Malware Analysis Report

2024-09-22 10:48

Sample ID 240718-aaw42sygqe
Target 555d3202e43afce04239e9c03eef07c9_JaffaCakes118
SHA256 b4936100106c42df1c621d5316cb93151c873dd6930c1552d1ed884b7dc45fdb
Tags
hawkeye keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b4936100106c42df1c621d5316cb93151c873dd6930c1552d1ed884b7dc45fdb

Threat Level: Known bad

The file 555d3202e43afce04239e9c03eef07c9_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

hawkeye keylogger persistence spyware stealer trojan

HawkEye

Deletes itself

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-07-18 00:01

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-18 00:01

Reported

2024-07-18 00:03

Platform

win7-20240704-en

Max time kernel

150s

Max time network

19s

Command Line

"C:\Users\Admin\AppData\Local\Temp\555d3202e43afce04239e9c03eef07c9_JaffaCakes118.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\adiadg.exe" C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\555d3202e43afce04239e9c03eef07c9_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1292 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\555d3202e43afce04239e9c03eef07c9_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 1292 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\555d3202e43afce04239e9c03eef07c9_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 1292 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\555d3202e43afce04239e9c03eef07c9_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 1292 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\555d3202e43afce04239e9c03eef07c9_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 2648 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe
PID 2648 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe
PID 2648 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe
PID 2648 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe
PID 2772 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe
PID 2772 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe
PID 2772 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe
PID 2772 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\555d3202e43afce04239e9c03eef07c9_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\555d3202e43afce04239e9c03eef07c9_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"

C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe

"C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe"

C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe

"C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe"

Network

N/A

Files

memory/1292-0-0x0000000074021000-0x0000000074022000-memory.dmp

memory/1292-1-0x0000000074020000-0x00000000745CB000-memory.dmp

memory/1292-2-0x0000000074020000-0x00000000745CB000-memory.dmp

\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

MD5 555d3202e43afce04239e9c03eef07c9
SHA1 36934ac3982e7ff1d42fdf3287892af12cf58304
SHA256 b4936100106c42df1c621d5316cb93151c873dd6930c1552d1ed884b7dc45fdb
SHA512 5bf89fd827c330d2b52cee071afa97652837a06cf27feab4a7e66619d5fd32bcc20d3e6354c6aec8c882b01f4c401ce81c55be2d95626a366aa82865cb58390d

memory/1292-15-0x0000000074020000-0x00000000745CB000-memory.dmp

memory/2648-14-0x0000000074020000-0x00000000745CB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

MD5 60127e21ef3560d27e40b893627cd982
SHA1 37cbe26c435d9860711d2cbb55f87766aa6c1041
SHA256 80f27c853dcc612f36b7ea94259c0f3c733addfe17b268df544396b5dc7160bb
SHA512 189d2ff98f6cd73074ac673f0ce64ddb730475a0f3bab63f46a84c336b7d861b21e35b2ee9ba53ccbbfb6e7f7fa0e61611c771e67fd101edbc76750c061948b2

\Users\Admin\AppData\Local\Temp\System\adiadg.exe

MD5 7557176df708545d6e3bcfe8163b9fac
SHA1 b0611f219736022ded02c0281a40874568c64ebe
SHA256 179b309599d34b6fe68022867e145682eabe751cd0df6930b1ca79e3e48d549e
SHA512 0c405f76c0b2795956e87aff4e4ed5d6addea872cf87098ca8ed892da9cf03e27932f1b3765e191c5b87b6970159dd6dc1498ee02533a454fd3b6faf889b5857

memory/2648-32-0x0000000074020000-0x00000000745CB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-18 00:01

Reported

2024-07-18 00:03

Platform

win10v2004-20240709-en

Max time kernel

150s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\555d3202e43afce04239e9c03eef07c9_JaffaCakes118.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\555d3202e43afce04239e9c03eef07c9_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\adiadg.exe" C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\555d3202e43afce04239e9c03eef07c9_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5096 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\555d3202e43afce04239e9c03eef07c9_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 5096 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\555d3202e43afce04239e9c03eef07c9_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 5096 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\555d3202e43afce04239e9c03eef07c9_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 2564 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe
PID 2564 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe
PID 2564 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe
PID 3528 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe
PID 3528 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe
PID 3528 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\555d3202e43afce04239e9c03eef07c9_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\555d3202e43afce04239e9c03eef07c9_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"

C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe

"C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe"

C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe

"C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp

Files

memory/5096-0-0x0000000074EA2000-0x0000000074EA3000-memory.dmp

memory/5096-1-0x0000000074EA0000-0x0000000075451000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

MD5 555d3202e43afce04239e9c03eef07c9
SHA1 36934ac3982e7ff1d42fdf3287892af12cf58304
SHA256 b4936100106c42df1c621d5316cb93151c873dd6930c1552d1ed884b7dc45fdb
SHA512 5bf89fd827c330d2b52cee071afa97652837a06cf27feab4a7e66619d5fd32bcc20d3e6354c6aec8c882b01f4c401ce81c55be2d95626a366aa82865cb58390d

memory/5096-13-0x0000000074EA0000-0x0000000075451000-memory.dmp

memory/2564-12-0x0000000074EA0000-0x0000000075451000-memory.dmp

memory/2564-14-0x0000000074EA0000-0x0000000075451000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

MD5 60127e21ef3560d27e40b893627cd982
SHA1 37cbe26c435d9860711d2cbb55f87766aa6c1041
SHA256 80f27c853dcc612f36b7ea94259c0f3c733addfe17b268df544396b5dc7160bb
SHA512 189d2ff98f6cd73074ac673f0ce64ddb730475a0f3bab63f46a84c336b7d861b21e35b2ee9ba53ccbbfb6e7f7fa0e61611c771e67fd101edbc76750c061948b2

C:\Users\Admin\AppData\Local\Temp\System\adiadg.exe

MD5 7557176df708545d6e3bcfe8163b9fac
SHA1 b0611f219736022ded02c0281a40874568c64ebe
SHA256 179b309599d34b6fe68022867e145682eabe751cd0df6930b1ca79e3e48d549e
SHA512 0c405f76c0b2795956e87aff4e4ed5d6addea872cf87098ca8ed892da9cf03e27932f1b3765e191c5b87b6970159dd6dc1498ee02533a454fd3b6faf889b5857

memory/3528-30-0x0000000074EA0000-0x0000000075451000-memory.dmp

memory/3528-32-0x0000000074EA0000-0x0000000075451000-memory.dmp

memory/3528-31-0x0000000074EA0000-0x0000000075451000-memory.dmp

memory/2564-36-0x0000000074EA0000-0x0000000075451000-memory.dmp

memory/3528-37-0x0000000074EA0000-0x0000000075451000-memory.dmp