Malware Analysis Report

2025-04-13 23:12

Sample ID 240722-2f3bsssbnd
Target 650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118
SHA256 19295dc181b298968aaea132edf764c3e512fab8fbb53fa3c086c87834346df0
Tags
darkcomet persistence rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

19295dc181b298968aaea132edf764c3e512fab8fbb53fa3c086c87834346df0

Threat Level: Known bad

The file 650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

darkcomet persistence rat trojan upx

Darkcomet

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

UPX packed file

Uses the VBS compiler for execution

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-22 22:32

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-22 22:32

Reported

2024-07-22 23:30

Platform

win7-20240705-en

Max time kernel

87s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\tmp5217 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp51F7.tmp.exe\"" C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2228 set thread context of 2856 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: 34 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: 35 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\DllHost.exe N/A
N/A N/A C:\Windows\SysWOW64\DllHost.exe N/A
N/A N/A C:\Windows\SysWOW64\DllHost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2228 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe
PID 2228 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe
PID 2228 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe
PID 2228 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe
PID 2228 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2228 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2228 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2228 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2228 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2228 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2228 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2228 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe

"C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}

Network

N/A

Files

memory/2228-0-0x0000000074F81000-0x0000000074F82000-memory.dmp

memory/2228-1-0x0000000074F80000-0x000000007552B000-memory.dmp

memory/2228-2-0x0000000074F80000-0x000000007552B000-memory.dmp

\Users\Admin\AppData\Local\Temp\ejEVpV.exe

MD5 c28c7391576fc2f85e85c019508d1da8
SHA1 2ebb377b1fa15391325fa29dd28ee1d1ce5fbc08
SHA256 da34c0793c289bf1f74094de9b4138b42ce855105a5f68127c298f9c445c2750
SHA512 6096bb4688e5bf355334e18f24702e29bd9e03f212e351036e62672f6e215f2bffda66aff179e77e611f59e2bed8c63a3355dcc4886c7724b249f259110c03c4

memory/2816-13-0x0000000000400000-0x0000000000514000-memory.dmp

memory/2228-11-0x0000000005410000-0x0000000005524000-memory.dmp

memory/2816-17-0x00000000003A0000-0x00000000003A1000-memory.dmp

memory/2856-30-0x0000000000400000-0x0000000000514000-memory.dmp

memory/2856-29-0x0000000000400000-0x0000000000514000-memory.dmp

memory/2856-28-0x0000000000400000-0x0000000000514000-memory.dmp

memory/2856-27-0x0000000000400000-0x0000000000514000-memory.dmp

memory/2856-26-0x0000000000400000-0x0000000000514000-memory.dmp

memory/2856-25-0x0000000000400000-0x0000000000514000-memory.dmp

memory/2856-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2856-22-0x0000000000400000-0x0000000000514000-memory.dmp

memory/2856-21-0x0000000000400000-0x0000000000514000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MAPKURDISTAN.JPG

MD5 b5efbdc0085d509003fc960de98f0445
SHA1 2ae2e0f6a27943d6eb586332cfd0c9b2795c1de1
SHA256 57d8962aa221bd191f5538e8d1efc8975adcc6c37734da016fe630deefb90a43
SHA512 870747f70494bc781efa53c2b3387369a14869b8d38eb8f470e483f6d6736d48c27f07548124015db810c93b1ead1d4ace9b46847a7189fb64d249290848822c

memory/2228-34-0x0000000074F80000-0x000000007552B000-memory.dmp

memory/2856-37-0x0000000002450000-0x0000000002452000-memory.dmp

memory/3004-36-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/2816-35-0x0000000003AF0000-0x0000000003AF2000-memory.dmp

memory/2816-41-0x0000000000400000-0x0000000000514000-memory.dmp

memory/2856-43-0x0000000000400000-0x0000000000514000-memory.dmp

memory/2856-45-0x0000000000400000-0x0000000000514000-memory.dmp

memory/2856-44-0x0000000000400000-0x0000000000514000-memory.dmp

memory/2856-46-0x0000000000400000-0x0000000000514000-memory.dmp

memory/2856-47-0x0000000000400000-0x0000000000514000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-22 22:32

Reported

2024-07-22 23:32

Platform

win10v2004-20240709-en

Max time kernel

3s

Max time network

68s

Command Line

"C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tmp9C60 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp9C4F.tmp.exe\"" C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: 34 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: 35 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: 36 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4284 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe
PID 4284 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe
PID 4284 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe
PID 4284 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4284 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4284 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4284 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4284 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4284 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4284 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4284 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4284 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe
PID 4284 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe
PID 4284 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe
PID 4284 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4284 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4284 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4284 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4284 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4284 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4284 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4284 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\650f2147f53dcc13c12716ac9d612fa4_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe

"C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp

Files

memory/4284-0-0x0000000074EC2000-0x0000000074EC3000-memory.dmp

memory/4284-1-0x0000000074EC0000-0x0000000075471000-memory.dmp

memory/4284-2-0x0000000074EC0000-0x0000000075471000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ejEVpV.exe

MD5 c28c7391576fc2f85e85c019508d1da8
SHA1 2ebb377b1fa15391325fa29dd28ee1d1ce5fbc08
SHA256 da34c0793c289bf1f74094de9b4138b42ce855105a5f68127c298f9c445c2750
SHA512 6096bb4688e5bf355334e18f24702e29bd9e03f212e351036e62672f6e215f2bffda66aff179e77e611f59e2bed8c63a3355dcc4886c7724b249f259110c03c4

memory/1052-14-0x0000000000400000-0x0000000000514000-memory.dmp

memory/1052-15-0x00000000021F0000-0x00000000021F1000-memory.dmp

memory/4796-20-0x0000000000400000-0x0000000000514000-memory.dmp

memory/4796-22-0x0000000000400000-0x0000000000514000-memory.dmp

memory/4284-29-0x0000000074EC0000-0x0000000075471000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MAPKURDISTAN.JPG

MD5 b5efbdc0085d509003fc960de98f0445
SHA1 2ae2e0f6a27943d6eb586332cfd0c9b2795c1de1
SHA256 57d8962aa221bd191f5538e8d1efc8975adcc6c37734da016fe630deefb90a43
SHA512 870747f70494bc781efa53c2b3387369a14869b8d38eb8f470e483f6d6736d48c27f07548124015db810c93b1ead1d4ace9b46847a7189fb64d249290848822c

memory/4796-28-0x0000000000400000-0x0000000000514000-memory.dmp

memory/4796-25-0x0000000000400000-0x0000000000514000-memory.dmp

memory/4796-23-0x0000000000400000-0x0000000000514000-memory.dmp

memory/4796-19-0x0000000000400000-0x0000000000514000-memory.dmp

memory/4796-34-0x0000000000400000-0x0000000000514000-memory.dmp

memory/1052-35-0x0000000000400000-0x0000000000514000-memory.dmp

memory/1052-36-0x0000000000400000-0x0000000000514000-memory.dmp

memory/4284-0-0x0000000074EC2000-0x0000000074EC3000-memory.dmp

memory/4284-1-0x0000000074EC0000-0x0000000075471000-memory.dmp

memory/4284-2-0x0000000074EC0000-0x0000000075471000-memory.dmp

memory/1052-14-0x0000000000400000-0x0000000000514000-memory.dmp

memory/1052-15-0x00000000021F0000-0x00000000021F1000-memory.dmp

memory/4796-20-0x0000000000400000-0x0000000000514000-memory.dmp

memory/4796-22-0x0000000000400000-0x0000000000514000-memory.dmp

memory/4284-29-0x0000000074EC0000-0x0000000075471000-memory.dmp

memory/4796-28-0x0000000000400000-0x0000000000514000-memory.dmp

memory/4796-25-0x0000000000400000-0x0000000000514000-memory.dmp

memory/4796-23-0x0000000000400000-0x0000000000514000-memory.dmp

memory/4796-19-0x0000000000400000-0x0000000000514000-memory.dmp

memory/4796-34-0x0000000000400000-0x0000000000514000-memory.dmp

memory/1052-35-0x0000000000400000-0x0000000000514000-memory.dmp

memory/1052-36-0x0000000000400000-0x0000000000514000-memory.dmp