Malware Analysis Report

2024-09-22 10:48

Sample ID 240722-wr98wszene
Target 643daec49804b49751bd0a33c6ab4107_JaffaCakes118
SHA256 3be96fae73eee287dee7a806e61278695afdb340b3d1efea2f68df960e71d5a5
Tags
hawkeye evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3be96fae73eee287dee7a806e61278695afdb340b3d1efea2f68df960e71d5a5

Threat Level: Known bad

The file 643daec49804b49751bd0a33c6ab4107_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

hawkeye evasion keylogger persistence spyware stealer trojan

Modifies firewall policy service

HawkEye

Boot or Logon Autostart Execution: Active Setup

Adds policy Run key to start application

Checks computer location settings

Deletes itself

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Modifies registry key

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-07-22 18:10

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-22 18:10

Reported

2024-07-22 18:14

Platform

win7-20240708-en

Max time kernel

150s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\643daec49804b49751bd0a33c6ab4107_JaffaCakes118.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\svchost.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\9PMD6QH73A.exe = "C:\\Users\\Admin\\AppData\\Roaming\\9PMD6QH73A.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\blank = "C:\\Users\\Admin\\AppData\\Roaming\\9PMD6QH73A.exe" C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\blank C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\blank\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\9PMD6QH73A.exe" C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\blank C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Active Setup\Installed Components\blank\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\9PMD6QH73A.exe" C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\audiodgi.exe" C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\blank = "C:\\Users\\Admin\\AppData\\Roaming\\9PMD6QH73A.exe" C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\blank = "C:\\Users\\Admin\\AppData\\Roaming\\9PMD6QH73A.exe" C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1972 set thread context of 2708 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1532 set thread context of 2964 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\643daec49804b49751bd0a33c6ab4107_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1488 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\643daec49804b49751bd0a33c6ab4107_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1488 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\643daec49804b49751bd0a33c6ab4107_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1488 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\643daec49804b49751bd0a33c6ab4107_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1488 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\643daec49804b49751bd0a33c6ab4107_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1972 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1972 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1972 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1972 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1972 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1972 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1972 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1972 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1972 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
PID 1972 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
PID 1972 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
PID 1972 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
PID 2708 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2888 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2888 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2888 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2888 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2920 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2920 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2920 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2920 wrote to memory of 2664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2904 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2904 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2904 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2904 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2812 wrote to memory of 2676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2812 wrote to memory of 2676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2812 wrote to memory of 2676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2812 wrote to memory of 2676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2724 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 2724 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 2724 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 2724 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 1532 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 1532 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 1532 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 1532 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 1532 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 1532 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 1532 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 1532 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

Processes

C:\Users\Admin\AppData\Local\Temp\643daec49804b49751bd0a33c6ab4107_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\643daec49804b49751bd0a33c6ab4107_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe

"C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\9PMD6QH73A.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\9PMD6QH73A.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\9PMD6QH73A.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\9PMD6QH73A.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

"C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe"

C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 craft22.no-ip.biz udp
US 8.8.8.8:53 1craft22.no-ip.biz udp
US 8.8.8.8:53 2craft22.no-ip.biz udp
US 8.8.8.8:53 3craft22.no-ip.biz udp
ES 94.73.36.129:3080 3craft22.no-ip.biz tcp
US 8.8.8.8:53 4craft22.no-ip.biz udp
US 8.8.8.8:53 5craft22.no-ip.biz udp
US 8.8.8.8:53 6craft22.no-ip.biz udp
US 8.8.8.8:53 7craft22.no-ip.biz udp
US 8.8.8.8:53 8craft22.no-ip.biz udp

Files

memory/1488-0-0x0000000074451000-0x0000000074452000-memory.dmp

memory/1488-1-0x0000000074450000-0x00000000749FB000-memory.dmp

memory/1488-2-0x0000000074450000-0x00000000749FB000-memory.dmp

\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 643daec49804b49751bd0a33c6ab4107
SHA1 7a0df7d13959291039a5c355aaf346b801822bbc
SHA256 3be96fae73eee287dee7a806e61278695afdb340b3d1efea2f68df960e71d5a5
SHA512 421857dc6ff4e0ea18a6499c0895e7b8ea299e85d0f1ddaa816e1a48381aa2924e259171e8397d0f62e5b27c7b184cde4746a13f2171f682c6c7994b385c6b64

memory/1488-18-0x0000000074450000-0x00000000749FB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe

MD5 a6deb877c0f1f4ded2d2ad0b885824ce
SHA1 b470b92025d3e85dde8f76cf46be9456d4692aec
SHA256 484f423590c54da0296682b7e82ad33901f08f464415c10608f352c88f1b0782
SHA512 d7d2b759431bfcce8649fc7b49cbccaa5b47e31661ab08932af058e3a7bccff8f0b60303e6d53fe0979f6b9378f487f41095f991096cb9270b6129b456159ff7

memory/1972-22-0x0000000074450000-0x00000000749FB000-memory.dmp

memory/1972-23-0x0000000074450000-0x00000000749FB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

MD5 5ae90c94a0da4a08bd17e07fa0b427db
SHA1 daed4176185ffe9e1894c0465b53afaf5b9e5e87
SHA256 1105c3d6fe779a1f3f713537c847b6b70bf5fc9fc0388c47ab6ae7501ca2f9e6
SHA512 c91693293f6d9b0eb0c0d050301635cc9e39ee8f9cb3a53e0acf43b1e48b38b44ebfb692841ffc45caa8dfbdd59ebe0490990382dc7a033079201f79e9860fcb

memory/2708-26-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2708-34-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2708-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2708-41-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2708-30-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2708-28-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2964-53-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1972-61-0x0000000074450000-0x00000000749FB000-memory.dmp

memory/2708-62-0x0000000000400000-0x0000000000470000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-22 18:10

Reported

2024-07-22 18:16

Platform

win10v2004-20240709-en

Max time kernel

150s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\643daec49804b49751bd0a33c6ab4107_JaffaCakes118.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\9PMD6QH73A.exe = "C:\\Users\\Admin\\AppData\\Roaming\\9PMD6QH73A.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\svchost.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\blank = "C:\\Users\\Admin\\AppData\\Roaming\\9PMD6QH73A.exe" C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\blank C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\blank\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\9PMD6QH73A.exe" C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\blank C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\blank\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\9PMD6QH73A.exe" C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\643daec49804b49751bd0a33c6ab4107_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\blank = "C:\\Users\\Admin\\AppData\\Roaming\\9PMD6QH73A.exe" C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\audiodgi.exe" C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\blank = "C:\\Users\\Admin\\AppData\\Roaming\\9PMD6QH73A.exe" C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2068 set thread context of 228 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3376 set thread context of 2856 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\643daec49804b49751bd0a33c6ab4107_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1648 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\643daec49804b49751bd0a33c6ab4107_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1648 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\643daec49804b49751bd0a33c6ab4107_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1648 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\643daec49804b49751bd0a33c6ab4107_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2068 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2068 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2068 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2068 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2068 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2068 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2068 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2068 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 228 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 228 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 228 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 228 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 228 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 228 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 228 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 228 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 228 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 228 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 228 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 228 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 4948 wrote to memory of 4812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4948 wrote to memory of 4812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4948 wrote to memory of 4812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1084 wrote to memory of 4292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1084 wrote to memory of 4292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1084 wrote to memory of 4292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2240 wrote to memory of 2992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2240 wrote to memory of 2992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2240 wrote to memory of 2992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2832 wrote to memory of 3328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2832 wrote to memory of 3328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2832 wrote to memory of 3328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2068 wrote to memory of 3092 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
PID 2068 wrote to memory of 3092 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
PID 2068 wrote to memory of 3092 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
PID 3092 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 3092 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 3092 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 3376 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 3376 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 3376 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 3376 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 3376 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 3376 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 3376 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
PID 3376 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

Processes

C:\Users\Admin\AppData\Local\Temp\643daec49804b49751bd0a33c6ab4107_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\643daec49804b49751bd0a33c6ab4107_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\9PMD6QH73A.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\9PMD6QH73A.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\9PMD6QH73A.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\9PMD6QH73A.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe

"C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe"

C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

"C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe"

C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 craft22.no-ip.biz udp
US 8.8.8.8:53 craft22.no-ip.biz udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 1craft22.no-ip.biz udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 2craft22.no-ip.biz udp
US 8.8.8.8:53 3craft22.no-ip.biz udp
ES 94.73.36.129:3080 3craft22.no-ip.biz tcp
US 8.8.8.8:53 4craft22.no-ip.biz udp
US 8.8.8.8:53 5craft22.no-ip.biz udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 6craft22.no-ip.biz udp
US 8.8.8.8:53 7craft22.no-ip.biz udp
US 8.8.8.8:53 8craft22.no-ip.biz udp

Files

memory/1648-0-0x0000000074C92000-0x0000000074C93000-memory.dmp

memory/1648-1-0x0000000074C90000-0x0000000075241000-memory.dmp

memory/1648-2-0x0000000074C90000-0x0000000075241000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 643daec49804b49751bd0a33c6ab4107
SHA1 7a0df7d13959291039a5c355aaf346b801822bbc
SHA256 3be96fae73eee287dee7a806e61278695afdb340b3d1efea2f68df960e71d5a5
SHA512 421857dc6ff4e0ea18a6499c0895e7b8ea299e85d0f1ddaa816e1a48381aa2924e259171e8397d0f62e5b27c7b184cde4746a13f2171f682c6c7994b385c6b64

memory/2068-22-0x0000000074C90000-0x0000000075241000-memory.dmp

memory/1648-21-0x0000000074C90000-0x0000000075241000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe

MD5 a6deb877c0f1f4ded2d2ad0b885824ce
SHA1 b470b92025d3e85dde8f76cf46be9456d4692aec
SHA256 484f423590c54da0296682b7e82ad33901f08f464415c10608f352c88f1b0782
SHA512 d7d2b759431bfcce8649fc7b49cbccaa5b47e31661ab08932af058e3a7bccff8f0b60303e6d53fe0979f6b9378f487f41095f991096cb9270b6129b456159ff7

memory/2068-18-0x0000000074C90000-0x0000000075241000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

MD5 5ae90c94a0da4a08bd17e07fa0b427db
SHA1 daed4176185ffe9e1894c0465b53afaf5b9e5e87
SHA256 1105c3d6fe779a1f3f713537c847b6b70bf5fc9fc0388c47ab6ae7501ca2f9e6
SHA512 c91693293f6d9b0eb0c0d050301635cc9e39ee8f9cb3a53e0acf43b1e48b38b44ebfb692841ffc45caa8dfbdd59ebe0490990382dc7a033079201f79e9860fcb

memory/228-24-0x0000000000400000-0x0000000000470000-memory.dmp

memory/228-27-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2068-42-0x0000000074C90000-0x0000000075241000-memory.dmp