Malware Analysis Report

2024-11-16 12:11

Sample ID 240717-rx2rgsvdqq
Target 536ab617bd5a7399c77eeb288de2df89_JaffaCakes118
SHA256 e2bf3a8de903d3135e38271df18f882e5b35d0092156035151e1002eccb3d4cb
Tags
neshta persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e2bf3a8de903d3135e38271df18f882e5b35d0092156035151e1002eccb3d4cb

Threat Level: Known bad

The file 536ab617bd5a7399c77eeb288de2df89_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

neshta persistence spyware stealer

Neshta

Detect Neshta payload

Loads dropped DLL

Reads user/profile data of web browsers

Modifies system executable filetype association

Checks computer location settings

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-17 14:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-17 14:35

Reported

2024-07-17 14:37

Platform

win7-20240704-en

Max time kernel

91s

Max time network

19s

Command Line

"C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Neshta

persistence spyware neshta

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2472 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe
PID 2472 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe
PID 2472 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe
PID 2472 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe
PID 2472 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe
PID 2472 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe
PID 2472 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe
PID 2472 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe
PID 2472 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe
PID 2472 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe
PID 2472 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe
PID 2472 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe

Processes

C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe"

Network

N/A

Files

memory/2472-0-0x000000007485E000-0x000000007485F000-memory.dmp

memory/2472-1-0x0000000000D90000-0x0000000000E1C000-memory.dmp

memory/2472-2-0x0000000000CE0000-0x0000000000D70000-memory.dmp

memory/2472-3-0x0000000074850000-0x0000000074F3E000-memory.dmp

memory/2472-4-0x0000000000490000-0x00000000004A2000-memory.dmp

memory/2472-5-0x000000007485E000-0x000000007485F000-memory.dmp

memory/2472-6-0x0000000074850000-0x0000000074F3E000-memory.dmp

memory/2472-7-0x0000000005210000-0x000000000526E000-memory.dmp

memory/2884-8-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2884-19-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2884-20-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2884-18-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2884-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2884-15-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2884-14-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2884-12-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2884-13-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2884-11-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2884-10-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2472-24-0x0000000074850000-0x0000000074F3E000-memory.dmp

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

MD5 283ddb24a12daa7ebab33d06020e61a5
SHA1 5314e55c89a2e178e1c45dd10ee9bd0f16729f94
SHA256 1f637ab41edc0ce254e51e897614473d4e3994e1f4656520d9cccf42ed306dad
SHA512 753f18b701425154bde9f626ca6661aa9976daf101c6700bb0a6b24b4baccf0f3728abaee37136d72bf12c03d2ca1ec3fcc6a28ac623065bf35a91086ef7591b

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-17 14:35

Reported

2024-07-17 14:37

Platform

win10v2004-20240709-en

Max time kernel

141s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Neshta

persistence spyware neshta

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~3.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13187~1.41\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4556 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe
PID 4556 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe
PID 4556 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe
PID 4556 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe
PID 4556 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe
PID 4556 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe
PID 4556 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe
PID 4556 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe
PID 4556 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe
PID 4556 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe
PID 4556 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe

Processes

C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

memory/4556-0-0x0000000074FBE000-0x0000000074FBF000-memory.dmp

memory/4556-1-0x0000000000D50000-0x0000000000DDC000-memory.dmp

memory/4556-2-0x0000000007BF0000-0x0000000007C80000-memory.dmp

memory/4556-3-0x0000000008430000-0x00000000089D4000-memory.dmp

memory/4556-4-0x0000000074FB0000-0x0000000075760000-memory.dmp

memory/4556-5-0x00000000080A0000-0x0000000008132000-memory.dmp

memory/4556-6-0x0000000005260000-0x000000000526A000-memory.dmp

memory/4556-7-0x0000000008350000-0x00000000083EC000-memory.dmp

memory/4556-8-0x0000000005870000-0x0000000005882000-memory.dmp

memory/4556-9-0x0000000074FBE000-0x0000000074FBF000-memory.dmp

memory/4556-10-0x0000000074FB0000-0x0000000075760000-memory.dmp

memory/4556-11-0x0000000006600000-0x000000000665E000-memory.dmp

memory/5004-12-0x0000000000400000-0x000000000041B000-memory.dmp

memory/5004-13-0x0000000000400000-0x000000000041B000-memory.dmp

memory/5004-15-0x0000000000400000-0x000000000041B000-memory.dmp

memory/5004-17-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4556-18-0x0000000074FB0000-0x0000000075760000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\536ab617bd5a7399c77eeb288de2df89_JaffaCakes118.exe

MD5 ad21938be44da1736ff4f0bdddc43e12
SHA1 608084ecc01f6081ab78217a56739c7a55b98f5c
SHA256 8bbc01490a0460190e840bfdec5f83594cf0dd0985234e6e6e36f6150a20c28f
SHA512 2cda2aa8f407dc9ec88a56f257d969c6da5d1142ed82653d28760a2271a90dfbff86699b0ea61f588350caa53f209110015ec504cbbe0b06d6fee23744bfb190

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

MD5 679e827dd8b6a3d29e47153f6ceef0a9
SHA1 6b0c343811f4f4deed609cf20cceede3b6d42c34
SHA256 bda9c9cb80cc5f6c31f18c982b7dd31ddef7a44bada4183ba23a41995677f230
SHA512 7a843224f1039a30b5b60e75a64030b1b9bd3ad1d4e136e717d358e86f43a0a0960e98f42230f5efd5d7b85767ad8c5a0a00035fc291becf932b5bbe8d4c8de7

memory/5004-114-0x0000000000400000-0x000000000041B000-memory.dmp