Malware Analysis Report

2024-09-22 10:46

Sample ID 240717-t7y5fssfrb
Target 53dd759d56240beba49d6318b4e53197_JaffaCakes118
SHA256 7904257af820db24fcf0cba9fe6cd156eecd2a99c4b837f5807660d2c13b5fb0
Tags
hawkeye evasion keylogger persistence spyware stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7904257af820db24fcf0cba9fe6cd156eecd2a99c4b837f5807660d2c13b5fb0

Threat Level: Known bad

The file 53dd759d56240beba49d6318b4e53197_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

hawkeye evasion keylogger persistence spyware stealer trojan upx

Modifies firewall policy service

HawkEye

Adds policy Run key to start application

Loads dropped DLL

Deletes itself

Executes dropped EXE

UPX packed file

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Program crash

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Modifies registry key

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-07-17 16:42

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-17 16:42

Reported

2024-07-17 16:45

Platform

win7-20240704-en

Max time kernel

150s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\53dd759d56240beba49d6318b4e53197_JaffaCakes118.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\svchost.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\audiodgi.exe" C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\audiodgi.exe" C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2028 set thread context of 2468 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2640 set thread context of 2540 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\53dd759d56240beba49d6318b4e53197_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2200 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\53dd759d56240beba49d6318b4e53197_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2200 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\53dd759d56240beba49d6318b4e53197_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2200 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\53dd759d56240beba49d6318b4e53197_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2200 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\53dd759d56240beba49d6318b4e53197_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2028 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2028 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2028 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2028 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2028 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2028 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2028 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2028 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2468 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2028 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
PID 2028 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
PID 2028 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
PID 2028 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
PID 2696 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 2696 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 2696 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 2696 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 2780 wrote to memory of 2804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2780 wrote to memory of 2804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2780 wrote to memory of 2804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2780 wrote to memory of 2804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 544 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 544 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 544 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 544 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 936 wrote to memory of 2144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 936 wrote to memory of 2144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 936 wrote to memory of 2144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 936 wrote to memory of 2144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2248 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2248 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2248 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2248 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2640 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 2640 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 2640 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 2640 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 2640 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 2640 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 2640 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 2640 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

Processes

C:\Users\Admin\AppData\Local\Temp\53dd759d56240beba49d6318b4e53197_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\53dd759d56240beba49d6318b4e53197_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe

"C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe"

C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

"C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 supr4.no-ip.org udp
ID 212.117.50.228:27018 supr4.no-ip.org tcp
ID 212.117.50.228:27018 supr4.no-ip.org tcp
US 8.8.8.8:53 1supr4.no-ip.org udp
US 8.8.8.8:53 2supr4.no-ip.org udp
US 8.8.8.8:53 3supr4.no-ip.org udp
ID 212.117.50.228:27018 3supr4.no-ip.org tcp
US 8.8.8.8:53 4supr4.no-ip.org udp
US 8.8.8.8:53 5supr4.no-ip.org udp
US 8.8.8.8:53 6supr4.no-ip.org udp
US 8.8.8.8:53 7supr4.no-ip.org udp
US 8.8.8.8:53 8supr4.no-ip.org udp

Files

memory/2200-0-0x0000000074821000-0x0000000074822000-memory.dmp

memory/2200-2-0x0000000074820000-0x0000000074DCB000-memory.dmp

memory/2200-4-0x0000000074820000-0x0000000074DCB000-memory.dmp

memory/2200-18-0x0000000074820000-0x0000000074DCB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 53dd759d56240beba49d6318b4e53197
SHA1 25f4afea4e8babc6d7774fcf08b48f3917f05ae8
SHA256 7904257af820db24fcf0cba9fe6cd156eecd2a99c4b837f5807660d2c13b5fb0
SHA512 61c4e0b2348317efa48905e6918040775269022d052af5f805a45670710fa1259606011e08b434ffe4ebdea58dc95b6a053f2af9d0539f4e119cd5bbca5924d2

memory/2028-22-0x0000000074820000-0x0000000074DCB000-memory.dmp

memory/2028-21-0x0000000074820000-0x0000000074DCB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe

MD5 6d283be2823b28d65301591c318cb91d
SHA1 eab65bfa634225d303a96d67f61223011f0c88ed
SHA256 ed40f7d336c87960d7e9ef7b70532f1636b160e7b30685b366eb503d59dbef57
SHA512 9eaa4369f653d98c04d3f192348be0dde5928cca693cf9c2bde190a0220c4b3c840126ac185a3a2a4b92cbaf74089c468919c861377deb34b842b5c233411abe

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

MD5 e9c70a8ab240fb4e8164d67c7c24be2f
SHA1 ca12502f573c41b3c5ae53cded52d3e2cf93733e
SHA256 a0fa0d7ec90c910403f23b411361e9966d1ef081ea65194d0a723d4308a1e570
SHA512 eae6ff76e057dbaeb60882131d2593fa34a28c3a1787f5a002e572ca8067efa706e2e735b8661e61f88b742a71d7f724c7736410297c2bb9b7ad50075f1f22dd

memory/2468-25-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2468-45-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2468-38-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2468-37-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2468-36-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2468-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2468-29-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2468-27-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2468-33-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2540-55-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2028-65-0x0000000074820000-0x0000000074DCB000-memory.dmp

memory/2468-66-0x0000000000400000-0x0000000000471000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-17 16:42

Reported

2024-07-17 16:45

Platform

win10v2004-20240709-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\53dd759d56240beba49d6318b4e53197_JaffaCakes118.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\svchost.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\audiodgi.exe" C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\53dd759d56240beba49d6318b4e53197_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\audiodgi.exe" C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3640 set thread context of 1116 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 4592 set thread context of 864 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\53dd759d56240beba49d6318b4e53197_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1556 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\53dd759d56240beba49d6318b4e53197_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1556 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\53dd759d56240beba49d6318b4e53197_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1556 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\53dd759d56240beba49d6318b4e53197_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3640 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3640 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3640 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3640 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3640 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3640 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3640 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3640 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1116 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1404 wrote to memory of 2100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1404 wrote to memory of 2100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1404 wrote to memory of 2100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3696 wrote to memory of 3108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3696 wrote to memory of 3108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3696 wrote to memory of 3108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1304 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1304 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1304 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5080 wrote to memory of 1004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5080 wrote to memory of 1004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5080 wrote to memory of 1004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3640 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
PID 3640 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
PID 3640 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
PID 4600 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 4600 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 4600 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 4592 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 4592 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 4592 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 4592 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

Processes

C:\Users\Admin\AppData\Local\Temp\53dd759d56240beba49d6318b4e53197_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\53dd759d56240beba49d6318b4e53197_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe

"C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe"

C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

"C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe"

C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 864 -ip 864

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 80

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 supr4.no-ip.org udp
ID 212.117.50.228:27018 supr4.no-ip.org tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
ID 212.117.50.228:27018 supr4.no-ip.org tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 192.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 1supr4.no-ip.org udp
US 8.8.8.8:53 2supr4.no-ip.org udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 3supr4.no-ip.org udp
ID 212.117.50.228:27018 3supr4.no-ip.org tcp
US 8.8.8.8:53 4supr4.no-ip.org udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 5supr4.no-ip.org udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 6supr4.no-ip.org udp
US 8.8.8.8:53 7supr4.no-ip.org udp
US 8.8.8.8:53 8supr4.no-ip.org udp

Files

memory/1556-0-0x0000000074DB2000-0x0000000074DB3000-memory.dmp

memory/1556-1-0x0000000074DB0000-0x0000000075361000-memory.dmp

memory/1556-2-0x0000000074DB0000-0x0000000075361000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 53dd759d56240beba49d6318b4e53197
SHA1 25f4afea4e8babc6d7774fcf08b48f3917f05ae8
SHA256 7904257af820db24fcf0cba9fe6cd156eecd2a99c4b837f5807660d2c13b5fb0
SHA512 61c4e0b2348317efa48905e6918040775269022d052af5f805a45670710fa1259606011e08b434ffe4ebdea58dc95b6a053f2af9d0539f4e119cd5bbca5924d2

memory/3640-17-0x0000000074DB0000-0x0000000075361000-memory.dmp

memory/1556-18-0x0000000074DB0000-0x0000000075361000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe

MD5 6d283be2823b28d65301591c318cb91d
SHA1 eab65bfa634225d303a96d67f61223011f0c88ed
SHA256 ed40f7d336c87960d7e9ef7b70532f1636b160e7b30685b366eb503d59dbef57
SHA512 9eaa4369f653d98c04d3f192348be0dde5928cca693cf9c2bde190a0220c4b3c840126ac185a3a2a4b92cbaf74089c468919c861377deb34b842b5c233411abe

memory/3640-21-0x0000000074DB0000-0x0000000075361000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

MD5 e9c70a8ab240fb4e8164d67c7c24be2f
SHA1 ca12502f573c41b3c5ae53cded52d3e2cf93733e
SHA256 a0fa0d7ec90c910403f23b411361e9966d1ef081ea65194d0a723d4308a1e570
SHA512 eae6ff76e057dbaeb60882131d2593fa34a28c3a1787f5a002e572ca8067efa706e2e735b8661e61f88b742a71d7f724c7736410297c2bb9b7ad50075f1f22dd

memory/1116-27-0x0000000000400000-0x0000000000471000-memory.dmp

memory/1116-28-0x0000000000400000-0x0000000000471000-memory.dmp

memory/1116-26-0x0000000000400000-0x0000000000471000-memory.dmp

memory/1116-23-0x0000000000400000-0x0000000000471000-memory.dmp

memory/3640-38-0x0000000074DB0000-0x0000000075361000-memory.dmp