Malware Analysis Report

2025-01-02 13:04

Sample ID 240703-b1yw1avdqp
Target 20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118
SHA256 eec3f523a932a73b97b200533024d6aa744af4d9e4219bf5759a9b6436764eeb
Tags
cybergate evasion persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

eec3f523a932a73b97b200533024d6aa744af4d9e4219bf5759a9b6436764eeb

Threat Level: Known bad

The file 20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

cybergate evasion persistence stealer trojan upx

UAC bypass

CyberGate, Rebhip

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Molebox Virtualization software

Executes dropped EXE

UPX packed file

Checks whether UAC is enabled

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

System policy modification

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-03 01:37

Signatures

Molebox Virtualization software

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-03 01:37

Reported

2024-07-03 01:39

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

150s

Command Line

winlogon.exe

Signatures

CyberGate, Rebhip

trojan stealer cybergate

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\windows\SysWOW64\microsoft\Win_Xp.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{218A3Q1V-M05N-O32L-4AM8-MA0JEIMDL4ML} C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{218A3Q1V-M05N-O32L-4AM8-MA0JEIMDL4ML}\StubPath = "c:\\windows\\system32\\microsoft\\Win_Xp.exe Restart" C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{218A3Q1V-M05N-O32L-4AM8-MA0JEIMDL4ML} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{218A3Q1V-M05N-O32L-4AM8-MA0JEIMDL4ML}\StubPath = "c:\\windows\\system32\\microsoft\\Win_Xp.exe" C:\Windows\SysWOW64\explorer.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\windows\SysWOW64\microsoft\Win_Xp.exe N/A

Molebox Virtualization software

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\windows\SysWOW64\microsoft\Win_Xp.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification \??\c:\windows\SysWOW64\microsoft\ C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
File created \??\c:\windows\SysWOW64\microsoft\Win_Xp.exe C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\SysWOW64\microsoft\Win_Xp.exe C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\SysWOW64\microsoft\Win_Xp.exe C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3348 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 3348 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 3348 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 3348 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 3348 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 3348 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 3348 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 3348 wrote to memory of 3976 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 3348 wrote to memory of 4076 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3348 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 3348 wrote to memory of 4104 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3348 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3348 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3348 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe C:\Windows\Explorer.EXE

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\windows\SysWOW64\microsoft\Win_Xp.exe N/A

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s nsi

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Windows\sysmon.exe

C:\Windows\sysmon.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe"

C:\windows\SysWOW64\microsoft\Win_Xp.exe

"C:\windows\system32\microsoft\Win_Xp.exe"

C:\Windows\System32\WaaSMedicAgent.exe

C:\Windows\System32\WaaSMedicAgent.exe e4e2b9e36caeb357872059215f9a9d69 3+Sb2rmYQ06XflIml734oQ.0.1.0.0.0

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc

C:\Windows\System32\mousocoreworker.exe

C:\Windows\System32\mousocoreworker.exe -Embedding

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 98.58.20.217.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 26.178.89.13.in-addr.arpa udp

Files

memory/3348-11-0x00000000771B0000-0x00000000772A0000-memory.dmp

memory/3348-15-0x00000000771B0000-0x00000000772A0000-memory.dmp

memory/3348-17-0x0000000002530000-0x000000000355A000-memory.dmp

memory/3348-22-0x0000000004220000-0x0000000004221000-memory.dmp

memory/3348-27-0x00000000771B0000-0x00000000772A0000-memory.dmp

memory/3348-26-0x00000000771B0000-0x00000000772A0000-memory.dmp

memory/3348-25-0x0000000002390000-0x0000000002392000-memory.dmp

memory/3348-21-0x0000000002390000-0x0000000002392000-memory.dmp

memory/3348-24-0x0000000002530000-0x000000000355A000-memory.dmp

memory/3348-9-0x0000000002530000-0x000000000355A000-memory.dmp

memory/3348-10-0x00000000771B0000-0x00000000772A0000-memory.dmp

memory/3348-12-0x00000000771B0000-0x00000000772A0000-memory.dmp

memory/3348-8-0x00000000771B0000-0x00000000772A0000-memory.dmp

memory/3348-7-0x00000000771D0000-0x00000000771D1000-memory.dmp

memory/3348-6-0x00000000021A0000-0x00000000021B0000-memory.dmp

memory/3348-5-0x0000000002290000-0x00000000022A0000-memory.dmp

memory/3348-4-0x0000000077B02000-0x0000000077B03000-memory.dmp

memory/3348-3-0x0000000002280000-0x0000000002290000-memory.dmp

memory/3348-2-0x00000000020F0000-0x000000000213E000-memory.dmp

memory/3348-1-0x00000000008F0000-0x00000000008F1000-memory.dmp

memory/3348-0-0x0000000000400000-0x0000000000476000-memory.dmp

memory/1136-36-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

memory/3348-34-0x0000000024080000-0x00000000240E2000-memory.dmp

memory/1136-35-0x0000000000E20000-0x0000000000E21000-memory.dmp

memory/3348-31-0x0000000024010000-0x0000000024072000-memory.dmp

\??\c:\windows\SysWOW64\microsoft\Win_Xp.exe

MD5 20a336d0e560c5dfd55e2f90dda5afe8
SHA1 4a899d324f43908862c7d4277d409b624452d645
SHA256 eec3f523a932a73b97b200533024d6aa744af4d9e4219bf5759a9b6436764eeb
SHA512 1f2e07db2f2bd02481a8d5a7b8075f7ac6b510655ba0654db16e6c9678863c18fd7153968817d7743c93e02e016491acbeb80fe883fc19eb2d99e1b747771987

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

MD5 de291a7303537f1770b8d411fb4130a2
SHA1 890dc55092d4bf75135f3c8d013fa2aa61bff5e4
SHA256 b7197c52605a2de5e987854355d8d91958142a5b5e6984244a3fce2149c4983c
SHA512 7825f5dfabe7744ceccf2f184e316e31f01eda6eacfb838e75c42379d50f369e0eb36eb30de9e1f23bce110f85f904ce9e0ffeac8d7fc2e017cabcd3ba831fd9

memory/3348-180-0x00000000020F0000-0x000000000213E000-memory.dmp

memory/3348-181-0x00000000771B0000-0x00000000772A0000-memory.dmp

C:\Users\Admin\AppData\Roaming\logs.dat

MD5 e21bd9604efe8ee9b59dc7605b927a2a
SHA1 3240ecc5ee459214344a1baac5c2a74046491104
SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
SHA512 42052ad5744ad76494bfa71d78578e545a3b39bfed4c4232592987bd28064b6366a423084f1193d137493c9b13d9ae1faac4cf9cc75eb715542fa56e13ca1493

C:\Windows\SYSTEM.INI

MD5 a0a9be4ecc3f4881f3bc7beb41c4deae
SHA1 884203fd000add51532e9e48ceae2d1c27a132ef
SHA256 69330bbe10b0d970c43e53833f36e12c11da489e2bacf16aac6dbd1a5ae46093
SHA512 9da2d198e2021cd9c5ff43a5007bf6b7a55b6d78c1cb4692fda4502d7a6cb77af3c8b97abac953dda142e704f05d08697592d359b5b62a4a61dda4562edc0461

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 15a5ec004eb2e41060ed48e6463a035b
SHA1 8b270eb5d250405be0145fb718b41698146cf5f8
SHA256 40464a582418cee99d42357fc8f4bde646aacbe447e57fbd44722726e12a1b69
SHA512 2831c4fe1d6ebb6f41a3e8f9e6078c0d2c3189d46ac88706ea058bc7a3223c5c4222b65a67b2acf3fd61fe27f428efdafb576eb4c9a239354ff9808bc1470344

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 1db1d427b9403029a75aa08819780bb5
SHA1 78fcfcff32db3723b717dc23f83064990e7f63ce
SHA256 c95ce379ea5b2dc07704f6eed9c2c65e1e335242621e9e8e9929fb82197b27c2
SHA512 34d47d63874f5981237bc5b91dac9e2afee4287ea0eb33a3091fe5c12cbb13e30e15c0cf091f2d5f88fb2c3d3040d6fecf68379cc2478938d4cc599e82fdae33

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 9f07a7b08d7947806d99aae8810567ab
SHA1 9a865bead273860c4155638330ae2c736f1351dc
SHA256 dc7af5bb8b493aac663f2e6a4dd5623b78f9b64553b9d6190dda85a20c90a1f5
SHA512 ef6c556d92d97efe64cc6ccfb708bdd3269874fff1ab1cbac6e8fc7943476819c05bfb8fb23d6f263934695aadf767918a3bc6a53b17d14a4713b7300d308396

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 69a81a33bd4b376686818a98f21d1078
SHA1 032e95f83a6fa39651ec4ea2e01e2ee78bcb1685
SHA256 adb24cd5bed065d1e77340b184c0f335d99126a656adce80936da6810b761c95
SHA512 6a3aeea150046e4f3df2fae6e2327d6ad85a0280e9a77224a11001a918320f7f1f03aa60470401c3e61f895ccb9d2c6db89d48c035156cfd9ea31c023f32f185

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 a532c8bf2b3751454e2eb3940f3b85bc
SHA1 b87dc2cbc06bf7ccf028d59f464e1435c095c2c5
SHA256 ac532ca684a13a362aa2d87474cbdb27fb5d04f93d52d018c28cc1b59b71fc01
SHA512 9c04ee6b6af72f583737f8c3af786db743f54a0d106c8132d398db0c366e955c1939c1d09e6a280063110cba7086de0ad7b8764166455514a2e74047b3e435d1

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 78a108a42fa1789975eaae9a2660a1dc
SHA1 04b5ee5273a6b3e81e88d55c7dcdcac12b9ec44d
SHA256 4c4a896fb4a97a6298660a9bbd9acc6725af53377aa61c62d1c0bd7aa5a3bbc3
SHA512 af6d09a6e3a0c1f116f72235a74ae1925d82c28c8cd5139c57bd435490ca3a4d0c6bd9a13e2e29c15ed6e9dc9278380ed31f1cd1a96c6174c3cd1b212dffde7d

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 97633d1ed5fb50c7b973e7ed1c6dc846
SHA1 4a9b0c6f4d63290fe582f108912700fef904ad0d
SHA256 6ad079753c9a10382275278b07934137550bfa3fdb4756be8b5cc6525b9ef7c3
SHA512 f1c8346f146ce937e0964c7e9d59ce777aa2d0598a23f56a09e5736a19bc2fa007a8980c6db397f2aa033e42a6824d599bd7b864651cb931d7ec038e00516473

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 d8886c89f4605180e91fe91c29804234
SHA1 777fa8c038f3d3f3cde4432843c3d8f8db41afab
SHA256 2bc5a9c105b130282c043469b41021faac4b2c78dda938084a9d6a25b1bc461a
SHA512 5fe3d5da8da21282f5ad51914ffe26110624491e73994593abd627f896e9523fd81c1344a7dadae6dc3ef19fe0ec8f788e9c18bad207331573df0c30f1991788

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 568e8a4b0b281eed04ac921d9b9fc53c
SHA1 8b11a349b288528a34c8067b19de770a65aba6f5
SHA256 0293791272d47cea4ed62e308127dfef0b0796bf79e1f83fbf8e2b6a8127705b
SHA512 5a89307cfb73ab4faf85ac9af8022a17edcff4003e0ddbae8864d0596880604081242f487a68dc930f702fac516618f538ceec2b0a4119a74646bdc9e773439f

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 856bfe47de45435d8fb0a3c9cf5f1864
SHA1 6fa1896279a9099c7cb6e01fc433528a9840d087
SHA256 15e1a8b58558542a2e26d360ab9f9a46c87186b735db428b098680c1cc0ef142
SHA512 a1202474f18c8aa2371880f1f022c0db352358a624eabc54fb1ea9ff395e96396ed1452fe4b6d6be6ffeadaafb3eaf77d26dfff5cf9e1deade95af860a98cbf5

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 5e4097cfc42fa19a71630e2ead389c55
SHA1 5700bf1ea90c65811bfa43023387c3e3c9588600
SHA256 7f90f2371e139e79b6ac886ff1965bfceb109ff09369c954bf67473182f9198d
SHA512 6168c1d7fff0f43d8bb6eb18543e6c854f7990c935327bbecdc4cf10e264cdcb2c7036baa7c6dd5c19bed034e6e843ec63e159a0cf71b13be62ae2b17fe5b69f

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 424f2c131ecc73d6248ffc91cb706867
SHA1 7c48ad3ae303b57dafc8694d6a9ab6cfc5d4f992
SHA256 32d0b442bfff347325551a6584962b14836231baaa10727ab8205b451aa9da2b
SHA512 0eac4562942459191662ac57a3a51981500215a5cab91e812cc0355f35f923e46de0e0ae287fa04274e9dc441a86cb867046ae105ab5d310dd8cf4e16ed462be

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 5425a32859915e526e1a4e4de9eb4e10
SHA1 3d312175d94aba94f734d2d5df6c76a68e9ebaa1
SHA256 22ab1b6662c8ab22795a2b9fbe808b4d5d1b5cc76295feb0c5c74cdc00dd0e5e
SHA512 cd03026da3bc9fbf9e6cb280b7ab1c3199f70dffee4ff97382cf3c42788f9fcb85b73e56879ae20efbd1f37a5b2abf67619925c4fca8faa1d95ac4769c8782d3

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 f639f57b26327691b5f591987fe746bc
SHA1 deec171565a85d8c581143048497cef0874a2b6d
SHA256 9c7a30676c3cbfa8a339d20ac6e9e0a01a2b97d38f3e2006d0b9b7d33719f74b
SHA512 067c45f95ac9dd876b454eefa09c53056d9e0ffa10ef5d367c6a8fba4e3b86eecee18ad5d2844ee0795c85626ccaf7ae85274b6e2a054b52636f699a53da1be6

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 1b85817b49c7c472f5a486fa5429b3a4
SHA1 788482183246a01a90f1289e4a61bdecfe916cb8
SHA256 f26ba36fe86d6e5a5f090a5c8807fa2374259d1f2d169562d84587d07a9f1320
SHA512 f215351d60db063edf8f1660f663f87ea273c1f76b3466688cdb1eabe92c898d49aecdd377eaae65b03ce6bcf6dd44f6fe82b02bb8bf91d17fe688734cded7d7

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 3d7f30ea460483d210c87ae97358622e
SHA1 c843e4a14959fc597888338b7729ba6aaeded550
SHA256 248c43b2c6deb7db897cd58cb88d60929e8f4591b72c06701c1fb1f48802b088
SHA512 ee7c86302a16d90930aee737feced80d68cab2d6eda1179fbea75407a2df0421bafb67e803dbea93899a7b0939a5a56c875453a336aa13102194036c25060fda

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 91b9604364e8d197af09cadfe3947adc
SHA1 64925051d2fbaf9f0057f59263979d585eae4667
SHA256 460a6f8a3b717143ff04d6e0eedf662d4d00c3ea142a6dcc0990ea6036400b47
SHA512 ef2c1ab41e5d197fe0632b13a91889cc7a1d75cc9a6fc1a4e8bdbc71130e9691a84bf22e5ce425f2d9e2bf0b46f92fb5442e3c9b7d2520c364f9ddfbb6aff5b9

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 c7d417cc20cc42e0f2ec655aeac41c75
SHA1 3a75a7dc02b26b2bab91c38e8e40315101c96670
SHA256 c56dd960dfb9117c30a176a040defcde63eed3a792460358d42a63f0d18a2259
SHA512 3b1019ac334cd2ebf6b485f2d8af5303eea58d17ed9cbf97add13836fecfcf9f10d8467e9003eb3c45c0c777b5ecb5d8921a206884ebf0328148c384c499de25

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-03 01:37

Reported

2024-07-03 01:39

Platform

win7-20240611-en

Max time kernel

120s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\20a336d0e560c5dfd55e2f90dda5afe8_JaffaCakes118.exe"

Network

N/A

Files

memory/1176-1-0x00000000002A0000-0x00000000002EE000-memory.dmp

memory/1176-0-0x0000000000230000-0x0000000000231000-memory.dmp

memory/1176-2-0x0000000000250000-0x0000000000260000-memory.dmp

memory/1176-6-0x0000000074F51000-0x0000000074F52000-memory.dmp

memory/1176-5-0x0000000077430000-0x0000000077431000-memory.dmp

memory/1176-4-0x0000000000270000-0x0000000000280000-memory.dmp

memory/1176-3-0x0000000000400000-0x0000000000476000-memory.dmp

memory/1176-7-0x0000000074F40000-0x0000000075050000-memory.dmp

memory/1176-8-0x0000000000400000-0x0000000000476000-memory.dmp

memory/1176-10-0x0000000074F40000-0x0000000075050000-memory.dmp

memory/1176-9-0x00000000002A0000-0x00000000002EE000-memory.dmp