Malware Analysis Report

2024-11-16 12:13

Sample ID 240723-d8habswajc
Target 65fda9d498ea814cd952167dcf175353_JaffaCakes118
SHA256 93036a31d57bb484184a6e56f3c85e028421c2c895859bb6ff8b0d7b50eb9c9d
Tags
neshta evasion persistence spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

93036a31d57bb484184a6e56f3c85e028421c2c895859bb6ff8b0d7b50eb9c9d

Threat Level: Known bad

The file 65fda9d498ea814cd952167dcf175353_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

neshta evasion persistence spyware stealer upx

Neshta

Drops file in Drivers directory

Sets file to hidden

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Modifies system executable filetype association

Checks computer location settings

UPX packed file

Adds Run key to start application

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Modifies registry class

Views/modifies file attributes

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-23 03:40

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-23 03:40

Reported

2024-07-23 05:00

Platform

win7-20240704-en

Max time kernel

117s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe"

Signatures

Neshta

persistence spyware neshta

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hоsts C:\Windows\SysWOW64\cmd.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\button = "C:\\Windows\\system32\\button.bat" C:\Windows\SysWOW64\reg.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\end.bat C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\SysWOW64\end.bat C:\Windows\SysWOW64\cmd.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2292 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3582-490\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe
PID 2292 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3582-490\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe
PID 2292 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3582-490\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe
PID 2292 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3582-490\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe
PID 2876 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2876 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2876 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2876 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2744 wrote to memory of 2752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2744 wrote to memory of 2752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2744 wrote to memory of 2752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2744 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2744 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2744 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2744 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2744 wrote to memory of 2640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2744 wrote to memory of 2640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2744 wrote to memory of 2640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2744 wrote to memory of 2640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2744 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2744 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2744 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2744 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2744 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2744 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2744 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2744 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2744 wrote to memory of 2856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2744 wrote to memory of 2856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2744 wrote to memory of 2856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2744 wrote to memory of 2856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2744 wrote to memory of 2552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2744 wrote to memory of 2552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2744 wrote to memory of 2552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2744 wrote to memory of 2552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\435.tmp\end.bat" "

C:\Windows\SysWOW64\chcp.com

chcp 1251

C:\Windows\SysWOW64\attrib.exe

attrib -s -r -h C:\Windows\system32\drivers\etc\hosts

C:\Windows\SysWOW64\attrib.exe

attrib +s -r +H C:\Windows\system32\drivers\etc\hosts

C:\Windows\SysWOW64\attrib.exe

attrib +r +s -H C:\Windows\system32\drivers\etc

C:\Windows\SysWOW64\attrib.exe

attrib +r +H +s C:\Windows\system32\drivers\etc\hosts

C:\Windows\SysWOW64\attrib.exe

attrib +r +s C:\Windows\system32\drivers\etc\hоsts

C:\Windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "button" /t REG_SZ /d "C:\Windows\system32\button.bat" /f

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\3582-490\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe

MD5 c6f1b034bffaf62bc1254e72c9aa1662
SHA1 83725b60cfd544154ef71e78a0ebf777885a92b2
SHA256 a19351ba29d0b6ddb6bc0999d8c52a6440ffeb09eb7b02f614b3c2f4a816f671
SHA512 ff789248d206697665a61d3ed781e4f797641c3f81aaf94e3d24801b384b4780b7b546c3e61f73b8166735cbfc1d342216c1c5910858ef8db1255cefc5c5504f

memory/2292-4-0x0000000002790000-0x00000000027E6000-memory.dmp

memory/2876-11-0x0000000000400000-0x0000000000456000-memory.dmp

C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE

MD5 754309b7b83050a50768236ee966224f
SHA1 10ed7efc2e594417ddeb00a42deb8fd9f804ed53
SHA256 acd32dd903e5464b0ecd153fb3f71da520d2e59a63d4c355d9c1874c919d04e6
SHA512 e5aaddf62c08c8fcc1ae3f29df220c5c730a2efa96dd18685ee19f5a9d66c4735bb4416c4828033661990604669ed345415ef2dc096ec75e1ab378dd804b1614

C:\Users\Admin\AppData\Local\Temp\435.tmp\end.bat

MD5 7587b2b0a5fc82e9e4cc74ce46ace872
SHA1 ca819f39b8ad8e94fdf21dc9df86df47ba637d53
SHA256 8a9dd393be84dcd564241a4f277605c91c237147ac5db202bc4b5536e2e1dce4
SHA512 328f0613548c6014a072c7772d4822cea14b2637f009dc948271f19bc56d4b52af5b9f5c1767b686b6c31e2855a0520dacbb0f6868753a2c6aef53592f17a096

C:\Windows\System32\drivers\etc\hosts

MD5 ee78bd138aebea10902115d93a9ac62f
SHA1 f380000215fda9a1978669a16b2d4d041c186f12
SHA256 8c8c206ec7fcccd5b86ea8026b21649988cdb4cbea4af346029737552b6e381b
SHA512 09a252dcfb572e3965c0d98e4593650f5105fd72bcbea25b7ff79f730dc8bec65207a73fbb91b974534b4e84ef9722e71808ffd1e0a8edd70a981271a78e16c9

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

C:\Windows\System32\drivers\etc\hosts

MD5 04085f0fc8a04703aa8d9d616726f0fc
SHA1 86ec391a6928845e6a67d91b2234a5cda1b51378
SHA256 6d8a3b6c60e361aadce048f41bc0cdc69a8e41b0b8c322986e8baeffe0e33394
SHA512 8b786d82e92af10ddf9e9fe059ca062a93c3adf2ec8d228d3cbb2b25ce664c741944de40cd0ca67c92cb80f90fd2db697e5c94a8f51a69834210c8d5bf991916

memory/2876-743-0x0000000000400000-0x0000000000456000-memory.dmp

memory/2292-755-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2292-756-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2292-757-0x0000000002790000-0x00000000027E6000-memory.dmp

memory/2292-758-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2292-759-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2292-761-0x0000000000400000-0x000000000041B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-23 03:40

Reported

2024-07-23 05:00

Platform

win10v2004-20240709-en

Max time kernel

140s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe"

Signatures

Neshta

persistence spyware neshta

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hоsts C:\Windows\SysWOW64\cmd.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3582-490\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\button = "C:\\Windows\\system32\\button.bat" C:\Windows\SysWOW64\reg.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\end.bat C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\SysWOW64\end.bat C:\Windows\SysWOW64\cmd.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MI9C33~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13187~1.41\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MI391D~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~2.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~4.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MIA062~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2456 wrote to memory of 4244 N/A C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3582-490\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe
PID 2456 wrote to memory of 4244 N/A C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3582-490\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe
PID 2456 wrote to memory of 4244 N/A C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3582-490\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe
PID 4244 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4244 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4244 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4360 wrote to memory of 4328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4360 wrote to memory of 4328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4360 wrote to memory of 4328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4360 wrote to memory of 2400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4360 wrote to memory of 2400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4360 wrote to memory of 2400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4360 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4360 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4360 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4360 wrote to memory of 2984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4360 wrote to memory of 2984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4360 wrote to memory of 2984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4360 wrote to memory of 4980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4360 wrote to memory of 4980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4360 wrote to memory of 4980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4360 wrote to memory of 2620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4360 wrote to memory of 2620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4360 wrote to memory of 2620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4360 wrote to memory of 5096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4360 wrote to memory of 5096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4360 wrote to memory of 5096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\830B.tmp\end.bat" "

C:\Windows\SysWOW64\chcp.com

chcp 1251

C:\Windows\SysWOW64\attrib.exe

attrib -s -r -h C:\Windows\system32\drivers\etc\hosts

C:\Windows\SysWOW64\attrib.exe

attrib +s -r +H C:\Windows\system32\drivers\etc\hosts

C:\Windows\SysWOW64\attrib.exe

attrib +r +s -H C:\Windows\system32\drivers\etc

C:\Windows\SysWOW64\attrib.exe

attrib +r +H +s C:\Windows\system32\drivers\etc\hosts

C:\Windows\SysWOW64\attrib.exe

attrib +r +s C:\Windows\system32\drivers\etc\hоsts

C:\Windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "button" /t REG_SZ /d "C:\Windows\system32\button.bat" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
NL 52.111.243.30:443 tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

C:\Users\Admin\AppData\Local\Temp\3582-490\65fda9d498ea814cd952167dcf175353_JaffaCakes118.exe

MD5 c6f1b034bffaf62bc1254e72c9aa1662
SHA1 83725b60cfd544154ef71e78a0ebf777885a92b2
SHA256 a19351ba29d0b6ddb6bc0999d8c52a6440ffeb09eb7b02f614b3c2f4a816f671
SHA512 ff789248d206697665a61d3ed781e4f797641c3f81aaf94e3d24801b384b4780b7b546c3e61f73b8166735cbfc1d342216c1c5910858ef8db1255cefc5c5504f

memory/4244-13-0x0000000000400000-0x0000000000456000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\830B.tmp\end.bat

MD5 7587b2b0a5fc82e9e4cc74ce46ace872
SHA1 ca819f39b8ad8e94fdf21dc9df86df47ba637d53
SHA256 8a9dd393be84dcd564241a4f277605c91c237147ac5db202bc4b5536e2e1dce4
SHA512 328f0613548c6014a072c7772d4822cea14b2637f009dc948271f19bc56d4b52af5b9f5c1767b686b6c31e2855a0520dacbb0f6868753a2c6aef53592f17a096

C:\Windows\System32\drivers\etc\hosts

MD5 9d86d0ef016df89edd6ac30c48ed5418
SHA1 b97909e0e810c18df521f20759af43241c8700d2
SHA256 5369a346a83a46e176e85a39ea14489f949514dc85b7f81d936fc243d71a4233
SHA512 a25c77afb10f0ed0adc1c9a59f40bc53dd4e0d54b49a53fcf4a7f22a57ac84025321bcf137641a1a1818d49a0e4c2f443f83ee83ac7a6ec9500c50d1fd0b24f9

C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

MD5 d9e8a1fa55faebd36ed2342fedefbedd
SHA1 c25cc7f0035488de9c5df0121a09b5100e1c28e9
SHA256 bd7696911d75a9a35dfd125b24cb95003f1e9598592df47fa23a2568986a4a9a
SHA512 134644c68bd04536e9ea0a5da6e334d36b1ce8012a061fa6dabd31f85c16a1ac9eee8c40fee3d55f25c4d4edf0672de8ce204e344c800361cbcff092c09d7a33

C:\Windows\System32\drivers\etc\hosts

MD5 f84f78b89cbb5aeb42768b8e153b004e
SHA1 d55251caa6c88cd07c70bb3be6948204f94ee33f
SHA256 f9d304d34520daf475f8bda3bf3c8918071c1ddb829526a2b2ec50253e6b9d58
SHA512 d87f30fd7ff7aa879b7bc93a61f8d2ef4ee3573620805e6d03f91db9e8a266dbf70388df7c251c244a069b2039326775d293da465e95f1ce4d1e3cf2e73b39e7

memory/4244-690-0x0000000000400000-0x0000000000456000-memory.dmp

memory/2456-757-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2456-758-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2456-760-0x0000000000400000-0x000000000041B000-memory.dmp