe

MD5 0cf4d99ef9305450bc818fc7ce941e91
SHA1 13d217d800e9003f458f340d72305e7672996ec7
SHA256 172bf347e03f7acb22546dd068ac7e9a49e7882bdc30f4e170e28c9ba4119883
SHA512 43a755aa165518024326b41cf5c1bbdc1b3ebd2fb2012fcaac5ecb162b14de901b128590c13fed58c8c5e74153a9191f97f73d535ab73f9d8c49a57d5a42249c

\Users\Admin\AppData\Roaming\huecheats.exe

MD5 03670a3264a00379a2e6497c0cc84660
SHA1 f8be2b1dbf5f22777e6bfff45e250bccd90f6eb8
SHA256 77cd28421b67137b653eb7722bb5879690530027aea63ba94746cda16524a906
SHA512 54fcb14598c542af6697ed1741caa319dfb34d2b4ba1c666b651795101789a83b39ef71d501860867129e8132212b64c186dd1697c3d0bca61d41702a9b3aed9

memory/1796-23-0x0000000000380000-0x0000000000390000-memory.dmp

memory/1796-25-0x0000000000390000-0x000000000039C000-memory.dmp

memory/3044-36-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3044-39-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3044-38-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3044-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/3044-33-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3044-31-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3044-29-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3044-27-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2748-40-0x0000000077540000-0x0000000077542000-memory.dmp

memory/2748-42-0x0000000077540000-0x0000000077542000-memory.dmp

memory/2748-44-0x0000000077540000-0x0000000077542000-memory.dmp

memory/2748-45-0x0000000077550000-0x0000000077552000-memory.dmp

memory/2748-47-0x0000000077550000-0x0000000077552000-memory.dmp

memory/2748-49-0x0000000077550000-0x0000000077552000-memory.dmp

memory/2748-64-0x000007FEFD4F0000-0x000007FEFD4F2000-memory.dmp

memory/2748-62-0x000007FEFD4F0000-0x000007FEFD4F2000-memory.dmp

memory/2748-59-0x0000000077570000-0x0000000077572000-memory.dmp

memory/2748-57-0x0000000077570000-0x0000000077572000-memory.dmp

memory/2748-55-0x0000000077570000-0x0000000077572000-memory.dmp

memory/2748-54-0x0000000077560000-0x0000000077562000-memory.dmp

memory/2748-67-0x000007FEFD500000-0x000007FEFD502000-memory.dmp

memory/2748-52-0x0000000077560000-0x0000000077562000-memory.dmp

memory/2748-50-0x0000000077560000-0x0000000077562000-memory.dmp

memory/2748-69-0x000007FEFD500000-0x000007FEFD502000-memory.dmp

memory/2748-70-0x0000000077580000-0x0000000077582000-memory.dmp

memory/2748-72-0x0000000077580000-0x0000000077582000-memory.dmp

memory/2748-74-0x0000000077580000-0x0000000077582000-memory.dmp

memory/2748-75-0x0000000077590000-0x0000000077592000-memory.dmp

memory/2748-77-0x0000000077590000-0x0000000077592000-memory.dmp

memory/2748-79-0x0000000077590000-0x0000000077592000-memory.dmp

memory/2004-93-0x0000000000B20000-0x0000000000B30000-memory.dmp

memory/2480-103-0x000000007EFDE000-0x000000007EFDF000-memory.dmp