Malware Analysis Report

2024-09-22 10:47

Sample ID 240713-clpkfs1drj
Target 3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118
SHA256 8b3b8df6a16eed6edc74e0b57adf7e057e643d572ae1fcd6d806e9c78141e145
Tags
hawkeye latentbot evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8b3b8df6a16eed6edc74e0b57adf7e057e643d572ae1fcd6d806e9c78141e145

Threat Level: Known bad

The file 3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

hawkeye latentbot evasion keylogger persistence spyware stealer trojan

HawkEye

LatentBot

Modifies firewall policy service

Deletes itself

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Modifies registry key

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-07-13 02:10

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-13 02:10

Reported

2024-07-13 02:12

Platform

win7-20240704-en

Max time kernel

150s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

LatentBot

trojan latentbot

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\KSF20FP27A.exe = "C:\\Users\\Admin\\AppData\\Roaming\\KSF20FP27A.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\© Microsoft Real Time Media Stack = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\rtmpltem.exe" C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2888 set thread context of 2648 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
Token: 1 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 31 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 32 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 34 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 35 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2844 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 2844 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 2844 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 2844 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 2888 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2888 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2888 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2888 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2888 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2888 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2888 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2888 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2888 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2888 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2888 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2648 wrote to memory of 2724 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2724 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2724 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2724 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2724 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2724 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2724 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 1752 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 1752 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 1752 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 1752 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 1752 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 1752 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 1752 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2220 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2220 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2220 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2220 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2220 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2220 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2220 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2124 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2124 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2124 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2124 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2124 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2124 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2124 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2888 wrote to memory of 780 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe
PID 2888 wrote to memory of 780 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe
PID 2888 wrote to memory of 780 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe
PID 2888 wrote to memory of 780 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe
PID 2124 wrote to memory of 2116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2124 wrote to memory of 2116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2124 wrote to memory of 2116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2124 wrote to memory of 2116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2124 wrote to memory of 2116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2124 wrote to memory of 2116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2124 wrote to memory of 2116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2220 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2220 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2220 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2220 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2220 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2220 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2220 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2724 wrote to memory of 2052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2724 wrote to memory of 2052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2724 wrote to memory of 2052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\KSF20FP27A.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\KSF20FP27A.exe:*:Enabled:Windows Messanger" /f

C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe

"C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\KSF20FP27A.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\KSF20FP27A.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f

C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe

"C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 dcomete70353.zapto.org udp
US 8.8.8.8:53 1dcomete70353.zapto.org udp
US 8.8.8.8:53 2dcomete70353.zapto.org udp
US 8.8.8.8:53 3dcomete70353.zapto.org udp
FR 78.159.134.214:4443 3dcomete70353.zapto.org tcp
US 8.8.8.8:53 4dcomete70353.zapto.org udp
US 8.8.8.8:53 5dcomete70353.zapto.org udp
US 8.8.8.8:53 6dcomete70353.zapto.org udp
US 8.8.8.8:53 7dcomete70353.zapto.org udp
US 8.8.8.8:53 8dcomete70353.zapto.org udp

Files

memory/2844-0-0x0000000074C11000-0x0000000074C12000-memory.dmp

memory/2844-1-0x0000000074C10000-0x00000000751BB000-memory.dmp

memory/2844-2-0x0000000074C10000-0x00000000751BB000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

MD5 3fc92e5d34ae656ad8ef85e0ee1e4f12
SHA1 ed670181751fcc091b3419cb6b7081adbd5ac722
SHA256 8b3b8df6a16eed6edc74e0b57adf7e057e643d572ae1fcd6d806e9c78141e145
SHA512 752e26940de0a40a1e6937007f927695d49329468eed0936dc7e264252bd75f9ae206cfe8ccc6fe0b14d1a14ce161e87985623a671fdf603ef17ff5b44265431

memory/2844-14-0x0000000074C10000-0x00000000751BB000-memory.dmp

memory/2888-17-0x0000000074C10000-0x00000000751BB000-memory.dmp

memory/2888-16-0x0000000074C10000-0x00000000751BB000-memory.dmp

memory/2888-15-0x0000000074C10000-0x00000000751BB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

MD5 7b453da9d6310a2202dcbb8202b45419
SHA1 351759ae45f546891fa517c5c766166a4d54b501
SHA256 17eb0cb7912c45766f98b7df016fa8a007a9c7f7e16b441a25ab63f8e7a82bbd
SHA512 b505209ab597fcf2674fa3bc39739978cf7ce5244883bbcdaac87c143a3a815cd6fc3316ebc8fecb9081a3c2e300c76768f290060cef09e848129f4279972be0

memory/2648-31-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2648-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2648-27-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2648-26-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2648-23-0x0000000000400000-0x0000000000470000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe

MD5 4777f65333a1f79b6eaa5eba507a855a
SHA1 007e6756a99e86410c24f078b2edf21a9c302aa1
SHA256 8a1fff36d4f7aac527918f7e8e7de942fec16ed0bc50d0a11ba11557d01a0be6
SHA512 40ee3626d28f927fee786aa05729d61a3082a3fe5c5ce4f53a24cc65407f4470dc660bfe60099d6baaddb8a32fbf1755ea791e6283c1c1f0152f0840ddc9cdeb

memory/2648-51-0x0000000010000000-0x000000001000F000-memory.dmp

memory/2888-53-0x0000000074C10000-0x00000000751BB000-memory.dmp

memory/2648-54-0x0000000000400000-0x0000000000470000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-13 02:10

Reported

2024-07-13 02:12

Platform

win10v2004-20240709-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

LatentBot

trojan latentbot

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\KSF20FP27A.exe = "C:\\Users\\Admin\\AppData\\Roaming\\KSF20FP27A.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\© Microsoft Real Time Media Stack = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\rtmpltem.exe" C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4132 set thread context of 4168 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
Token: 1 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 31 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 32 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 34 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 35 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2624 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Local\Temp\3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 2624 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Local\Temp\3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 2624 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Local\Temp\3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 4132 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4132 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4132 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4132 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4132 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4132 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4132 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4132 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4168 wrote to memory of 4144 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4168 wrote to memory of 4144 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4168 wrote to memory of 4144 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4168 wrote to memory of 2012 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4168 wrote to memory of 2012 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4168 wrote to memory of 2012 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4168 wrote to memory of 3608 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4168 wrote to memory of 3608 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4168 wrote to memory of 3608 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4168 wrote to memory of 3660 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4168 wrote to memory of 3660 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4168 wrote to memory of 3660 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4132 wrote to memory of 376 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe
PID 4132 wrote to memory of 376 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe
PID 4132 wrote to memory of 376 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe
PID 3608 wrote to memory of 3444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2012 wrote to memory of 3652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3608 wrote to memory of 3444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3608 wrote to memory of 3444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2012 wrote to memory of 3652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2012 wrote to memory of 3652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4144 wrote to memory of 2348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4144 wrote to memory of 2348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4144 wrote to memory of 2348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3660 wrote to memory of 1996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3660 wrote to memory of 1996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3660 wrote to memory of 1996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 376 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe
PID 376 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe
PID 376 wrote to memory of 4584 N/A C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\KSF20FP27A.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\KSF20FP27A.exe:*:Enabled:Windows Messanger" /f

C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe

"C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\KSF20FP27A.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\KSF20FP27A.exe:*:Enabled:Windows Messanger" /f

C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe

"C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 dcomete70353.zapto.org udp
US 8.8.8.8:53 dcomete70353.zapto.org udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 1dcomete70353.zapto.org udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 2dcomete70353.zapto.org udp
US 8.8.8.8:53 3dcomete70353.zapto.org udp
FR 78.159.134.214:4443 3dcomete70353.zapto.org tcp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 4dcomete70353.zapto.org udp
US 8.8.8.8:53 5dcomete70353.zapto.org udp
US 8.8.8.8:53 6dcomete70353.zapto.org udp
US 8.8.8.8:53 7dcomete70353.zapto.org udp
US 8.8.8.8:53 8dcomete70353.zapto.org udp

Files

memory/2624-0-0x0000000075492000-0x0000000075493000-memory.dmp

memory/2624-1-0x0000000075490000-0x0000000075A41000-memory.dmp

memory/2624-2-0x0000000075490000-0x0000000075A41000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

MD5 3fc92e5d34ae656ad8ef85e0ee1e4f12
SHA1 ed670181751fcc091b3419cb6b7081adbd5ac722
SHA256 8b3b8df6a16eed6edc74e0b57adf7e057e643d572ae1fcd6d806e9c78141e145
SHA512 752e26940de0a40a1e6937007f927695d49329468eed0936dc7e264252bd75f9ae206cfe8ccc6fe0b14d1a14ce161e87985623a671fdf603ef17ff5b44265431

memory/2624-13-0x0000000075490000-0x0000000075A41000-memory.dmp

memory/4132-14-0x0000000075490000-0x0000000075A41000-memory.dmp

memory/4132-15-0x0000000075490000-0x0000000075A41000-memory.dmp

memory/4132-16-0x0000000075490000-0x0000000075A41000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

MD5 7b453da9d6310a2202dcbb8202b45419
SHA1 351759ae45f546891fa517c5c766166a4d54b501
SHA256 17eb0cb7912c45766f98b7df016fa8a007a9c7f7e16b441a25ab63f8e7a82bbd
SHA512 b505209ab597fcf2674fa3bc39739978cf7ce5244883bbcdaac87c143a3a815cd6fc3316ebc8fecb9081a3c2e300c76768f290060cef09e848129f4279972be0

memory/4168-22-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4168-24-0x0000000000400000-0x0000000000470000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe

MD5 4777f65333a1f79b6eaa5eba507a855a
SHA1 007e6756a99e86410c24f078b2edf21a9c302aa1
SHA256 8a1fff36d4f7aac527918f7e8e7de942fec16ed0bc50d0a11ba11557d01a0be6
SHA512 40ee3626d28f927fee786aa05729d61a3082a3fe5c5ce4f53a24cc65407f4470dc660bfe60099d6baaddb8a32fbf1755ea791e6283c1c1f0152f0840ddc9cdeb

memory/4168-41-0x0000000010000000-0x000000001000F000-memory.dmp

memory/4132-43-0x0000000075490000-0x0000000075A41000-memory.dmp