Malware Analysis Report

2025-01-19 07:08

Sample ID 240625-rfw5nsxdkj
Target 0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118
SHA256 9bfdecb3b2352f79da808e09402dfce008c0e14e5be6a13d0709a7a2e11de6fb
Tags
ramnit banker spyware stealer trojan worm defense_evasion evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9bfdecb3b2352f79da808e09402dfce008c0e14e5be6a13d0709a7a2e11de6fb

Threat Level: Known bad

The file 0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

ramnit banker spyware stealer trojan worm defense_evasion evasion persistence

Modifies WinLogon for persistence

UAC bypass

Ramnit

Executes dropped EXE

Checks BIOS information in registry

Checks computer location settings

Drops startup file

Loads dropped DLL

Impair Defenses: Safe Mode Boot

Adds Run key to start application

Unsigned PE

Program crash

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

Suspicious behavior: LoadsDriver

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-25 14:08

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 14:08

Reported

2024-06-25 14:11

Platform

win10v2004-20240611-en

Max time kernel

140s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe"

Signatures

Ramnit

trojan spyware stealer worm banker ramnit

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cplrybmbukfwwtin.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1437896433" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{755A7ABF-32FC-11EF-9D11-EA96628E18C9} = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115017" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1257427106" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1257739845" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115017" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115017" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115017" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1257739845" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426089510" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1257427106" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115017" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\cplrybmbukfwwtin.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\cplrybmbukfwwtin.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3336 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 3336 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 3336 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 3336 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 3336 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 3336 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 3336 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 3336 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 3336 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 3336 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 3336 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 3336 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2368 wrote to memory of 2588 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2368 wrote to memory of 2588 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2588 wrote to memory of 4168 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2588 wrote to memory of 4168 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2588 wrote to memory of 4168 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 3336 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 3336 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 3336 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 3336 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 3336 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 3336 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 3336 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 3336 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 3336 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 3336 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 3336 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 3336 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 3356 wrote to memory of 3516 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 3356 wrote to memory of 3516 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2588 wrote to memory of 1208 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2588 wrote to memory of 1208 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2588 wrote to memory of 1208 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 3336 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\cplrybmbukfwwtin.exe
PID 3336 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\cplrybmbukfwwtin.exe
PID 3336 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\cplrybmbukfwwtin.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3692 -ip 3692

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 204

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe"

C:\Program Files\Internet Explorer\IEXPLORE.EXE

"C:\Program Files\Internet Explorer\IEXPLORE.EXE"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2588 CREDAT:17410 /prefetch:2

C:\Windows\SysWOW64\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 864 -ip 864

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 208

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe"

C:\Program Files\Internet Explorer\IEXPLORE.EXE

"C:\Program Files\Internet Explorer\IEXPLORE.EXE"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2588 CREDAT:17416 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\cplrybmbukfwwtin.exe

"C:\Users\Admin\AppData\Local\Temp\cplrybmbukfwwtin.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.107.115:443 www.bing.com tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 23.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 115.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 api.bing.com udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 161.19.199.152.in-addr.arpa udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

memory/3336-1-0x0000000000400000-0x000000000043A000-memory.dmp

memory/3336-0-0x0000000000400000-0x0000000000439054-memory.dmp

memory/3336-4-0x00000000004E0000-0x00000000004E1000-memory.dmp

memory/3336-7-0x0000000000400000-0x0000000000439054-memory.dmp

memory/3336-6-0x0000000000400000-0x0000000000439054-memory.dmp

memory/3336-3-0x00000000004D0000-0x00000000004D1000-memory.dmp

memory/3692-9-0x0000000000480000-0x0000000000481000-memory.dmp

memory/3692-8-0x00000000004A0000-0x00000000004A1000-memory.dmp

memory/3336-11-0x0000000000400000-0x000000000043A000-memory.dmp

memory/3336-15-0x0000000000400000-0x0000000000439054-memory.dmp

memory/3336-16-0x0000000077B22000-0x0000000077B23000-memory.dmp

memory/3336-18-0x0000000000400000-0x0000000000439054-memory.dmp

memory/3336-19-0x0000000077B22000-0x0000000077B23000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verD532.tmp

MD5 1a545d0052b581fbb2ab4c52133846bc
SHA1 62f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512 bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

C:\Users\Admin\AppData\Local\Temp\cplrybmbukfwwtin.exe

MD5 0e5c792beac4688855f7b1546d77d7fa
SHA1 9c0b2575945349994d541b88584ec188e994e7d6
SHA256 9bfdecb3b2352f79da808e09402dfce008c0e14e5be6a13d0709a7a2e11de6fb
SHA512 0cd8ff79c13afd7079cf8faa5a1840c0ee24d3835e7641b1430012564571edcc39e0d53095cc38988f6cafd78ca0ada3e19e84c88086555ccee13a212fdc02f7

memory/3336-36-0x0000000000400000-0x000000000043A000-memory.dmp

memory/3148-38-0x0000000000400000-0x0000000000439054-memory.dmp

memory/3148-37-0x0000000000400000-0x000000000043A000-memory.dmp

memory/3148-43-0x0000000000400000-0x0000000000439054-memory.dmp

memory/3148-42-0x0000000000400000-0x000000000043A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QQACG5HD\suggestions[1].en-US

MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 14:08

Reported

2024-06-25 14:11

Platform

win7-20240508-en

Max time kernel

150s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\axdffrbo\\ieurpukf.exe" C:\Windows\SysWOW64\svchost.exe N/A

Ramnit

trojan spyware stealer worm banker ramnit

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\svchost.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\svchost.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ieurpukf.exe C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ieurpukf.exe C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ajsmrwmlfeeotxqg.exe N/A

Impair Defenses: Safe Mode Boot

defense_evasion
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend C:\Windows\SysWOW64\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc C:\Windows\SysWOW64\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power C:\Windows\SysWOW64\svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\IeuRpukf = "C:\\Users\\Admin\\AppData\\Local\\axdffrbo\\ieurpukf.exe" C:\Windows\SysWOW64\svchost.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ajsmrwmlfeeotxqg.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ajsmrwmlfeeotxqg.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1868 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1868 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1868 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1868 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1868 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1868 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1868 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1868 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1868 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1868 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1868 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1868 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1868 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1868 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1868 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1868 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1868 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1868 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1868 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1868 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 1868 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ajsmrwmlfeeotxqg.exe
PID 1868 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ajsmrwmlfeeotxqg.exe
PID 1868 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ajsmrwmlfeeotxqg.exe
PID 1868 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ajsmrwmlfeeotxqg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0e5c792beac4688855f7b1546d77d7fa_JaffaCakes118.exe"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\SysWOW64\svchost.exe

C:\Windows\system32\svchost.exe

C:\Users\Admin\AppData\Local\Temp\ajsmrwmlfeeotxqg.exe

"C:\Users\Admin\AppData\Local\Temp\ajsmrwmlfeeotxqg.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 google.com udp
GB 142.250.178.14:80 google.com tcp
US 8.8.8.8:53 htmthgurhtchwlhwklf.com udp
US 162.249.65.200:443 htmthgurhtchwlhwklf.com tcp
US 162.249.65.200:443 htmthgurhtchwlhwklf.com tcp
US 8.8.8.8:53 jiwucjyxjibyd.com udp
US 8.8.8.8:53 khddwukkbwhfdiufhaj.com udp
US 8.8.8.8:53 snoknwlgcwgaafbtqkt.com udp
US 8.8.8.8:53 tfgyaoingy.com udp
US 8.8.8.8:53 ukiixagdbdkd.com udp
US 8.8.8.8:53 swbadolov.com udp
US 8.8.8.8:53 ouljuvkvn.com udp
US 8.8.8.8:53 tiqfgpaxvmhsxtk.com udp
US 8.8.8.8:53 cxatodxefolgkokdqy.com udp
DE 46.165.220.143:443 ukiixagdbdkd.com tcp
US 204.95.99.223:443 snoknwlgcwgaafbtqkt.com tcp
DE 195.201.179.207:443 tfgyaoingy.com tcp
US 8.8.8.8:53 caytmlnlrou.com udp
US 8.8.8.8:53 ubkfgwqslhqyy.com udp
US 8.8.8.8:53 qbsqnpyyooh.com udp
IE 34.253.216.9:443 ubkfgwqslhqyy.com tcp
US 8.8.8.8:53 vrguyjjxorlyen.com udp
US 8.8.8.8:53 nvepdnpx.com udp
US 8.8.8.8:53 vwaeloyyutodtr.com udp
US 8.8.8.8:53 gokbwlivwvgqlretxd.com udp
US 8.8.8.8:53 mukevipvxvrq.com udp
US 8.8.8.8:53 empsqyowjuvvsvrwj.com udp
US 8.8.8.8:53 duomyvwabkuappgqxhp.com udp
US 8.8.8.8:53 voohnyqdinl.com udp
US 8.8.8.8:53 ncxphtrpiawmchfylsy.com udp
US 8.8.8.8:53 ldiogjdyyxacm.com udp
US 8.8.8.8:53 xwrmquiqjdsxk.com udp
US 8.8.8.8:53 kuetvxnntsk.com udp
US 8.8.8.8:53 lsawmyxqxvmogvxifm.com udp
US 8.8.8.8:53 ppdbeidwufrb.com udp
US 8.8.8.8:53 tfipmwkcgigiey.com udp
US 8.8.8.8:53 pgahbyurf.com udp
US 8.8.8.8:53 yaesbfejdxs.com udp
US 8.8.8.8:53 yeokcogbbprvybwqn.com udp
US 8.8.8.8:53 ocwbuffwnj.com udp
US 8.8.8.8:53 pubecchfuxgquhguye.com udp
US 8.8.8.8:53 cpugvsnhyrueqcyxnvo.com udp
US 8.8.8.8:53 bxqqsoxw.com udp
US 8.8.8.8:53 gvjkpsip.com udp
US 8.8.8.8:53 garxfslj.com udp
US 8.8.8.8:53 jpeobmbipilmwsc.com udp
US 8.8.8.8:53 mfpgvhnjp.com udp
US 8.8.8.8:53 sjolcaml.com udp
US 8.8.8.8:53 spykqqdavslss.com udp
US 8.8.8.8:53 hcegcnlr.com udp
US 8.8.8.8:53 derdamdyvt.com udp
US 8.8.8.8:53 hnywdakvhxvuoeuap.com udp
US 8.8.8.8:53 fxamvtgx.com udp
US 8.8.8.8:53 rxkcrxbkc.com udp
US 8.8.8.8:53 wavmiijmnswdmbuhcn.com udp
US 8.8.8.8:53 gylgunsiciis.com udp
US 8.8.8.8:53 exvpgubuxrdvhijan.com udp
US 8.8.8.8:53 mvorlnmwfkayjrqfni.com udp
US 8.8.8.8:53 nhvfyugxtgrnk.com udp
US 8.8.8.8:53 ktltiueyc.com udp
US 8.8.8.8:53 ndtdktwnkplaavqsfa.com udp
US 8.8.8.8:53 pvgnfjpvih.com udp
US 8.8.8.8:53 ftmtkcjkomqdw.com udp
US 8.8.8.8:53 shkxklmbrgcqoeh.com udp
US 8.8.8.8:53 daxwkcompfufkvaa.com udp
US 8.8.8.8:53 ttwiysoohhkrhl.com udp
US 8.8.8.8:53 yblmyabknhn.com udp
US 8.8.8.8:53 nkootxbt.com udp
US 8.8.8.8:53 rbafexvqgsmmnnvfv.com udp
US 8.8.8.8:53 anypbvojndegpnm.com udp
DE 46.165.220.143:443 anypbvojndegpnm.com tcp
US 8.8.8.8:53 apimyackpqd.com udp
US 8.8.8.8:53 jptkockakusewlaqfdt.com udp
US 8.8.8.8:53 kbohjdsc.com udp
US 8.8.8.8:53 qxthcmscxhradd.com udp
US 8.8.8.8:53 ldyyuwwwgw.com udp
US 8.8.8.8:53 eonvwoabjwow.com udp
US 8.8.8.8:53 rrnuptrt.com udp
US 8.8.8.8:53 ksynclhbmctx.com udp
US 8.8.8.8:53 nwakycbynypuhbpkpx.com udp
US 8.8.8.8:53 kabywdoswjvqgdso.com udp
US 8.8.8.8:53 miafnrcwjddy.com udp
US 8.8.8.8:53 fjegwqbvoae.com udp
US 8.8.8.8:53 lnolxrnhb.com udp
US 8.8.8.8:53 ryauwismekfu.com udp
US 8.8.8.8:53 njopiyisfxnxw.com udp
US 8.8.8.8:53 kuftuiyxrlyrbffu.com udp
US 8.8.8.8:53 xjxsswjhxpfekmlcwv.com udp
US 8.8.8.8:53 xpgpwjnpcgatgypiepg.com udp
US 8.8.8.8:53 hrwgpaisqjtadka.com udp
US 8.8.8.8:53 xtjjsdpqjrckayml.com udp
US 8.8.8.8:53 rirbqsrjqsnw.com udp
US 8.8.8.8:53 jmdqxtwclkxellkxgn.com udp
US 8.8.8.8:53 ggplhlwurkffvsfxxdh.com udp
US 8.8.8.8:53 gjkdyorakldhem.com udp
US 8.8.8.8:53 iaoaagmfylemjyq.com udp
US 8.8.8.8:53 gmajhefkqm.com udp
US 8.8.8.8:53 mesctomcqxdvseeesd.com udp
US 8.8.8.8:53 hbjgehxcf.com udp
US 8.8.8.8:53 xhxiowpga.com udp
US 8.8.8.8:53 ypwubsqx.com udp
US 8.8.8.8:53 gadwjccnb.com udp
US 8.8.8.8:53 wgyndijomue.com udp
US 8.8.8.8:53 lecgcbtmbnofr.com udp
US 8.8.8.8:53 riacjyielwbe.com udp
US 8.8.8.8:53 clufudjixpqmyspofp.com udp
US 8.8.8.8:53 otfbjejwjvcno.com udp
US 8.8.8.8:53 takpkwhluhhediie.com udp
US 8.8.8.8:53 ieqpusccgyvca.com udp
US 8.8.8.8:53 pqqvrioftjalqahlo.com udp
US 8.8.8.8:53 omqluoghcqw.com udp
US 8.8.8.8:53 oxlbfdxd.com udp
US 8.8.8.8:53 ciqeutekeaojdxcxu.com udp
US 8.8.8.8:53 udyrxoed.com udp
US 8.8.8.8:53 qfdufqnr.com udp
US 8.8.8.8:53 uuwqjcksfo.com udp
US 8.8.8.8:53 fjaapqjsqreelq.com udp
US 8.8.8.8:53 yywtmnpgo.com udp
US 8.8.8.8:53 owjvhbqartmagudc.com udp
US 8.8.8.8:53 lvhsmwthsn.com udp
US 8.8.8.8:53 xsmhhtctdkvikelygk.com udp
US 8.8.8.8:53 fymctauygyk.com udp
US 8.8.8.8:53 attqfideqdholwyafo.com udp
US 8.8.8.8:53 lhvlyhgojmdtq.com udp
US 8.8.8.8:53 pbpanibyxfajxlr.com udp
US 8.8.8.8:53 ijjuircfabvpqh.com udp
US 8.8.8.8:53 mrigtuhohkbsju.com udp
US 8.8.8.8:53 iueenjqheehbvhpkp.com udp
US 8.8.8.8:53 wpahyhff.com udp
US 8.8.8.8:53 hgbstappdn.com udp
US 8.8.8.8:53 nfadxfjmdfvqpj.com udp
US 8.8.8.8:53 lkvcgnfsyhvlugcap.com udp
US 8.8.8.8:53 llhbeoxrxoqk.com udp
US 8.8.8.8:53 jdcfoplrebamtbcqa.com udp
US 8.8.8.8:53 hjxaihieibafwv.com udp
US 8.8.8.8:53 xyttylxriaj.com udp
US 8.8.8.8:53 jlormrurxa.com udp
US 8.8.8.8:53 gpngcqfqrjmfydxckai.com udp
US 8.8.8.8:53 xsflgqxa.com udp
US 8.8.8.8:53 ecguxgqdjcyhggfk.com udp
US 8.8.8.8:53 vqokjkmppvllwxuk.com udp
US 8.8.8.8:53 ybxgengtxtycjemmqng.com udp
US 8.8.8.8:53 mshvgpvvs.com udp
US 8.8.8.8:53 tuddhpqmbadaaht.com udp
US 8.8.8.8:53 uxxykffflohlhskeyi.com udp
US 8.8.8.8:53 iibdbafng.com udp
US 8.8.8.8:53 rcsllpxjlsypet.com udp
US 8.8.8.8:53 xfjiribvjqd.com udp
US 8.8.8.8:53 mmxqkwglxtdtor.com udp
US 8.8.8.8:53 nvsgajhivvn.com udp
US 8.8.8.8:53 prqerbwwjvw.com udp
US 8.8.8.8:53 xorutrhmdjwmfcpgsvq.com udp
US 8.8.8.8:53 gnmbqnxvumfclqyug.com udp
US 8.8.8.8:53 yktervxj.com udp
US 8.8.8.8:53 iblgthye.com udp
US 8.8.8.8:53 bfbbvadypijthjh.com udp
US 8.8.8.8:53 hhtxwgap.com udp
US 8.8.8.8:53 ptxfoqfjjxhdnekeh.com udp
US 8.8.8.8:53 fmwuiydsiqsporrgw.com udp
US 8.8.8.8:53 faexhycctgxdl.com udp
US 8.8.8.8:53 cdorpnmmafnomwyeny.com udp
US 8.8.8.8:53 eehckdyaxxjqhdo.com udp
US 8.8.8.8:53 rxatjyykg.com udp
US 8.8.8.8:53 yrluloqkxujrvv.com udp
US 8.8.8.8:53 ltqgnbgqukixovfdaoi.com udp
US 8.8.8.8:53 mmdchhrh.com udp
US 8.8.8.8:53 vqurlimfhvxttpjr.com udp
US 8.8.8.8:53 buoprdhrhaighfcfl.com udp
US 8.8.8.8:53 lvmmllrmkpdll.com udp
US 8.8.8.8:53 cbscmebdlyfkdeeasmu.com udp
US 8.8.8.8:53 nucpjoumgxmhndsob.com udp
US 8.8.8.8:53 xqelqiidxspuqvi.com udp
US 8.8.8.8:53 osajklwmmhjp.com udp
US 8.8.8.8:53 qdonhyqsieseoqlm.com udp
US 8.8.8.8:53 nulthurgrjvwqokbic.com udp
US 8.8.8.8:53 gaohkehqjs.com udp
US 8.8.8.8:53 lrpvmktouq.com udp
US 8.8.8.8:53 sohwjlifxvlmfguite.com udp
US 8.8.8.8:53 ecuamsraikwrwki.com udp
US 8.8.8.8:53 hpswpjjmvccxmimedi.com udp
US 8.8.8.8:53 kyonhkyryembre.com udp
US 8.8.8.8:53 vcxkjqaswogrbmqgfyf.com udp
US 8.8.8.8:53 ksewxcnjo.com udp
US 8.8.8.8:53 treayxvaoaqol.com udp
US 8.8.8.8:53 xllnolng.com udp
US 8.8.8.8:53 uoqdcxvy.com udp
US 8.8.8.8:53 xjhhggbuufmlirsmgjx.com udp
US 8.8.8.8:53 dsooagtnljlwfpmewvm.com udp
US 8.8.8.8:53 cwnwhjtgqtt.com udp
US 8.8.8.8:53 dcdtpewhb.com udp
US 8.8.8.8:53 havonolwc.com udp
US 8.8.8.8:53 yvywhtknppwkfcfvyhj.com udp
US 8.8.8.8:53 yniktagnfeuapbkkjm.com udp
US 8.8.8.8:53 eijabgcrvhynghfx.com udp
US 8.8.8.8:53 vomdkymumbypgiqba.com udp
US 8.8.8.8:53 gggyexvskphnets.com udp
US 8.8.8.8:53 ivjbicjj.com udp
US 8.8.8.8:53 qqtxsbps.com udp
US 8.8.8.8:53 ljxvlmvyyqjch.com udp
US 8.8.8.8:53 uqmgwttutorxwgums.com udp
US 8.8.8.8:53 kfucikjlowsaypemxe.com udp
US 8.8.8.8:53 dtqmfjuwgawuoswof.com udp
US 8.8.8.8:53 hvjunwdwyoypxkk.com udp
US 8.8.8.8:53 uhguoyhafk.com udp
US 8.8.8.8:53 nyigwkvffift.com udp
US 8.8.8.8:53 gllurecirqjdybfy.com udp
US 8.8.8.8:53 oqrmgtfyglxye.com udp
US 8.8.8.8:53 jkocxjytlxvytl.com udp
US 8.8.8.8:53 google.com udp
GB 142.250.178.14:80 google.com tcp
GB 142.250.178.14:80 google.com tcp

Files

memory/1868-1-0x0000000000400000-0x000000000043A000-memory.dmp

memory/1868-0-0x0000000000400000-0x0000000000439054-memory.dmp

memory/1868-2-0x0000000000400000-0x0000000000439054-memory.dmp

memory/1868-5-0x0000000000280000-0x0000000000281000-memory.dmp

memory/1868-4-0x0000000000270000-0x0000000000271000-memory.dmp

memory/1868-13-0x0000000000400000-0x0000000000439054-memory.dmp

memory/1592-9-0x0000000000090000-0x0000000000091000-memory.dmp

memory/1592-7-0x0000000020010000-0x000000002001C000-memory.dmp

memory/1592-14-0x0000000020010000-0x000000002001C000-memory.dmp

memory/1592-20-0x00000000000A0000-0x00000000000A1000-memory.dmp

memory/1592-19-0x0000000000090000-0x0000000000091000-memory.dmp

memory/1592-18-0x00000000000B0000-0x00000000000B1000-memory.dmp

memory/1592-23-0x0000000020010000-0x000000002001C000-memory.dmp

memory/1592-22-0x0000000020010000-0x000000002001C000-memory.dmp

memory/1592-21-0x0000000020010000-0x000000002001C000-memory.dmp

memory/2824-27-0x0000000020010000-0x000000002002C000-memory.dmp

memory/1868-34-0x0000000077E5F000-0x0000000077E60000-memory.dmp

memory/1868-33-0x0000000077E60000-0x0000000077E61000-memory.dmp

memory/2824-35-0x0000000020010000-0x000000002002C000-memory.dmp

C:\Users\Admin\AppData\Local\axdffrbo\ieurpukf.exe

MD5 0e5c792beac4688855f7b1546d77d7fa
SHA1 9c0b2575945349994d541b88584ec188e994e7d6
SHA256 9bfdecb3b2352f79da808e09402dfce008c0e14e5be6a13d0709a7a2e11de6fb
SHA512 0cd8ff79c13afd7079cf8faa5a1840c0ee24d3835e7641b1430012564571edcc39e0d53095cc38988f6cafd78ca0ada3e19e84c88086555ccee13a212fdc02f7

memory/2824-44-0x0000000020010000-0x000000002002C000-memory.dmp

memory/2824-47-0x0000000020010000-0x000000002002C000-memory.dmp

memory/2824-52-0x0000000020010000-0x000000002002C000-memory.dmp

memory/2824-45-0x0000000020010000-0x000000002002C000-memory.dmp

memory/1868-54-0x0000000077E60000-0x0000000077E61000-memory.dmp

memory/1868-63-0x0000000002B80000-0x0000000002BBA000-memory.dmp

memory/1868-62-0x0000000002B80000-0x0000000002BBA000-memory.dmp

memory/2564-75-0x0000000000400000-0x0000000000439054-memory.dmp

memory/2564-74-0x0000000000400000-0x000000000043A000-memory.dmp

memory/1868-73-0x0000000000400000-0x0000000000439054-memory.dmp

memory/1868-70-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2564-80-0x0000000000400000-0x0000000000439054-memory.dmp

memory/2564-79-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2824-82-0x0000000020010000-0x000000002002C000-memory.dmp

memory/2824-83-0x0000000020010000-0x000000002002C000-memory.dmp

memory/2824-91-0x0000000020010000-0x000000002002C000-memory.dmp

memory/2824-92-0x0000000020010000-0x000000002002C000-memory.dmp

memory/2824-93-0x0000000020010000-0x000000002002C000-memory.dmp

memory/2824-94-0x0000000020010000-0x000000002002C000-memory.dmp

memory/2824-95-0x0000000020010000-0x000000002002C000-memory.dmp

memory/2824-96-0x0000000020010000-0x000000002002C000-memory.dmp

memory/2824-97-0x0000000020010000-0x000000002002C000-memory.dmp

memory/2824-98-0x0000000020010000-0x000000002002C000-memory.dmp

memory/2824-99-0x0000000020010000-0x000000002002C000-memory.dmp

memory/2824-100-0x0000000020010000-0x000000002002C000-memory.dmp