Malware Analysis Report

2024-10-19 07:55

Sample ID 240626-1hbfesyajl
Target 138d1fd5cbb648b4251a36a9fe914418_JaffaCakes118
SHA256 02dc555089d53f749b087fd2c724c41aa7dc6482e104730825478436719e5c9f
Tags
darkcomet zombie evasion persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

02dc555089d53f749b087fd2c724c41aa7dc6482e104730825478436719e5c9f

Threat Level: Known bad

The file 138d1fd5cbb648b4251a36a9fe914418_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

darkcomet zombie evasion persistence rat trojan

Windows security bypass

Darkcomet

Modifies security service

Modifies WinLogon for persistence

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Windows security modification

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-26 21:38

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-26 21:38

Reported

2024-06-26 21:41

Platform

win7-20240611-en

Max time kernel

138s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\138d1fd5cbb648b4251a36a9fe914418_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2696 set thread context of 2572 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\138d1fd5cbb648b4251a36a9fe914418_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Travian Hack.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: 33 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: 34 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: 35 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemtimePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1656 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\138d1fd5cbb648b4251a36a9fe914418_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Travian Hack.exe
PID 1656 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\138d1fd5cbb648b4251a36a9fe914418_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Travian Hack.exe
PID 1656 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\138d1fd5cbb648b4251a36a9fe914418_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Travian Hack.exe
PID 2892 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\Travian Hack.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 2892 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\Travian Hack.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 2892 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\Travian Hack.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 2892 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\Travian Hack.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 2792 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2792 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2792 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2792 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2696 wrote to memory of 2572 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2696 wrote to memory of 2572 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2696 wrote to memory of 2572 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2696 wrote to memory of 2572 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2696 wrote to memory of 2572 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2696 wrote to memory of 2572 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\138d1fd5cbb648b4251a36a9fe914418_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\138d1fd5cbb648b4251a36a9fe914418_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\Travian Hack.exe

"C:\Users\Admin\AppData\Local\Temp\Travian Hack.exe"

C:\Users\Admin\AppData\Local\Temp\server.exe

"C:\Users\Admin\AppData\Local\Temp\server.exe"

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 anonymous-hr.zapto.org udp
PS 94.73.22.187:5150 anonymous-hr.zapto.org tcp
N/A 127.0.0.1:5150 tcp
PS 94.73.22.187:5150 anonymous-hr.zapto.org tcp
N/A 127.0.0.1:5150 tcp
PS 94.73.22.187:5150 anonymous-hr.zapto.org tcp
US 8.8.8.8:53 anonymous-hr.zapto.org udp
PS 94.73.22.187:5150 anonymous-hr.zapto.org tcp
N/A 127.0.0.1:5150 tcp
N/A 127.0.0.1:5150 tcp
PS 94.73.22.187:5150 anonymous-hr.zapto.org tcp
N/A 127.0.0.1:5150 tcp
PS 94.73.22.187:5150 anonymous-hr.zapto.org tcp
N/A 127.0.0.1:5150 tcp
US 8.8.8.8:53 anonymous-hr.zapto.org udp
PS 94.73.22.187:5150 anonymous-hr.zapto.org tcp

Files

memory/1656-0-0x000007FEF61DE000-0x000007FEF61DF000-memory.dmp

memory/1656-1-0x000007FEF5F20000-0x000007FEF68BD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Travian Hack.exe

MD5 a2d562adc906b7c0351551af1317e402
SHA1 79b87f5e3b0312fc6f205c06f1385a633bd6ac79
SHA256 c80ee55191716d24bb89c0daf55a196b2b9f73421b03935510bd037e4432fc94
SHA512 f77f476663f0b24d3195cc23566a18cb2a59bc143ad6f631f1980f9101575562c75e09b4a4922864d03dc3fad845decf7aab712010ab4826d4dbc4b23dc9de1a

memory/1656-9-0x000007FEF5F20000-0x000007FEF68BD000-memory.dmp

memory/2892-10-0x000007FEF5F20000-0x000007FEF68BD000-memory.dmp

memory/2892-11-0x000007FEF5F20000-0x000007FEF68BD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\server.exe

MD5 135c52171999304022023d032e8f4064
SHA1 ec69532dec170bb90fa5f87bdfd0a4c57a6582df
SHA256 e51aeb463290ade3ee17c1c4203767d7154579187a163d5587a09277f8fd5dfe
SHA512 c0af921cc29ab60496d4356a7cb1205c2be43ae13ebf745de8520e4a863ca7d280d03b15793890449fe555960c9ca32c2b45a8740e02d709278f676a2e3ba457

memory/2892-19-0x000007FEF5F20000-0x000007FEF68BD000-memory.dmp

memory/2792-31-0x0000000000400000-0x00000000004B8000-memory.dmp

memory/2572-33-0x0000000000400000-0x00000000004B8000-memory.dmp

memory/2696-34-0x0000000000400000-0x00000000004B8000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-26 21:38

Reported

2024-06-26 21:41

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\138d1fd5cbb648b4251a36a9fe914418_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\138d1fd5cbb648b4251a36a9fe914418_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Travian Hack.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3092 set thread context of 3420 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\138d1fd5cbb648b4251a36a9fe914418_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Travian Hack.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: 33 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: 34 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: 35 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: 36 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemtimePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 956 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\138d1fd5cbb648b4251a36a9fe914418_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Travian Hack.exe
PID 956 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\138d1fd5cbb648b4251a36a9fe914418_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Travian Hack.exe
PID 228 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\Travian Hack.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 228 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\Travian Hack.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 228 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\Travian Hack.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 764 wrote to memory of 3092 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 764 wrote to memory of 3092 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 764 wrote to memory of 3092 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 3092 wrote to memory of 3420 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 3092 wrote to memory of 3420 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 3092 wrote to memory of 3420 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 3092 wrote to memory of 3420 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 3092 wrote to memory of 3420 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\138d1fd5cbb648b4251a36a9fe914418_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\138d1fd5cbb648b4251a36a9fe914418_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\Travian Hack.exe

"C:\Users\Admin\AppData\Local\Temp\Travian Hack.exe"

C:\Users\Admin\AppData\Local\Temp\server.exe

"C:\Users\Admin\AppData\Local\Temp\server.exe"

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 anonymous-hr.zapto.org udp
N/A 127.0.0.1:5150 tcp
US 8.8.8.8:53 anonymous-hr.zapto.org udp
N/A 127.0.0.1:5150 tcp
N/A 127.0.0.1:5150 tcp
N/A 127.0.0.1:5150 tcp
N/A 127.0.0.1:5150 tcp
N/A 127.0.0.1:5150 tcp
US 8.8.8.8:53 anonymous-hr.zapto.org udp
N/A 127.0.0.1:5150 tcp
US 8.8.8.8:53 anonymous-hr.zapto.org udp
N/A 127.0.0.1:5150 tcp
N/A 127.0.0.1:5150 tcp
N/A 127.0.0.1:5150 tcp
US 8.8.8.8:53 anonymous-hr.zapto.org udp
N/A 127.0.0.1:5150 tcp
N/A 127.0.0.1:5150 tcp
N/A 127.0.0.1:5150 tcp
US 8.8.8.8:53 anonymous-hr.zapto.org udp
N/A 127.0.0.1:5150 tcp
N/A 127.0.0.1:5150 tcp
N/A 127.0.0.1:5150 tcp
US 8.8.8.8:53 anonymous-hr.zapto.org udp
N/A 127.0.0.1:5150 tcp
N/A 127.0.0.1:5150 tcp
N/A 127.0.0.1:5150 tcp
US 8.8.8.8:53 anonymous-hr.zapto.org udp
N/A 127.0.0.1:5150 tcp
N/A 127.0.0.1:5150 tcp
N/A 127.0.0.1:5150 tcp
US 8.8.8.8:53 anonymous-hr.zapto.org udp
N/A 127.0.0.1:5150 tcp
N/A 127.0.0.1:5150 tcp
N/A 127.0.0.1:5150 tcp
US 8.8.8.8:53 anonymous-hr.zapto.org udp
N/A 127.0.0.1:5150 tcp
N/A 127.0.0.1:5150 tcp

Files

memory/956-0-0x00007FF9A83E5000-0x00007FF9A83E6000-memory.dmp

memory/956-1-0x00007FF9A8130000-0x00007FF9A8AD1000-memory.dmp

memory/956-2-0x00007FF9A8130000-0x00007FF9A8AD1000-memory.dmp

memory/956-3-0x000000001BE20000-0x000000001BEC6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Travian Hack.exe

MD5 a2d562adc906b7c0351551af1317e402
SHA1 79b87f5e3b0312fc6f205c06f1385a633bd6ac79
SHA256 c80ee55191716d24bb89c0daf55a196b2b9f73421b03935510bd037e4432fc94
SHA512 f77f476663f0b24d3195cc23566a18cb2a59bc143ad6f631f1980f9101575562c75e09b4a4922864d03dc3fad845decf7aab712010ab4826d4dbc4b23dc9de1a

memory/228-15-0x00007FF9A8130000-0x00007FF9A8AD1000-memory.dmp

memory/228-17-0x00007FF9A8130000-0x00007FF9A8AD1000-memory.dmp

memory/956-18-0x00007FF9A8130000-0x00007FF9A8AD1000-memory.dmp

memory/228-19-0x00007FF9A8130000-0x00007FF9A8AD1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\server.exe

MD5 135c52171999304022023d032e8f4064
SHA1 ec69532dec170bb90fa5f87bdfd0a4c57a6582df
SHA256 e51aeb463290ade3ee17c1c4203767d7154579187a163d5587a09277f8fd5dfe
SHA512 c0af921cc29ab60496d4356a7cb1205c2be43ae13ebf745de8520e4a863ca7d280d03b15793890449fe555960c9ca32c2b45a8740e02d709278f676a2e3ba457

memory/228-32-0x00007FF9A8130000-0x00007FF9A8AD1000-memory.dmp

memory/764-45-0x0000000000400000-0x00000000004B8000-memory.dmp

memory/3420-46-0x0000000000400000-0x00000000004B8000-memory.dmp

memory/3092-47-0x0000000000400000-0x00000000004B8000-memory.dmp