Malware Analysis Report

2024-10-19 07:55

Sample ID 240626-xx52ss1gqj
Target 131da82ef6d07117f53b510d30868284_JaffaCakes118
SHA256 99156da53e622418cbd84c7de2dd8dc49d9068bc8cb227b1ba7f6d47667d1e09
Tags
darkcomet evasion persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

99156da53e622418cbd84c7de2dd8dc49d9068bc8cb227b1ba7f6d47667d1e09

Threat Level: Known bad

The file 131da82ef6d07117f53b510d30868284_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

darkcomet evasion persistence rat trojan

Modifies WinLogon for persistence

Windows security bypass

Darkcomet

Modifies security service

Executes dropped EXE

Windows security modification

Checks computer location settings

Loads dropped DLL

Deletes itself

Checks BIOS information in registry

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Checks processor information in registry

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Runs ping.exe

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-26 19:14

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-26 19:14

Reported

2024-06-26 19:17

Platform

win7-20240221-en

Max time kernel

149s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\GoogleUpdater\\GoogleUpdater.exe" C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdater.exe = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleUpdater\\GoogleUpdater.exe" C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2196 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2196 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2196 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2196 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2196 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2196 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2196 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2196 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2196 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2196 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2196 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2196 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2196 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2196 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2068 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 2068 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 2068 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 2068 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 2068 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 2068 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 2068 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 2068 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2068 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2068 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2068 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2548 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2548 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2548 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2548 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2568 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 2568 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 2568 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 2568 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 2568 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 2568 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 2568 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 2568 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 2568 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 2568 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 2568 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 2568 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 2568 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 2568 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 2568 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 2568 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 2568 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe

Processes

C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe

C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe

"C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 2

C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe

C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 misheldavins.no-ip.biz udp

Files

memory/2068-2-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2196-1-0x0000000000400000-0x00000000004CE000-memory.dmp

memory/2068-0-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2068-3-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2068-4-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2068-5-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2068-6-0x0000000000400000-0x00000000004C1000-memory.dmp

C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe

MD5 131da82ef6d07117f53b510d30868284
SHA1 369931664189b626bd77b3af71b2c808effb8b0a
SHA256 99156da53e622418cbd84c7de2dd8dc49d9068bc8cb227b1ba7f6d47667d1e09
SHA512 d959b283a2f077e50a66d019e13a600c3ed6b5f927fbd84d8db8542109c1aa0f22957ae4d3be934cac6448b0a14dee6129a64937e049a732ec8afd7634562999

C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat

MD5 edb2ec773e95951ab9a67bbf9ddca873
SHA1 0a01b0e8687717ff2694c6a9509ad00db7c7c066
SHA256 c9d727ed176425740dee2ea0a05f02795011dbe291ed87f0861f318c1b54b9e0
SHA512 0702519f37522e0666ba754baabaf2015ccdbb65b335d7d5a1a6e3d98bf927916c6e818bf63efbd5b7ac0116d0b255f1e8f95671c9c55519ff8813d69d58f052

memory/2068-27-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2788-36-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2788-41-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2568-35-0x0000000000400000-0x00000000004CE000-memory.dmp

memory/2788-42-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2788-44-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2788-47-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2788-46-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2788-45-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2788-43-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2788-48-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2788-49-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2788-50-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2788-51-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2788-52-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2788-53-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2788-54-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2788-55-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2788-56-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2788-57-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2788-58-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2788-59-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2788-60-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/2788-61-0x0000000000400000-0x00000000004C1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-26 19:14

Reported

2024-06-26 19:17

Platform

win10v2004-20240226-en

Max time kernel

151s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\GoogleUpdater\\GoogleUpdater.exe" C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleUpdater.exe = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleUpdater\\GoogleUpdater.exe" C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2748 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2748 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2748 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2748 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2748 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2748 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2748 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2748 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2748 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2748 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2748 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2748 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 2748 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe
PID 4016 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 4016 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 4016 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 4016 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4016 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4016 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 556 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 556 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 556 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 556 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 556 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 556 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 556 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 556 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 556 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 556 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 556 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 556 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 556 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe
PID 2628 wrote to memory of 1504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2628 wrote to memory of 1504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2628 wrote to memory of 1504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\131da82ef6d07117f53b510d30868284_JaffaCakes118.exe

C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe

"C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "

C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe

C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 10.179.89.13.in-addr.arpa udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp
US 8.8.8.8:53 misheldavins.no-ip.biz udp

Files

memory/2748-2-0x0000000000400000-0x00000000004CE000-memory.dmp

memory/4016-1-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/4016-0-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/4016-3-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/4016-4-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/4016-5-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/4016-6-0x0000000000400000-0x00000000004C1000-memory.dmp

C:\Users\Admin\AppData\Roaming\GoogleUpdater\GoogleUpdater.exe

MD5 131da82ef6d07117f53b510d30868284
SHA1 369931664189b626bd77b3af71b2c808effb8b0a
SHA256 99156da53e622418cbd84c7de2dd8dc49d9068bc8cb227b1ba7f6d47667d1e09
SHA512 d959b283a2f077e50a66d019e13a600c3ed6b5f927fbd84d8db8542109c1aa0f22957ae4d3be934cac6448b0a14dee6129a64937e049a732ec8afd7634562999

memory/4016-34-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/4016-45-0x0000000000400000-0x00000000004C1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat

MD5 edb2ec773e95951ab9a67bbf9ddca873
SHA1 0a01b0e8687717ff2694c6a9509ad00db7c7c066
SHA256 c9d727ed176425740dee2ea0a05f02795011dbe291ed87f0861f318c1b54b9e0
SHA512 0702519f37522e0666ba754baabaf2015ccdbb65b335d7d5a1a6e3d98bf927916c6e818bf63efbd5b7ac0116d0b255f1e8f95671c9c55519ff8813d69d58f052

memory/556-51-0x0000000000400000-0x00000000004CE000-memory.dmp

memory/1828-53-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1828-54-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1828-55-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1828-58-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1828-60-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1828-59-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1828-57-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1828-56-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1828-61-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1828-62-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1828-63-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1828-64-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1828-65-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1828-66-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1828-67-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1828-68-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1828-69-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1828-70-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1828-71-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1828-72-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1828-73-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1828-74-0x0000000000400000-0x00000000004C1000-memory.dmp