Malware Analysis Report

2025-01-22 13:07

Sample ID 240718-jk4rbasdpb
Target 566cbbea4da936e0b4012181dde49ced_JaffaCakes118
SHA256 c67c18e006d0acf3c0188f842c929bd9e445e7e891db0830dc50afda835b17e5
Tags
njrat ddd evasion persistence privilege_escalation trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c67c18e006d0acf3c0188f842c929bd9e445e7e891db0830dc50afda835b17e5

Threat Level: Known bad

The file 566cbbea4da936e0b4012181dde49ced_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

njrat ddd evasion persistence privilege_escalation trojan

njRAT/Bladabindi

Modifies Windows Firewall

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-18 07:44

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-18 07:44

Reported

2024-07-18 07:47

Platform

win10v2004-20240709-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\581153482cb6003050ef63cae0773a6e = "\"C:\\Users\\Admin\\AppData\\Roaming\\Host Process3.exe\" .." C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\581153482cb6003050ef63cae0773a6e = "\"C:\\Users\\Admin\\AppData\\Roaming\\Host Process3.exe\" .." C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4408 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe
PID 4408 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe
PID 4408 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe
PID 4408 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe
PID 4408 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe
PID 4408 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe
PID 4408 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe
PID 4408 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe
PID 3368 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Host Process3.exe
PID 3368 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Host Process3.exe
PID 3368 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Host Process3.exe
PID 2144 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe C:\Users\Admin\AppData\Roaming\Host Process3.exe
PID 2144 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe C:\Users\Admin\AppData\Roaming\Host Process3.exe
PID 2144 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe C:\Users\Admin\AppData\Roaming\Host Process3.exe
PID 2144 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe C:\Users\Admin\AppData\Roaming\Host Process3.exe
PID 2144 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe C:\Users\Admin\AppData\Roaming\Host Process3.exe
PID 2144 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe C:\Users\Admin\AppData\Roaming\Host Process3.exe
PID 2144 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe C:\Users\Admin\AppData\Roaming\Host Process3.exe
PID 2144 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe C:\Users\Admin\AppData\Roaming\Host Process3.exe
PID 1776 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe C:\Windows\SysWOW64\netsh.exe
PID 1776 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe C:\Windows\SysWOW64\netsh.exe
PID 1776 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe

"{path}"

C:\Users\Admin\AppData\Roaming\Host Process3.exe

"C:\Users\Admin\AppData\Roaming\Host Process3.exe"

C:\Users\Admin\AppData\Roaming\Host Process3.exe

"{path}"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Host Process3.exe" "Host Process3.exe" ENABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 frankooxyz2.ddns.net udp
US 8.8.8.8:53 frankooxyz2.ddns.net udp
US 8.8.8.8:53 233.143.123.92.in-addr.arpa udp
US 8.8.8.8:53 frankooxyz2.ddns.net udp
US 8.8.8.8:53 frankooxyz2.ddns.net udp
US 8.8.8.8:53 frankooxyz2.ddns.net udp
US 8.8.8.8:53 frankooxyz2.ddns.net udp
US 8.8.8.8:53 frankooxyz2.ddns.net udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 frankooxyz2.ddns.net udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 frankooxyz2.ddns.net udp
US 8.8.8.8:53 frankooxyz2.ddns.net udp
US 8.8.8.8:53 frankooxyz2.ddns.net udp
US 8.8.8.8:53 frankooxyz2.ddns.net udp
US 8.8.8.8:53 frankooxyz2.ddns.net udp
US 8.8.8.8:53 frankooxyz2.ddns.net udp
US 8.8.8.8:53 frankooxyz2.ddns.net udp
US 8.8.8.8:53 frankooxyz2.ddns.net udp

Files

memory/4408-0-0x00000000749A2000-0x00000000749A3000-memory.dmp

memory/4408-1-0x00000000749A0000-0x0000000074F51000-memory.dmp

memory/4408-2-0x00000000749A0000-0x0000000074F51000-memory.dmp

memory/4408-3-0x00000000749A0000-0x0000000074F51000-memory.dmp

memory/3368-4-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe.log

MD5 37b9a01e5f69908b54ac3783fb6a198d
SHA1 21df4f25255ba9bce869a2d85a0d988a8e733840
SHA256 61e0c029ab63d51a18f668bd3df97a517a7598dcd7f9074a236cc2e173271f22
SHA512 57591b143342a697526cbf75cc3f63a6789744b68033bc325d7c46cbcf15eca5b703d69450252d505aafd5f07e458f2f6295dc92ca32aca3db5747543aa183e0

memory/4408-7-0x00000000749A2000-0x00000000749A3000-memory.dmp

memory/4408-8-0x00000000749A0000-0x0000000074F51000-memory.dmp

memory/3368-9-0x00000000749A0000-0x0000000074F51000-memory.dmp

memory/3368-10-0x00000000749A0000-0x0000000074F51000-memory.dmp

memory/3368-11-0x00000000749A0000-0x0000000074F51000-memory.dmp

C:\Users\Admin\AppData\Roaming\Host Process3.exe

MD5 566cbbea4da936e0b4012181dde49ced
SHA1 529f3e4666813410abcec4b5f0f790e431983f38
SHA256 c67c18e006d0acf3c0188f842c929bd9e445e7e891db0830dc50afda835b17e5
SHA512 fc96e5cff59e30737a1cddb503a91f385446e3e721d5f800e4c6674d3045b17236b9f20dca198cfe06f4057152fae983b057e177cdc0132b20eef228ddfb3343

memory/2144-23-0x00000000749A0000-0x0000000074F51000-memory.dmp

memory/2144-25-0x00000000749A0000-0x0000000074F51000-memory.dmp

memory/3368-24-0x00000000749A0000-0x0000000074F51000-memory.dmp

memory/2144-30-0x00000000749A0000-0x0000000074F51000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Host Process3.exe.log

MD5 839abdbf1dcf283008e25eca01105b63
SHA1 d804246e2d7895cd055b01341574784e66b798b9
SHA256 7fedbfb2c1a3adc33f8a84457396c57eaa7a58934dc588ccde4066d94377c047
SHA512 35e81f6e5de6c4d1a1fd49f100c94d35fe77104f35960bb8159f742c7d6f9e7df9f7be6e6ec3ff5b8fa3fdcfde8d72edcb45762f85add54d5f83d6faffb521dd

memory/1776-31-0x00000000749A0000-0x0000000074F51000-memory.dmp

memory/1776-32-0x00000000749A0000-0x0000000074F51000-memory.dmp

memory/1776-33-0x00000000749A0000-0x0000000074F51000-memory.dmp

memory/1776-34-0x00000000749A0000-0x0000000074F51000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-18 07:44

Reported

2024-07-18 07:47

Platform

win7-20240705-en

Max time kernel

150s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\581153482cb6003050ef63cae0773a6e = "\"C:\\Users\\Admin\\AppData\\Roaming\\Host Process3.exe\" .." C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\581153482cb6003050ef63cae0773a6e = "\"C:\\Users\\Admin\\AppData\\Roaming\\Host Process3.exe\" .." C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3028 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe
PID 3028 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe
PID 3028 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe
PID 3028 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe
PID 3028 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe
PID 3028 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe
PID 3028 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe
PID 3028 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe
PID 3028 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe
PID 2804 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Host Process3.exe
PID 2804 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Host Process3.exe
PID 2804 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Host Process3.exe
PID 2804 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Host Process3.exe
PID 2644 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe C:\Users\Admin\AppData\Roaming\Host Process3.exe
PID 2644 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe C:\Users\Admin\AppData\Roaming\Host Process3.exe
PID 2644 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe C:\Users\Admin\AppData\Roaming\Host Process3.exe
PID 2644 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe C:\Users\Admin\AppData\Roaming\Host Process3.exe
PID 2644 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe C:\Users\Admin\AppData\Roaming\Host Process3.exe
PID 2644 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe C:\Users\Admin\AppData\Roaming\Host Process3.exe
PID 2644 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe C:\Users\Admin\AppData\Roaming\Host Process3.exe
PID 2644 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe C:\Users\Admin\AppData\Roaming\Host Process3.exe
PID 2644 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe C:\Users\Admin\AppData\Roaming\Host Process3.exe
PID 2536 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe C:\Windows\SysWOW64\netsh.exe
PID 2536 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe C:\Windows\SysWOW64\netsh.exe
PID 2536 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe C:\Windows\SysWOW64\netsh.exe
PID 2536 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Roaming\Host Process3.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\566cbbea4da936e0b4012181dde49ced_JaffaCakes118.exe

"{path}"

C:\Users\Admin\AppData\Roaming\Host Process3.exe

"C:\Users\Admin\AppData\Roaming\Host Process3.exe"

C:\Users\Admin\AppData\Roaming\Host Process3.exe

"{path}"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Host Process3.exe" "Host Process3.exe" ENABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 frankooxyz2.ddns.net udp

Files

memory/3028-0-0x0000000074B31000-0x0000000074B32000-memory.dmp

memory/3028-1-0x0000000074B30000-0x00000000750DB000-memory.dmp

memory/3028-2-0x0000000074B30000-0x00000000750DB000-memory.dmp

memory/2804-3-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3028-14-0x0000000074B30000-0x00000000750DB000-memory.dmp

memory/2804-13-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2804-16-0x0000000074B30000-0x00000000750DB000-memory.dmp

memory/2804-15-0x0000000074B30000-0x00000000750DB000-memory.dmp

memory/2804-11-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2804-4-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2804-9-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2804-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2804-6-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2804-5-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2804-17-0x0000000074B30000-0x00000000750DB000-memory.dmp

C:\Users\Admin\AppData\Roaming\Host Process3.exe

MD5 566cbbea4da936e0b4012181dde49ced
SHA1 529f3e4666813410abcec4b5f0f790e431983f38
SHA256 c67c18e006d0acf3c0188f842c929bd9e445e7e891db0830dc50afda835b17e5
SHA512 fc96e5cff59e30737a1cddb503a91f385446e3e721d5f800e4c6674d3045b17236b9f20dca198cfe06f4057152fae983b057e177cdc0132b20eef228ddfb3343

memory/2804-25-0x0000000074B30000-0x00000000750DB000-memory.dmp

memory/2644-26-0x0000000074B30000-0x00000000750DB000-memory.dmp

memory/2536-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2644-40-0x0000000074B30000-0x00000000750DB000-memory.dmp