Malware Analysis Report

2025-03-15 06:32

Sample ID 240624-xbrmaazfjr
Target 0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118
SHA256 42a793d416126707f7949a114249fb5512e73d8ddf9a68afebbe20f278312d14
Tags
gh0strat rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

42a793d416126707f7949a114249fb5512e73d8ddf9a68afebbe20f278312d14

Threat Level: Known bad

The file 0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

gh0strat rat

Gh0strat

Gh0st RAT payload

Loads dropped DLL

Deletes itself

Checks computer location settings

Executes dropped EXE

Enumerates connected drives

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Program crash

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-24 18:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-24 18:41

Reported

2024-06-24 18:43

Platform

win7-20240611-en

Max time kernel

117s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe"

Signatures

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\148A.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\inl33A0.tmp N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\msiexec.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\loader.dll C:\Users\Admin\AppData\Roaming\148A.tmp N/A
File created C:\Program Files\Common Files\lanmao.dll C:\Users\Admin\AppData\Roaming\148A.tmp N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\f763459.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f76345c.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI362D.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Logs\DPX\setuperr.log C:\Windows\SysWOW64\expand.exe N/A
File created C:\WINDOWS\vbcfg.ini C:\Users\Admin\AppData\Roaming\148A.tmp N/A
File created C:\Windows\Installer\f763459.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f76345e.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Logs\DPX\setupact.log C:\Windows\SysWOW64\expand.exe N/A
File opened for modification C:\Windows\Installer\f76345c.ipi C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2856 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\148A.tmp
PID 2856 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\148A.tmp
PID 2856 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\148A.tmp
PID 2856 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\148A.tmp
PID 2856 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\148A.tmp
PID 2856 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\148A.tmp
PID 2856 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\148A.tmp
PID 2856 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2856 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2856 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2856 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2856 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2856 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2856 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 2856 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2856 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2856 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2856 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2856 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2856 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2856 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2856 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2856 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2856 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2856 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2856 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2424 wrote to memory of 1788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 2424 wrote to memory of 1788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 2424 wrote to memory of 1788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 2424 wrote to memory of 1788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 2640 wrote to memory of 1724 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2640 wrote to memory of 1724 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2640 wrote to memory of 1724 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2640 wrote to memory of 1724 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2640 wrote to memory of 1724 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2640 wrote to memory of 1724 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2640 wrote to memory of 1724 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2708 wrote to memory of 2120 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl33A0.tmp
PID 2708 wrote to memory of 2120 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl33A0.tmp
PID 2708 wrote to memory of 2120 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl33A0.tmp
PID 2708 wrote to memory of 2120 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl33A0.tmp
PID 2120 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\inl33A0.tmp C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\inl33A0.tmp C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\inl33A0.tmp C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\inl33A0.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\148A.tmp

C:\Users\Admin\AppData\Roaming\148A.tmp

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\INS2FF~1.INI /quiet

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat" "

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\0A30E1~1.EXE > nul

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding ADE1857112810E57B181C09C1CDCDF05

C:\Windows\SysWOW64\expand.exe

expand.exe "C:\Users\Admin\AppData\Local\Temp\favorites_url.cab" -F:*.* "C:\Users\Admin\Favorites"

C:\Users\Admin\AppData\Local\Temp\inl33A0.tmp

C:\Users\Admin\AppData\Local\Temp\inl33A0.tmp cdf1912.tmp

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inl33A0.tmp > nul

Network

Country Destination Domain Proto
US 8.8.8.8:53 jump3.35638.com udp
US 8.8.8.8:53 bofangqi.6gg.cn udp
SG 170.33.13.246:80 bofangqi.6gg.cn tcp
US 8.8.8.8:53 www.xunlei100.com udp
US 8.8.8.8:53 download.lava.cn udp

Files

memory/2856-1-0x0000000000020000-0x0000000000023000-memory.dmp

memory/2856-0-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2856-8-0x0000000000440000-0x0000000000470000-memory.dmp

memory/2324-12-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2324-13-0x00000000001F0000-0x00000000001F2000-memory.dmp

memory/2324-17-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2856-19-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\INS2FF~1.INI

MD5 5d6cc1bcccbe27a22bef7943b1b1ea57
SHA1 4edc5969992339a3f82f304ca659234037495552
SHA256 82fa7bf55105fb0b800ba4f086bfcd652c35581777b2e14923340405c26c2901
SHA512 83a879df85354a3fc0d59875398a71abe659d5ea2dc583ea711443f64946febb7048a392753415e3685d482a0bbeb04c6c909cabc4919b52d65e6c145893e5af

C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat

MD5 2ff17037ea18311d09217312261b5ca6
SHA1 acd96015c8d72409a117fd2a893892f464cac591
SHA256 ee68ce42a699eaa01d70559a293f45209fef7c247555e73ca0443404c80b21f8
SHA512 f2119cb9ab2d09ffe9d57f9af32397e1113355ecd8147c7a9ee1d88629bc1495b524b75a408e20c54d74d02784739311f675db5fb315b19a46fbace4582c0421

C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

MD5 d20d9eda31a2d0300e4589df7f352370
SHA1 79b46d2dbb489914cfedafdbc90e62951471b48e
SHA256 d7a1d6a8cf5c3fbb85cd06147a599f5274630b86b1c89721f10a60c1bbe994d8
SHA512 d28c5b69325a9833776ea362445b77b231a0ec9b9b8b4a2ad37a434ee8b2b0c1903d6ade1e372f73ac8ada951e0a24076cf23d9307d27fed5927f4bf8b0d0a5e

C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat

MD5 8663de6fce9208b795dc913d1a6a3f5b
SHA1 882193f208cf012eaf22eeaa4fef3b67e7c67c15
SHA256 2909ea8555f2fc19097c1070a1da8fcfd6dc6886aa1d99d7e0c05e53feeb5b61
SHA512 9381063e0f85e874be54ae22675393b82c6ab54b223090148e4acbeff6f22393c96c90b83d6538461b695528af01d1f1231cf5dc719f07d6168386974b490688

memory/2856-54-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2856-55-0x0000000000020000-0x0000000000023000-memory.dmp

\??\c:\users\admin\appdata\local\temp\favorites_url.cab

MD5 da68bc3b7c3525670a04366bc55629f5
SHA1 15fda47ecfead7db8f7aee6ca7570138ba7f1b71
SHA256 73f3605192b676c92649034768378909a19d13883a7ea6f8ba1b096c78ffadb5
SHA512 6fee416affcb6a74621479697bca6f14f5429b00de3aa595abe3c60c6b2e094877b59f8783bbe7bdd567fa565d0630bb02def5603f8f0ea92fe8f2c3ac5383c0

C:\Config.Msi\f76345d.rbs

MD5 2a256beda61303cbf117f6c92800d910
SHA1 0b7a6394f30426c2145f20a34a4471b6a3f8815d
SHA256 9832b7b2560a383a04f637e7d509e987716dba10af97457504df61ed5ec02726
SHA512 5e999529e5597ed9b44c529e4323c7501d89940309595db5713cdd803194df884fd8d5a8b188fb81545e70577302fe640f36652e2b25817af541265e04a72dae

memory/2120-92-0x0000000000400000-0x0000000000408000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-24 18:41

Reported

2024-06-24 18:43

Platform

win10v2004-20240508-en

Max time kernel

41s

Max time network

50s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\inl5882.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\44BA.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\inl5882.tmp N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\S: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\e57594b.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{6CB27FD5-21F9-4FF3-90C2-BF069FC33424} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI5B5E.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\LOGS\DPX\setupact.log C:\Windows\SysWOW64\expand.exe N/A
File created C:\Windows\Installer\e57594b.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e57594f.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\LOGS\DPX\setuperr.log C:\Windows\SysWOW64\expand.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\44BA.tmp

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 432 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\44BA.tmp
PID 432 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\44BA.tmp
PID 432 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\44BA.tmp
PID 432 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 432 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 432 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\msiexec.exe
PID 432 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 432 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 432 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 432 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 432 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 432 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 432 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 432 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 432 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 3872 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 2060 wrote to memory of 3872 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 2060 wrote to memory of 3872 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 3392 wrote to memory of 2364 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl5882.tmp
PID 3392 wrote to memory of 2364 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl5882.tmp
PID 3392 wrote to memory of 2364 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\inl5882.tmp
PID 4340 wrote to memory of 1200 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4340 wrote to memory of 1200 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4340 wrote to memory of 1200 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2364 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\inl5882.tmp C:\Windows\SysWOW64\cmd.exe
PID 2364 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\inl5882.tmp C:\Windows\SysWOW64\cmd.exe
PID 2364 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\inl5882.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0a30e151e99b3cdc6cc2ec55d1c3049c_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\44BA.tmp

C:\Users\Admin\AppData\Roaming\44BA.tmp

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2144 -ip 2144

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 256

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\INS54E~1.INI /quiet

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat" "

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\0A30E1~1.EXE > nul

C:\Windows\SysWOW64\expand.exe

expand.exe "C:\Users\Admin\AppData\Local\Temp\favorites_url.cab" -F:*.* "C:\Users\Admin\Favorites"

C:\Users\Admin\AppData\Local\Temp\inl5882.tmp

C:\Users\Admin\AppData\Local\Temp\inl5882.tmp cdf1912.tmp

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 8E223BF9706E0E24B7EBBF6B502F6AAB

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inl5882.tmp > nul

Network

Country Destination Domain Proto
US 8.8.8.8:53 jump3.35638.com udp
US 8.8.8.8:53 bofangqi.6gg.cn udp
US 8.8.8.8:53 www.xunlei100.com udp

Files

memory/432-1-0x00000000001A0000-0x00000000001A3000-memory.dmp

memory/432-0-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2144-8-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2144-10-0x00000000001D0000-0x00000000001D2000-memory.dmp

memory/2144-12-0x0000000000400000-0x0000000000430000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\INS54E~1.INI

MD5 ac405f4ca98071a7e862362a91b3a25d
SHA1 ae65feee835fdfb53438ccff6d9b2de98b8d1502
SHA256 c91e3f949304f93ab9481bae27332823144d28470214ee55a960ca7653d26301
SHA512 185ed97163e97d93d15d24f50ffefa464485e77c7ea353d032fd3b156bf4576f161b5d6d64b7e49f5b055d5ce121572a9c1cb5beb775d23381a374fef09e1edc

C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

MD5 d20d9eda31a2d0300e4589df7f352370
SHA1 79b46d2dbb489914cfedafdbc90e62951471b48e
SHA256 d7a1d6a8cf5c3fbb85cd06147a599f5274630b86b1c89721f10a60c1bbe994d8
SHA512 d28c5b69325a9833776ea362445b77b231a0ec9b9b8b4a2ad37a434ee8b2b0c1903d6ade1e372f73ac8ada951e0a24076cf23d9307d27fed5927f4bf8b0d0a5e

memory/432-31-0x0000000000400000-0x000000000043E000-memory.dmp

memory/432-30-0x00000000001A0000-0x00000000001A3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat

MD5 8663de6fce9208b795dc913d1a6a3f5b
SHA1 882193f208cf012eaf22eeaa4fef3b67e7c67c15
SHA256 2909ea8555f2fc19097c1070a1da8fcfd6dc6886aa1d99d7e0c05e53feeb5b61
SHA512 9381063e0f85e874be54ae22675393b82c6ab54b223090148e4acbeff6f22393c96c90b83d6538461b695528af01d1f1231cf5dc719f07d6168386974b490688

C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat

MD5 58998eddc698c5982091922efa04b6b8
SHA1 d358644cd1bb85f33197d129caadcd1252a71dd8
SHA256 8aa654515bd06024e1e8efe1d4eae7638347e28408eca186f2076bccaf502f63
SHA512 f8ddadeaa6999fb747bc3cf67f57d5563fab3f1a6f5989a7c0a9bb6d3d5646dd8a0270bf8a088a0e60d639f8aaa1b8e6a0c5cdfaec4443ed9d72f034a5cbc457

\??\c:\users\admin\appdata\local\temp\favorites_url.cab

MD5 da68bc3b7c3525670a04366bc55629f5
SHA1 15fda47ecfead7db8f7aee6ca7570138ba7f1b71
SHA256 73f3605192b676c92649034768378909a19d13883a7ea6f8ba1b096c78ffadb5
SHA512 6fee416affcb6a74621479697bca6f14f5429b00de3aa595abe3c60c6b2e094877b59f8783bbe7bdd567fa565d0630bb02def5603f8f0ea92fe8f2c3ac5383c0

C:\Config.Msi\e57594e.rbs

MD5 3124ea1524faa74cb4900275ccbbadc3
SHA1 1ec1c2a8e509b21fc5ef28b220e106315396811b
SHA256 45398322c3b38998bd962efa1d6a165591cc3be84b39fb17926fb6c3aebadd49
SHA512 0d78169bb36b196fbb62dd77b9bada1c7167d5342d20acb4c55abed0fee0cd06643b61050cc49851e30481d8c868f9ae5945f4fe18e2e77c16b08b7c5a248825

memory/2364-77-0x0000000000400000-0x0000000000408000-memory.dmp