Malware Analysis Report

2024-08-06 17:30

Sample ID 240626-ylqcmstbjn
Target 133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118
SHA256 fdc99489f71d7f72e1ec5746cdae8cc7d441c28082de699d6e066c1c16b1ee77
Tags
darkcomet latentbot guest16 persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fdc99489f71d7f72e1ec5746cdae8cc7d441c28082de699d6e066c1c16b1ee77

Threat Level: Known bad

The file 133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

darkcomet latentbot guest16 persistence rat trojan

Darkcomet

LatentBot

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-26 19:52

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-26 19:52

Reported

2024-06-26 19:55

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

LatentBot

trojan latentbot

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ƴƐơӸƛ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Googleupdaterss = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GoogleUpdate.exe" C:\Users\Admin\AppData\Local\Temp\ƴƐơӸƛ.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 624 set thread context of 1132 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 624 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 624 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 624 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 760 wrote to memory of 1788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 760 wrote to memory of 1788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 760 wrote to memory of 1788 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 624 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ƴƐơӸƛ.exe
PID 624 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ƴƐơӸƛ.exe
PID 624 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ƴƐơӸƛ.exe
PID 624 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 624 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 624 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 624 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 624 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 624 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 624 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 624 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 624 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 624 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 624 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 624 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 624 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 624 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gtwvkvzl.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3A99.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3A98.tmp"

C:\Users\Admin\AppData\Local\Temp\ƴƐơӸƛ.exe

"C:\Users\Admin\AppData\Local\Temp\ƴƐơӸƛ.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 botnetclients.zapto.org udp
US 8.8.8.8:53 udp

Files

memory/624-0-0x00000000752C2000-0x00000000752C3000-memory.dmp

memory/624-1-0x00000000752C0000-0x0000000075871000-memory.dmp

memory/624-2-0x00000000752C0000-0x0000000075871000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\gtwvkvzl.cmdline

MD5 548951bdd37d847911db5ae73ba74dd0
SHA1 b8e4773b71982f675c3fe8a81ba66b06cd926f2a
SHA256 c4d9a1e3d8c9022c7749321c08b88e512233cd73ef52f9e1e2354412e509dc80
SHA512 3eedadcaa0842dc11fffe3867c906b6d3f6f58ef0ce503b8bc6a3707be8933f5ac4ffc76d68222fcff4f9b56e7f1160d3e930b1b17066babdd867a356ad07f8f

\??\c:\Users\Admin\AppData\Local\Temp\gtwvkvzl.0.cs

MD5 f80b11bd919779674e6eafe423e97e60
SHA1 909c86bd235bbae1769517843edb6d963effa3a2
SHA256 9c93657602cf1b1d423c530c66cad6fee05420cb9058fd887d689d4aa38bb6c9
SHA512 c17379d0a5461ba9111bb2367025d993904cf063bd71e93806e672847f5bbe8bfad8953706a358d22f36bad05ec04411445d109d982f1942980953e3819e5c66

memory/760-8-0x00000000752C0000-0x0000000075871000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\CSC3A98.tmp

MD5 2730ab17d4096ca3bd422d60329a4dd4
SHA1 5e2b17f0949eff720b65a436ebcab5ee7c9981a6
SHA256 60c5e88c7e70c5261c29c4f6658893c93eebe2c5a0a60b6a7aa8431bd3b55bfa
SHA512 c74a0088cf03f3171b31a13a54d37d35cadc796f5bec6508291b60835c445cfc04cc1f10ca14b059b58b250aeda235bed6a272839c170700cdb505a532a3d451

C:\Users\Admin\AppData\Local\Temp\RES3A99.tmp

MD5 f945b67328147d12c25845ea161ced14
SHA1 2990d7ee4f3463021fe415648da87a12a8019b80
SHA256 f5e8b37ecb29a81009c5b8ef43d238a50054e6fd629f7d8c2cbe0dd11e711111
SHA512 afaf9682582f7fe86412ccc0a63a07e5323f394769a08336a15fea068681110913451b6d2dba97df6f133f550761d0d06f494411377c44c6aa339c7c452fc4a6

memory/760-15-0x00000000752C0000-0x0000000075871000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ƴƐơӸƛ.exe

MD5 0d445dec862f16335f356fe9e7b0ffb2
SHA1 b9705ecb09ff5a35937a02f9435918ffda6e2e72
SHA256 e4282c30dfeac24350abe4b1526f440b74460f0e6c79a006dda923b702f0d72a
SHA512 d98c52c4f9aa1d3e4678d80cfa0a9bcdf0f22b969f97a417bc36a0bc9840f0f1bec4b1f453076c0010004de556ba914f94b3ab74ef08623a86a08f07e79c1842

memory/1656-21-0x00000000752C0000-0x0000000075871000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 e118330b4629b12368d91b9df6488be0
SHA1 ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA256 3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
SHA512 ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

memory/1132-26-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/624-30-0x00000000752C0000-0x0000000075871000-memory.dmp

memory/1132-33-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1132-32-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1132-31-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1132-28-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1656-27-0x00000000752C0000-0x0000000075871000-memory.dmp

memory/1132-22-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1656-35-0x00000000752C0000-0x0000000075871000-memory.dmp

memory/1132-36-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1132-37-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1132-38-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1132-39-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1132-40-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1132-41-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1132-42-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1132-43-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1132-44-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1132-45-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1132-46-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1132-47-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1132-48-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/1132-49-0x0000000000400000-0x00000000004B0000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-26 19:52

Reported

2024-06-26 19:55

Platform

win7-20240611-en

Max time kernel

150s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

LatentBot

trojan latentbot

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ƴƐơӸƛ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\Googleupdaterss = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GoogleUpdate.exe" C:\Users\Admin\AppData\Local\Temp\ƴƐơӸƛ.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2444 set thread context of 2604 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2444 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2444 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2444 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2444 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2412 wrote to memory of 3068 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2412 wrote to memory of 3068 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2412 wrote to memory of 3068 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2412 wrote to memory of 3068 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2444 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ƴƐơӸƛ.exe
PID 2444 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ƴƐơӸƛ.exe
PID 2444 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ƴƐơӸƛ.exe
PID 2444 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ƴƐơӸƛ.exe
PID 2444 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2444 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2444 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2444 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2444 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2444 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2444 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2444 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2444 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2444 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2444 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2444 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2444 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\133b22daeb05a907491ce1c8fbef04b9_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\7mzsi43y.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5F60.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5F5F.tmp"

C:\Users\Admin\AppData\Local\Temp\ƴƐơӸƛ.exe

"C:\Users\Admin\AppData\Local\Temp\ƴƐơӸƛ.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 botnetclients.zapto.org udp

Files

memory/2444-0-0x0000000074A21000-0x0000000074A22000-memory.dmp

memory/2444-1-0x0000000074A20000-0x0000000074FCB000-memory.dmp

memory/2444-2-0x0000000074A20000-0x0000000074FCB000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\7mzsi43y.cmdline

MD5 25a6bc1120c3addc990931df4b9e1353
SHA1 f85af7d0255e459e5e5cc37cdb3d8f4411ff8404
SHA256 29195459bf4be3ee830b4c4862e0a9069f90291aff9a03bf2f5f3b11012dcfe6
SHA512 080c02f5a9e258aa7ae70e4eb5ba5a11510ff661625e3751fd74d8a19869bb5adda64f3668875cf71ccf3db84810cd99a71a980eb304fceb34b3c5ee74b5a02a

\??\c:\Users\Admin\AppData\Local\Temp\7mzsi43y.0.cs

MD5 f80b11bd919779674e6eafe423e97e60
SHA1 909c86bd235bbae1769517843edb6d963effa3a2
SHA256 9c93657602cf1b1d423c530c66cad6fee05420cb9058fd887d689d4aa38bb6c9
SHA512 c17379d0a5461ba9111bb2367025d993904cf063bd71e93806e672847f5bbe8bfad8953706a358d22f36bad05ec04411445d109d982f1942980953e3819e5c66

memory/2412-8-0x0000000074A20000-0x0000000074FCB000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\CSC5F5F.tmp

MD5 2730ab17d4096ca3bd422d60329a4dd4
SHA1 5e2b17f0949eff720b65a436ebcab5ee7c9981a6
SHA256 60c5e88c7e70c5261c29c4f6658893c93eebe2c5a0a60b6a7aa8431bd3b55bfa
SHA512 c74a0088cf03f3171b31a13a54d37d35cadc796f5bec6508291b60835c445cfc04cc1f10ca14b059b58b250aeda235bed6a272839c170700cdb505a532a3d451

C:\Users\Admin\AppData\Local\Temp\RES5F60.tmp

MD5 34793905d04d0c7496fa35c7b00910c2
SHA1 364f0dd3b7b56e1a65a65f44ddc84939b39efebc
SHA256 3851cea9e95bdb99d168b37831b9d82446f6d1ddb737029eb3d14e521a8351d3
SHA512 148c4602bb7de0839835a8a86a39048cb83d3acad25942b66c189317631ee44feab39f639b8ace071f461e6d57e25f63c7d386cbe73f21357427e8beb7599138

memory/2412-15-0x0000000074A20000-0x0000000074FCB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ƴƐơӸƛ.exe

MD5 625fbe98fb723b1181ceae84b621865f
SHA1 9392708d9c12b88bc12f16528110906f6e2d2820
SHA256 f62a7a8b59825f7f63b4d8bde7c208fe1a41b3443dfe06f53d6c5eb3ff646f24
SHA512 df734f9b61861272c221c03026928c753fa271947a8c84cdfdb0e24e69aa0f7c9f6ceeee21585e857a009b34f60e8dacec094d42db37a78d6221fb45981fbaa9

\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 ed797d8dc2c92401985d162e42ffa450
SHA1 0f02fc517c7facc4baefde4fe9467fb6488ebabe
SHA256 b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e
SHA512 e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

memory/2604-29-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2604-42-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2604-45-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2604-47-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2604-48-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2444-46-0x0000000074A20000-0x0000000074FCB000-memory.dmp

memory/2444-44-0x0000000000570000-0x0000000000670000-memory.dmp

memory/2604-41-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2604-39-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2604-35-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2604-27-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2604-26-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2604-37-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2604-33-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2604-31-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2604-49-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2604-50-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2604-51-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2604-52-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2604-53-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2604-54-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2604-55-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2604-56-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2604-57-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2604-58-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2604-59-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2604-60-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2604-61-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2604-62-0x0000000000400000-0x00000000004B0000-memory.dmp