Malware Analysis Report

2024-09-11 05:42

Sample ID 240628-m8n8bawdqa
Target 19e46408cdf85c1790728b2ad1e00dec_JaffaCakes118
SHA256 be984dcb05ac824b5ffcab2d7c0c2c5f131da0801c8efb93e953a65d71cadd41
Tags
defense_evasion discovery exploit
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

be984dcb05ac824b5ffcab2d7c0c2c5f131da0801c8efb93e953a65d71cadd41

Threat Level: Likely malicious

The file 19e46408cdf85c1790728b2ad1e00dec_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

defense_evasion discovery exploit

Possible privilege escalation attempt

Modifies file permissions

Checks computer location settings

Deletes itself

Loads dropped DLL

Enumerates connected drives

File and Directory Permissions Modification: Windows File and Directory Permissions Modification

Drops file in System32 directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
File and Directory Permissions Modification
T1222
Windows File and Directory Permissions Modification
T1222.001
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-28 11:08

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-28 11:08

Reported

2024-06-28 11:10

Platform

win7-20240221-en

Max time kernel

119s

Max time network

120s

Command Line

C:\Windows\system32\svchost.exe -k DcomLaunch

Signatures

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

File and Directory Permissions Modification: Windows File and Directory Permissions Modification

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\apa.dll C:\Windows\SysWOW64\regsvr32.exe N/A
File created C:\Windows\SysWOW64\rpcss.dll C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification C:\Windows\SysWOW64\rpcss.dll C:\Windows\SysWOW64\regsvr32.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\regsvr32.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\takeown.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2976 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\19e46408cdf85c1790728b2ad1e00dec_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2976 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\19e46408cdf85c1790728b2ad1e00dec_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2976 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\19e46408cdf85c1790728b2ad1e00dec_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2976 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\19e46408cdf85c1790728b2ad1e00dec_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2976 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\19e46408cdf85c1790728b2ad1e00dec_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2976 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\19e46408cdf85c1790728b2ad1e00dec_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2976 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\19e46408cdf85c1790728b2ad1e00dec_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2300 wrote to memory of 1980 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\takeown.exe
PID 2300 wrote to memory of 1980 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\takeown.exe
PID 2300 wrote to memory of 1980 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\takeown.exe
PID 2300 wrote to memory of 1980 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\takeown.exe
PID 2300 wrote to memory of 2256 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\icacls.exe
PID 2300 wrote to memory of 2256 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\icacls.exe
PID 2300 wrote to memory of 2256 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\icacls.exe
PID 2300 wrote to memory of 2256 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\icacls.exe
PID 2300 wrote to memory of 604 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 2300 wrote to memory of 604 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 2300 wrote to memory of 684 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 2300 wrote to memory of 684 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 2300 wrote to memory of 748 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\svchost.exe
PID 2300 wrote to memory of 748 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\svchost.exe
PID 2300 wrote to memory of 808 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\svchost.exe
PID 2300 wrote to memory of 808 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\svchost.exe
PID 2300 wrote to memory of 856 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 2300 wrote to memory of 856 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 2300 wrote to memory of 972 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 2300 wrote to memory of 972 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 2300 wrote to memory of 240 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 2300 wrote to memory of 240 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 2300 wrote to memory of 1076 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 2300 wrote to memory of 1076 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 2300 wrote to memory of 1704 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 2300 wrote to memory of 1704 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 2300 wrote to memory of 2672 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\cmd.exe
PID 2300 wrote to memory of 2672 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\cmd.exe
PID 2300 wrote to memory of 2672 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\cmd.exe
PID 2300 wrote to memory of 2672 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Users\Admin\AppData\Local\Temp\19e46408cdf85c1790728b2ad1e00dec_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\19e46408cdf85c1790728b2ad1e00dec_JaffaCakes118.exe"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\system32\regsvr32.exe" /s C:\Users\Admin\AppData\Local\Temp\f760e24~.tmp ,C:\Users\Admin\AppData\Local\Temp\19e46408cdf85c1790728b2ad1e00dec_JaffaCakes118.exe

C:\Windows\SysWOW64\takeown.exe

takeown /f "C:\Windows\system32\rpcss.dll"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Windows\system32\rpcss.dll" /grant administrators:F

C:\Windows\SysWOW64\cmd.exe

cmd /c del %SystemRoot%\system32\rpcss.dll~*

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\f760e24~.tmp

MD5 36f922a60f155a6f3559bdb5f85a2701
SHA1 2f3b4b2dd7e66910288d3e932968b21544db8343
SHA256 3077dfd2d02e710597f6b398a9b9c5bb0f797f6ad6c6013ef0e222d6c7b13bbd
SHA512 6567f10e5b426e55e83370593bd62046d63f8c020f83451f72fde08aee5f2f38f480fe1cba5312efd5bb863d81971f60cbd49ba31cf6dbcac55e7fd3cb84947f

memory/604-12-0x00000000001D0000-0x00000000001D1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-28 11:08

Reported

2024-06-28 11:10

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

51s

Command Line

C:\Windows\system32\svchost.exe -k DcomLaunch -p

Signatures

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\19e46408cdf85c1790728b2ad1e00dec_JaffaCakes118.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\G: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\svchost.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\svchost.exe N/A

File and Directory Permissions Modification: Windows File and Directory Permissions Modification

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\apa.dll C:\Windows\SysWOW64\regsvr32.exe N/A
File created C:\Windows\SysWOW64\rpcss.dll C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification C:\Windows\SysWOW64\rpcss.dll C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx C:\Windows\System32\svchost.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "0018400E3FB4E05F" C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\regsvr32.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\takeown.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2520 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\19e46408cdf85c1790728b2ad1e00dec_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2520 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\19e46408cdf85c1790728b2ad1e00dec_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2520 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\19e46408cdf85c1790728b2ad1e00dec_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 916 wrote to memory of 5052 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\takeown.exe
PID 916 wrote to memory of 5052 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\takeown.exe
PID 916 wrote to memory of 5052 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\takeown.exe
PID 916 wrote to memory of 2876 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\icacls.exe
PID 916 wrote to memory of 2876 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\icacls.exe
PID 916 wrote to memory of 2876 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\icacls.exe
PID 916 wrote to memory of 796 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 796 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 908 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 908 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 956 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 956 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 748 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 748 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 1048 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 1048 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 1056 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\svchost.exe
PID 916 wrote to memory of 1056 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\svchost.exe
PID 916 wrote to memory of 1108 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\svchost.exe
PID 916 wrote to memory of 1108 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\svchost.exe
PID 916 wrote to memory of 1116 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 1116 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 1156 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 1156 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 1188 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\svchost.exe
PID 916 wrote to memory of 1188 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\svchost.exe
PID 916 wrote to memory of 1280 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 1280 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 1320 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 1320 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 1336 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 1336 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 1436 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 1436 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 1460 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 1460 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 1576 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 1576 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 1588 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\svchost.exe
PID 916 wrote to memory of 1588 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\svchost.exe
PID 916 wrote to memory of 1632 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\svchost.exe
PID 916 wrote to memory of 1632 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\svchost.exe
PID 916 wrote to memory of 1728 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 1728 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 1760 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\svchost.exe
PID 916 wrote to memory of 1760 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\svchost.exe
PID 916 wrote to memory of 1772 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\svchost.exe
PID 916 wrote to memory of 1772 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\svchost.exe
PID 916 wrote to memory of 1880 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\svchost.exe
PID 916 wrote to memory of 1880 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\svchost.exe
PID 916 wrote to memory of 2020 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 2020 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 2028 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 2028 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 1100 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\svchost.exe
PID 916 wrote to memory of 1100 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\svchost.exe
PID 916 wrote to memory of 2052 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\svchost.exe
PID 916 wrote to memory of 2052 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\svchost.exe
PID 916 wrote to memory of 2084 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 2084 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe
PID 916 wrote to memory of 2196 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe

Processes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s nsi

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

C:\Users\Admin\AppData\Local\Temp\19e46408cdf85c1790728b2ad1e00dec_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\19e46408cdf85c1790728b2ad1e00dec_JaffaCakes118.exe"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\system32\regsvr32.exe" /s C:\Users\Admin\AppData\Local\Temp\e5757a5~.tmp ,C:\Users\Admin\AppData\Local\Temp\19e46408cdf85c1790728b2ad1e00dec_JaffaCakes118.exe

C:\Windows\SysWOW64\takeown.exe

takeown /f "C:\Windows\system32\rpcss.dll"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Windows\system32\rpcss.dll" /grant administrators:F

C:\Windows\SysWOW64\cmd.exe

cmd /c del %SystemRoot%\system32\rpcss.dll~*

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\e5757a5~.tmp

MD5 36f922a60f155a6f3559bdb5f85a2701
SHA1 2f3b4b2dd7e66910288d3e932968b21544db8343
SHA256 3077dfd2d02e710597f6b398a9b9c5bb0f797f6ad6c6013ef0e222d6c7b13bbd
SHA512 6567f10e5b426e55e83370593bd62046d63f8c020f83451f72fde08aee5f2f38f480fe1cba5312efd5bb863d81971f60cbd49ba31cf6dbcac55e7fd3cb84947f

C:\Windows\SysWOW64\apa.dll

MD5 ff5f253c12dd8373c347b218fc46adf9
SHA1 a42b85049849d001cb83ffab4cefc6edcb863613
SHA256 7a45df2b7128f24e56986db32feedd12694a34cdab9d86cede6f871fe1f9b3e0
SHA512 ca3c5f36d07c75c41c174baaa9d077f336c666c55de7139eda8593f0e95f7d2fa63bde9578cd1defd5fd6f44e53266d0555fac86fd98c1eed00b04db5c845645