Malware Analysis Report

2024-10-19 07:59

Sample ID 240626-z7j87axcmn
Target 13803ebdba0993bab5f7229fd955972b_JaffaCakes118
SHA256 bbd2e79112498c9b3bf4c64a4843e7f54a260136846fcb3bbf123eee9c50225f
Tags
darkcomet rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bbd2e79112498c9b3bf4c64a4843e7f54a260136846fcb3bbf123eee9c50225f

Threat Level: Known bad

The file 13803ebdba0993bab5f7229fd955972b_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

darkcomet rat trojan

Darkcomet

Executes dropped EXE

Loads dropped DLL

Uses the VBS compiler for execution

Checks computer location settings

Drops startup file

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-26 21:21

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-26 21:21

Reported

2024-06-26 21:24

Platform

win7-20240508-en

Max time kernel

146s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FacbookUpdate.exe C:\Users\Admin\AppData\Roaming\13803ebdba0993bab5f7229fd955972b_JaffaCakes1181.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FacbookUpdate.exe C:\Users\Admin\AppData\Roaming\13803ebdba0993bab5f7229fd955972b_JaffaCakes1181.exe N/A

Uses the VBS compiler for execution

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2896 set thread context of 2076 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2896 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 2896 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 2896 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 2896 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 2896 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 2896 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 2896 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 2896 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 2896 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 2896 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 2896 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 2896 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 2896 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 2896 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2896 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2896 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2896 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2748 wrote to memory of 2344 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2748 wrote to memory of 2344 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2748 wrote to memory of 2344 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2748 wrote to memory of 2344 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2896 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\13803ebdba0993bab5f7229fd955972b_JaffaCakes1181.exe
PID 2896 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\13803ebdba0993bab5f7229fd955972b_JaffaCakes1181.exe
PID 2896 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\13803ebdba0993bab5f7229fd955972b_JaffaCakes1181.exe
PID 2896 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\13803ebdba0993bab5f7229fd955972b_JaffaCakes1181.exe

Processes

C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe

C:\Users\Admin\AppData\Local\Temp\\plugtemp\Service.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tasmovav.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3AD0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3ACF.tmp"

C:\Users\Admin\AppData\Roaming\13803ebdba0993bab5f7229fd955972b_JaffaCakes1181.exe

"C:\Users\Admin\AppData\Roaming\13803ebdba0993bab5f7229fd955972b_JaffaCakes1181.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp

Files

memory/2896-0-0x0000000074651000-0x0000000074652000-memory.dmp

memory/2896-1-0x0000000074650000-0x0000000074BFB000-memory.dmp

memory/2896-2-0x0000000074650000-0x0000000074BFB000-memory.dmp

\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

memory/2076-8-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2076-22-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2076-20-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2076-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2076-17-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2076-16-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2076-15-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2076-14-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2076-13-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2076-12-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2076-10-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2076-23-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2076-24-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2076-27-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2076-26-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2076-25-0x0000000000400000-0x00000000004B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tasmovav.cmdline

MD5 a01e48c47091811bfe2ee385d259b9ff
SHA1 5796e5b2a0fb93da40a6512935b01be62957cb28
SHA256 1779ab68c145ea285bd6ffc93c34793fa3cf330fbd2d1dee5bf4bdc84b69c083
SHA512 5c22cd87a220b3dca2352d5c3db544b8f93d9796509bc4584fcf26530d14d8e02a5ca8efb4a518d8e367c1d9bd21aee65994b5ec6a3f95c18fd524b09a1a6675

memory/2748-33-0x0000000000400000-0x000000000051E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tasmovav.0.vb

MD5 d007d837b472eb92cdc46f3a1ad562ee
SHA1 5b4774056e716551e93e1f6aa3da377713507430
SHA256 3abccaba5ad2e2f2b71694b24d616ebc2bcb93cdcbd1c74cbefa8b2948d8a44a
SHA512 a0054bb92d69daf3a27ff5878cb86018cd7606dcf45195daf7a983580d3407328f6c19aad34375047664d7167922461368e9354a3a7310691e7ee28d05fb45cd

C:\Users\Admin\AppData\Local\Temp\vbc3ACF.tmp

MD5 f61654d85e74e9ca8434cc7680914cb7
SHA1 030242438513a7c3c199b219382aa97c02cfcff7
SHA256 79baf021db0ac4da858028a3fa9043bd9a93e35f3e3d58b0f7ee9505d1659fe4
SHA512 29835920b2e4d19ba4c06f1b367185fc3a3b27d56972fea95a2a4ddd388bf83e64c2fdc34f4db43e42a83469851412333f80986e5b56858de220ad898e2f19c0

C:\Users\Admin\AppData\Local\Temp\RES3AD0.tmp

MD5 9fb5a1f7edbd6f39e72288191f93f550
SHA1 8d9456cecfc37a677313536042a740495ba1b8d2
SHA256 a998adad2854730f7be5f574289d8683444411fa4408da14292accc0556b7f31
SHA512 1ebaa596f08096240249f211601da6d1ab9a6f34698ff5f36d2b499a5d52dabd378ad41b0cab30eb2511f214befbbfdb7ca3f9327bb621127534bcb65ef5c791

memory/2748-42-0x0000000000400000-0x000000000051E000-memory.dmp

C:\Users\Admin\AppData\Roaming\13803ebdba0993bab5f7229fd955972b_JaffaCakes1181.exe

MD5 db253db1f3be73caf2af745cc7038fcc
SHA1 13e2cfc7aa0ea7661831dee7bf9f6df05b5b489c
SHA256 e0a223c216fb18facdd7ad79d7d78b725d2b4391e2cc9162d1206c0607102b16
SHA512 1decc2db0ccea9bdd3d040951e26187ac9f5dbe660a61af2cc90a23e72b7cd3efdcd1cae7392a6d2cd6cc0b9d7bbc34fa45900e2ddea44f231de71a1d346c5c3

C:\Users\Admin\AppData\Roaming\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe

MD5 13803ebdba0993bab5f7229fd955972b
SHA1 a5e977d4dcdd53be60f0f48910d1b92ea7628202
SHA256 bbd2e79112498c9b3bf4c64a4843e7f54a260136846fcb3bbf123eee9c50225f
SHA512 457d97542f2114f95a526ab771fca972c6cc41bc07aa4106fa75973ef429f7562dc2e0cce0b146b82648a21459424ec0a395923394cfe5ca4fba05479c60b391

memory/2896-50-0x0000000074650000-0x0000000074BFB000-memory.dmp

memory/2076-51-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2076-52-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2076-54-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2076-55-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2076-56-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2076-58-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2076-59-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2076-61-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2076-62-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2076-64-0x0000000000400000-0x00000000004B6000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-26 21:21

Reported

2024-06-26 21:24

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FacbookUpdate.exe C:\Users\Admin\AppData\Roaming\13803ebdba0993bab5f7229fd955972b_JaffaCakes1181.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FacbookUpdate.exe C:\Users\Admin\AppData\Roaming\13803ebdba0993bab5f7229fd955972b_JaffaCakes1181.exe N/A

Uses the VBS compiler for execution

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 720 set thread context of 4628 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 720 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 720 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 720 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 720 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 720 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 720 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 720 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 720 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 720 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 720 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 720 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 720 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 720 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 720 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
PID 720 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 720 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 720 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2740 wrote to memory of 400 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2740 wrote to memory of 400 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2740 wrote to memory of 400 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 720 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\13803ebdba0993bab5f7229fd955972b_JaffaCakes1181.exe
PID 720 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\13803ebdba0993bab5f7229fd955972b_JaffaCakes1181.exe
PID 720 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\13803ebdba0993bab5f7229fd955972b_JaffaCakes1181.exe

Processes

C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe

C:\Users\Admin\AppData\Local\Temp\\plugtemp\Service.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xq7t8iej.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5F66.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE9B390698A8C49A5B5E956B2CA25F4C.TMP"

C:\Users\Admin\AppData\Roaming\13803ebdba0993bab5f7229fd955972b_JaffaCakes1181.exe

"C:\Users\Admin\AppData\Roaming\13803ebdba0993bab5f7229fd955972b_JaffaCakes1181.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 57.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp
US 8.8.8.8:53 ad713.no-ip.biz udp

Files

memory/720-0-0x0000000074A62000-0x0000000074A63000-memory.dmp

memory/720-1-0x0000000074A60000-0x0000000075011000-memory.dmp

memory/720-2-0x0000000074A60000-0x0000000075011000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe

MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

memory/4628-6-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/4628-9-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/4628-10-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/4628-12-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/4628-13-0x0000000002180000-0x0000000002181000-memory.dmp

memory/4628-14-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/4628-16-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/4628-15-0x0000000000400000-0x00000000004B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\xq7t8iej.cmdline

MD5 f4506b343f8e068aa3744e6d391a8892
SHA1 46ca388550eb1eee647885c7a38767e619665487
SHA256 93545b271f6bb411799695f8b8b563d08556f35507c2456a4461b41c0276d94e
SHA512 a16beb96de0152e0b29c24a4e9eeb737cd0d5c42da0944cc903a7390d79bd8b2c1bef65569963c805e6ee710eb38972f6e2f968f0ca58fe59640b9661e7a47d5

memory/2740-22-0x0000000002210000-0x0000000002220000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\xq7t8iej.0.vb

MD5 d007d837b472eb92cdc46f3a1ad562ee
SHA1 5b4774056e716551e93e1f6aa3da377713507430
SHA256 3abccaba5ad2e2f2b71694b24d616ebc2bcb93cdcbd1c74cbefa8b2948d8a44a
SHA512 a0054bb92d69daf3a27ff5878cb86018cd7606dcf45195daf7a983580d3407328f6c19aad34375047664d7167922461368e9354a3a7310691e7ee28d05fb45cd

C:\Users\Admin\AppData\Local\Temp\vbcE9B390698A8C49A5B5E956B2CA25F4C.TMP

MD5 f61654d85e74e9ca8434cc7680914cb7
SHA1 030242438513a7c3c199b219382aa97c02cfcff7
SHA256 79baf021db0ac4da858028a3fa9043bd9a93e35f3e3d58b0f7ee9505d1659fe4
SHA512 29835920b2e4d19ba4c06f1b367185fc3a3b27d56972fea95a2a4ddd388bf83e64c2fdc34f4db43e42a83469851412333f80986e5b56858de220ad898e2f19c0

C:\Users\Admin\AppData\Local\Temp\RES5F66.tmp

MD5 b5c326ae60d90eacd50bfb0f7aa5e857
SHA1 20b086659f17428239942a5ee1fbd13424bb8315
SHA256 4517379ed8c7e5a1ee8700d64fa4c5abbd47a81aa98c8de758266202fc321381
SHA512 01f49917b270980aaec59c7913709d304434c5903a3a1fc51d94454dd131d8f3540c149c67ebb30aa20dcfead24d809d09ae72aa6d281d119e27da9f650ee511

C:\Users\Admin\AppData\Roaming\13803ebdba0993bab5f7229fd955972b_JaffaCakes1181.exe

MD5 3668208041814a386006847384bf759c
SHA1 05fabbf729bf321eb4cacc1d162476ae8c2aecf1
SHA256 d4856d3fe3e86168bab3bbd90acc9c5d6a9bf6edcb3a09315717083da424c6ed
SHA512 98883576fc8e4aa3e93babe911ffecaccfdd7b6326db5c04ac5d1ae67d5320bdfe2c071c8e742f797c8ccd42c1c8c40751ce98694bef70d1193de2151e854693

C:\Users\Admin\AppData\Roaming\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe

MD5 13803ebdba0993bab5f7229fd955972b
SHA1 a5e977d4dcdd53be60f0f48910d1b92ea7628202
SHA256 bbd2e79112498c9b3bf4c64a4843e7f54a260136846fcb3bbf123eee9c50225f
SHA512 457d97542f2114f95a526ab771fca972c6cc41bc07aa4106fa75973ef429f7562dc2e0cce0b146b82648a21459424ec0a395923394cfe5ca4fba05479c60b391

memory/720-38-0x0000000074A60000-0x0000000075011000-memory.dmp

memory/4628-39-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/4628-40-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/4628-41-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/4628-42-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/4628-43-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/4628-44-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/4628-45-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/4628-46-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/4628-47-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/4628-48-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/4628-49-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/4628-50-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/4628-51-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/4628-52-0x0000000000400000-0x00000000004B6000-memory.dmp