Malware Analysis Report

2024-09-22 10:44

Sample ID 240703-pmywqsvarh
Target 2264289f009d42213b66cffcbf5a10e3_JaffaCakes118
SHA256 2305bde763611feb701816efdf831e878e28bd0091c06f3475b6706973343894
Tags
hawkeye evasion keylogger persistence spyware stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2305bde763611feb701816efdf831e878e28bd0091c06f3475b6706973343894

Threat Level: Known bad

The file 2264289f009d42213b66cffcbf5a10e3_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

hawkeye evasion keylogger persistence spyware stealer trojan upx

HawkEye

Modifies firewall policy service

Adds policy Run key to start application

Boot or Logon Autostart Execution: Active Setup

Deletes itself

UPX packed file

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies registry key

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-07-03 12:27

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-03 12:27

Reported

2024-07-03 12:29

Platform

win7-20240221-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2264289f009d42213b66cffcbf5a10e3_JaffaCakes118.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\RunescapeHack.exe = "C:\\Users\\Admin\\AppData\\Roaming\\RunescapeHack.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\svchost.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\111 = "C:\\Users\\Admin\\AppData\\Roaming\\RunescapeHack.exe" C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DEE2FBC3-DAB2-DE0F-DADA-C5FFAE35AF4F} C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DEE2FBC3-DAB2-DE0F-DADA-C5FFAE35AF4F}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\RunescapeHack.exe" C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{DEE2FBC3-DAB2-DE0F-DADA-C5FFAE35AF4F} C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Active Setup\Installed Components\{DEE2FBC3-DAB2-DE0F-DADA-C5FFAE35AF4F}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\RunescapeHack.exe" C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\111 = "C:\\Users\\Admin\\AppData\\Roaming\\RunescapeHack.exe" C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\111 = "C:\\Users\\Admin\\AppData\\Roaming\\RunescapeHack.exe" C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\audiodgi.exe" C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2532 set thread context of 2724 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2264289f009d42213b66cffcbf5a10e3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2524 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\2264289f009d42213b66cffcbf5a10e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2524 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\2264289f009d42213b66cffcbf5a10e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2524 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\2264289f009d42213b66cffcbf5a10e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2524 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\2264289f009d42213b66cffcbf5a10e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2532 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2532 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2532 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2532 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2532 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2532 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2532 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2532 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2532 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
PID 2532 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
PID 2532 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
PID 2532 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
PID 2724 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2452 wrote to memory of 2052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2452 wrote to memory of 2052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2452 wrote to memory of 2052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2452 wrote to memory of 2052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2504 wrote to memory of 1600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2504 wrote to memory of 1600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2504 wrote to memory of 1600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2504 wrote to memory of 1600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2896 wrote to memory of 2332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2896 wrote to memory of 2332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2896 wrote to memory of 2332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2896 wrote to memory of 2332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2560 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2560 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2560 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2560 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2976 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 2976 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 2976 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 2976 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 2780 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 2780 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 2780 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 2780 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2264289f009d42213b66cffcbf5a10e3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\2264289f009d42213b66cffcbf5a10e3_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe

"C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\RunescapeHack.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\RunescapeHack.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\RunescapeHack.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\RunescapeHack.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

"C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe"

C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 sourcehost.no-ip.biz udp
ES 94.73.32.191:3333 sourcehost.no-ip.biz tcp
ES 94.73.32.191:3333 sourcehost.no-ip.biz tcp
US 8.8.8.8:53 1sourcehost.no-ip.biz udp
US 8.8.8.8:53 2sourcehost.no-ip.biz udp
US 8.8.8.8:53 3sourcehost.no-ip.biz udp
ES 94.73.36.129:3333 3sourcehost.no-ip.biz tcp
US 8.8.8.8:53 4sourcehost.no-ip.biz udp
US 8.8.8.8:53 5sourcehost.no-ip.biz udp
US 8.8.8.8:53 6sourcehost.no-ip.biz udp
US 8.8.8.8:53 7sourcehost.no-ip.biz udp
US 8.8.8.8:53 8sourcehost.no-ip.biz udp

Files

memory/2524-0-0x0000000074711000-0x0000000074712000-memory.dmp

memory/2524-1-0x0000000074710000-0x0000000074CBB000-memory.dmp

memory/2524-2-0x0000000074710000-0x0000000074CBB000-memory.dmp

\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 2264289f009d42213b66cffcbf5a10e3
SHA1 514a24dd120158bcfb5f1e3ce9b5e239bd96c43d
SHA256 2305bde763611feb701816efdf831e878e28bd0091c06f3475b6706973343894
SHA512 2acacb25a27beb28b0b3ba0ef75f0e0d98076778d6d244586b75b09f0b12d3432f7bcd588a6bcf50652b6ca584d2c815304c83f1a5b485f24b9799b10a9081b5

memory/2532-22-0x0000000074710000-0x0000000074CBB000-memory.dmp

memory/2524-21-0x0000000074710000-0x0000000074CBB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe

MD5 a6deb877c0f1f4ded2d2ad0b885824ce
SHA1 b470b92025d3e85dde8f76cf46be9456d4692aec
SHA256 484f423590c54da0296682b7e82ad33901f08f464415c10608f352c88f1b0782
SHA512 d7d2b759431bfcce8649fc7b49cbccaa5b47e31661ab08932af058e3a7bccff8f0b60303e6d53fe0979f6b9378f487f41095f991096cb9270b6129b456159ff7

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

MD5 0d3766182ed84d9eefdd43b8a4455a06
SHA1 718aa8c791ea243cfebf06ebe70e43e8d5040b25
SHA256 0cc01f94732bc99086ce9a1db18f0e34466c112b87ceafeaa31f2fec5be0e65b
SHA512 e9730586a72826053569b52be6f2d1a9a657e51b8f911c4379aee36a541c64c01ca3b51ad9eee16c227cf12caedda450be0251af43dbeff156177dd22973c9de

memory/2532-24-0x0000000074710000-0x0000000074CBB000-memory.dmp

memory/2724-26-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2724-28-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2724-33-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2724-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2724-30-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2724-36-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2724-37-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2724-40-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2532-53-0x0000000074710000-0x0000000074CBB000-memory.dmp

memory/2724-54-0x0000000000400000-0x0000000000473000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-03 12:27

Reported

2024-07-03 12:29

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2264289f009d42213b66cffcbf5a10e3_JaffaCakes118.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\RunescapeHack.exe = "C:\\Users\\Admin\\AppData\\Roaming\\RunescapeHack.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\wmpmetwk.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\111 = "C:\\Users\\Admin\\AppData\\Roaming\\RunescapeHack.exe" C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DEE2FBC3-DAB2-DE0F-DADA-C5FFAE35AF4F}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\RunescapeHack.exe" C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{DEE2FBC3-DAB2-DE0F-DADA-C5FFAE35AF4F} C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{DEE2FBC3-DAB2-DE0F-DADA-C5FFAE35AF4F}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\RunescapeHack.exe" C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DEE2FBC3-DAB2-DE0F-DADA-C5FFAE35AF4F} C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2264289f009d42213b66cffcbf5a10e3_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\audiodgi.exe" C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\111 = "C:\\Users\\Admin\\AppData\\Roaming\\RunescapeHack.exe" C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\111 = "C:\\Users\\Admin\\AppData\\Roaming\\RunescapeHack.exe" C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3704 set thread context of 1584 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2264289f009d42213b66cffcbf5a10e3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1400 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\2264289f009d42213b66cffcbf5a10e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1400 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\2264289f009d42213b66cffcbf5a10e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1400 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\2264289f009d42213b66cffcbf5a10e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1028 wrote to memory of 4044 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1028 wrote to memory of 4044 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1028 wrote to memory of 4044 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1028 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
PID 1028 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
PID 1028 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
PID 1920 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 1920 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 1920 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 3704 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 3704 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 3704 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 3704 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 3704 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 3704 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 3704 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 3704 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 1584 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Windows\SysWOW64\cmd.exe
PID 1584 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Windows\SysWOW64\cmd.exe
PID 1584 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Windows\SysWOW64\cmd.exe
PID 1584 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Windows\SysWOW64\cmd.exe
PID 1584 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Windows\SysWOW64\cmd.exe
PID 1584 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Windows\SysWOW64\cmd.exe
PID 1584 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Windows\SysWOW64\cmd.exe
PID 1584 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Windows\SysWOW64\cmd.exe
PID 1584 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Windows\SysWOW64\cmd.exe
PID 1584 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Windows\SysWOW64\cmd.exe
PID 1584 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Windows\SysWOW64\cmd.exe
PID 1584 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Windows\SysWOW64\cmd.exe
PID 4936 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4936 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4936 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1480 wrote to memory of 1460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1480 wrote to memory of 1460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1480 wrote to memory of 1460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2120 wrote to memory of 4964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2120 wrote to memory of 4964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2120 wrote to memory of 4964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4584 wrote to memory of 4680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4584 wrote to memory of 4680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4584 wrote to memory of 4680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2264289f009d42213b66cffcbf5a10e3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\2264289f009d42213b66cffcbf5a10e3_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe

"C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1960,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

"C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe"

C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\RunescapeHack.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\RunescapeHack.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\RunescapeHack.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\RunescapeHack.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 sourcehost.no-ip.biz udp
ES 94.73.32.191:3333 sourcehost.no-ip.biz tcp
ES 94.73.32.191:3333 sourcehost.no-ip.biz tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 1sourcehost.no-ip.biz udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 2sourcehost.no-ip.biz udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 3sourcehost.no-ip.biz udp
ES 94.73.36.129:3333 3sourcehost.no-ip.biz tcp
US 8.8.8.8:53 4sourcehost.no-ip.biz udp
US 8.8.8.8:53 5sourcehost.no-ip.biz udp
US 8.8.8.8:53 120.150.79.40.in-addr.arpa udp
US 8.8.8.8:53 6sourcehost.no-ip.biz udp
US 8.8.8.8:53 7sourcehost.no-ip.biz udp

Files

memory/1400-0-0x0000000074C02000-0x0000000074C03000-memory.dmp

memory/1400-1-0x0000000074C00000-0x00000000751B1000-memory.dmp

memory/1400-2-0x0000000074C00000-0x00000000751B1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 2264289f009d42213b66cffcbf5a10e3
SHA1 514a24dd120158bcfb5f1e3ce9b5e239bd96c43d
SHA256 2305bde763611feb701816efdf831e878e28bd0091c06f3475b6706973343894
SHA512 2acacb25a27beb28b0b3ba0ef75f0e0d98076778d6d244586b75b09f0b12d3432f7bcd588a6bcf50652b6ca584d2c815304c83f1a5b485f24b9799b10a9081b5

C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe

MD5 a6deb877c0f1f4ded2d2ad0b885824ce
SHA1 b470b92025d3e85dde8f76cf46be9456d4692aec
SHA256 484f423590c54da0296682b7e82ad33901f08f464415c10608f352c88f1b0782
SHA512 d7d2b759431bfcce8649fc7b49cbccaa5b47e31661ab08932af058e3a7bccff8f0b60303e6d53fe0979f6b9378f487f41095f991096cb9270b6129b456159ff7

memory/1400-18-0x0000000074C00000-0x00000000751B1000-memory.dmp

memory/1028-22-0x0000000074C00000-0x00000000751B1000-memory.dmp

memory/1028-21-0x0000000074C00000-0x00000000751B1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

MD5 0d3766182ed84d9eefdd43b8a4455a06
SHA1 718aa8c791ea243cfebf06ebe70e43e8d5040b25
SHA256 0cc01f94732bc99086ce9a1db18f0e34466c112b87ceafeaa31f2fec5be0e65b
SHA512 e9730586a72826053569b52be6f2d1a9a657e51b8f911c4379aee36a541c64c01ca3b51ad9eee16c227cf12caedda450be0251af43dbeff156177dd22973c9de

memory/1920-25-0x0000000074C00000-0x00000000751B1000-memory.dmp

memory/1920-26-0x0000000074C00000-0x00000000751B1000-memory.dmp

memory/1920-27-0x0000000074C00000-0x00000000751B1000-memory.dmp

memory/1584-30-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1584-33-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1584-35-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1584-34-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1028-44-0x0000000074C00000-0x00000000751B1000-memory.dmp

memory/1028-45-0x0000000074C00000-0x00000000751B1000-memory.dmp

memory/1920-46-0x0000000074C00000-0x00000000751B1000-memory.dmp

memory/1920-49-0x0000000074C00000-0x00000000751B1000-memory.dmp