Malware Analysis Report

2024-09-22 10:46

Sample ID 240724-zs186azcne
Target 6cc127a50dab265b3ef97f9e24dfe354_JaffaCakes118
SHA256 249fef02cb6e2ad1c9289efa1f36e28a8e2368bf6932254fc643ba5049bc137a
Tags
darkcomet hawkeye discovery keylogger persistence rat spyware stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

249fef02cb6e2ad1c9289efa1f36e28a8e2368bf6932254fc643ba5049bc137a

Threat Level: Known bad

The file 6cc127a50dab265b3ef97f9e24dfe354_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

darkcomet hawkeye discovery keylogger persistence rat spyware stealer trojan upx

HawkEye

Darkcomet

Executes dropped EXE

UPX packed file

Loads dropped DLL

Checks computer location settings

Deletes itself

Adds Run key to start application

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-07-24 20:59

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-24 20:59

Reported

2024-07-24 21:02

Platform

win7-20240708-en

Max time kernel

21s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6cc127a50dab265b3ef97f9e24dfe354_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

HawkEye

keylogger trojan stealer spyware hawkeye

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\nvxdsinc.exe" C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\6cc127a50dab265b3ef97f9e24dfe354_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6cc127a50dab265b3ef97f9e24dfe354_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 34 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 35 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 34 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 35 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1744 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\6cc127a50dab265b3ef97f9e24dfe354_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 1744 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\6cc127a50dab265b3ef97f9e24dfe354_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 1744 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\6cc127a50dab265b3ef97f9e24dfe354_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 1744 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\6cc127a50dab265b3ef97f9e24dfe354_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 2468 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2468 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2468 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2468 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2468 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2468 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2468 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2468 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2468 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2468 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2468 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2468 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe
PID 2468 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe
PID 2468 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe
PID 2468 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe
PID 2704 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe
PID 2704 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe
PID 2704 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe
PID 2704 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe
PID 2568 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2568 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2568 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2568 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2568 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2568 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2568 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2568 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2568 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2568 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2568 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6cc127a50dab265b3ef97f9e24dfe354_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\6cc127a50dab265b3ef97f9e24dfe354_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe

"C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe"

C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe

"C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 gethosted.no-ip.biz udp

Files

memory/1744-0-0x0000000074341000-0x0000000074342000-memory.dmp

memory/1744-2-0x0000000074340000-0x00000000748EB000-memory.dmp

memory/1744-1-0x0000000074340000-0x00000000748EB000-memory.dmp

\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

MD5 6cc127a50dab265b3ef97f9e24dfe354
SHA1 c328cb48839d1bc8061bc864cfeb9042f30e9a4a
SHA256 249fef02cb6e2ad1c9289efa1f36e28a8e2368bf6932254fc643ba5049bc137a
SHA512 e324a083580d926fa0f9d7241be538399847949bb9a0ad815683dd24c5e2e5e244c756e557bf60fa72d6c27b73e20bf0ee8f1c5f7f52ffbbd511290f8e724c78

memory/1744-14-0x0000000074340000-0x00000000748EB000-memory.dmp

memory/2468-15-0x0000000074340000-0x00000000748EB000-memory.dmp

memory/2468-16-0x0000000074340000-0x00000000748EB000-memory.dmp

memory/2468-17-0x0000000074340000-0x00000000748EB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

MD5 62380a0db84756560a59ba039e718d3d
SHA1 f012e1e45dd22c71703c20b7b870b2be83bc1b23
SHA256 34d48a5afe21969c78cf890d9cc30c7e77670bc7bbc2772e0ef534c152155cfa
SHA512 557f90ad748388e1fa8fa26817a96996f0f0ce4ceb6fc7f3d6eadac474abb8d9b360191aeb66e12ad42c47d106bd967a6d55235ff0b9b0ad9f8457701c1a31f6

memory/2660-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2660-28-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/2660-25-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/2660-23-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/2660-31-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/2660-33-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/2660-35-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/2660-32-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/2660-38-0x0000000000400000-0x00000000004C9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe

MD5 efcf28f05a96d7718bbe1961a37d88ba
SHA1 68fd8bb335b7fe6d3623fcb1a11bafdbfbf9684f
SHA256 048879506d846d463bee545d62ccc444863831e8f158a850699d6ca1dad9b804
SHA512 f0c113524caf77599a409220d08e22bd8ab2a525416e95c1f940bb9d873b3246e9ee1f8600fa5eb767dbe00df5f24c00c1d37298506d577837206ad96f2aff06

memory/2660-50-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/2660-49-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/2660-48-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/2660-47-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/2660-37-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/2468-67-0x0000000074340000-0x00000000748EB000-memory.dmp

memory/2660-68-0x0000000000400000-0x00000000004C9000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-24 20:59

Reported

2024-07-24 21:02

Platform

win10v2004-20240709-en

Max time kernel

150s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6cc127a50dab265b3ef97f9e24dfe354_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

HawkEye

keylogger trojan stealer spyware hawkeye

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\6cc127a50dab265b3ef97f9e24dfe354_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\nvxdsinc.exe" C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\6cc127a50dab265b3ef97f9e24dfe354_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6cc127a50dab265b3ef97f9e24dfe354_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 34 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 35 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 36 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 34 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 35 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 36 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4832 wrote to memory of 5076 N/A C:\Users\Admin\AppData\Local\Temp\6cc127a50dab265b3ef97f9e24dfe354_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 4832 wrote to memory of 5076 N/A C:\Users\Admin\AppData\Local\Temp\6cc127a50dab265b3ef97f9e24dfe354_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 4832 wrote to memory of 5076 N/A C:\Users\Admin\AppData\Local\Temp\6cc127a50dab265b3ef97f9e24dfe354_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 5076 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 5076 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 5076 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 5076 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 5076 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 5076 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 5076 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 5076 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 5076 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe
PID 5076 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe
PID 5076 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe
PID 4460 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe
PID 4460 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe
PID 4460 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe
PID 3444 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3444 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3444 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3444 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3444 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3444 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3444 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3444 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6cc127a50dab265b3ef97f9e24dfe354_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\6cc127a50dab265b3ef97f9e24dfe354_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe

"C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe"

C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe

"C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 19.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 gethosted.no-ip.biz udp
US 8.8.8.8:53 gethosted.no-ip.biz udp

Files

memory/4832-0-0x0000000074E42000-0x0000000074E43000-memory.dmp

memory/4832-1-0x0000000074E40000-0x00000000753F1000-memory.dmp

memory/4832-2-0x0000000074E40000-0x00000000753F1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

MD5 6cc127a50dab265b3ef97f9e24dfe354
SHA1 c328cb48839d1bc8061bc864cfeb9042f30e9a4a
SHA256 249fef02cb6e2ad1c9289efa1f36e28a8e2368bf6932254fc643ba5049bc137a
SHA512 e324a083580d926fa0f9d7241be538399847949bb9a0ad815683dd24c5e2e5e244c756e557bf60fa72d6c27b73e20bf0ee8f1c5f7f52ffbbd511290f8e724c78

memory/5076-13-0x0000000074E40000-0x00000000753F1000-memory.dmp

memory/4832-14-0x0000000074E40000-0x00000000753F1000-memory.dmp

memory/5076-15-0x0000000074E40000-0x00000000753F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

MD5 62380a0db84756560a59ba039e718d3d
SHA1 f012e1e45dd22c71703c20b7b870b2be83bc1b23
SHA256 34d48a5afe21969c78cf890d9cc30c7e77670bc7bbc2772e0ef534c152155cfa
SHA512 557f90ad748388e1fa8fa26817a96996f0f0ce4ceb6fc7f3d6eadac474abb8d9b360191aeb66e12ad42c47d106bd967a6d55235ff0b9b0ad9f8457701c1a31f6

memory/2312-22-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/2312-21-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/2312-23-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/2312-25-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/2312-24-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/2312-26-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/2312-28-0x0000000000400000-0x00000000004C9000-memory.dmp

memory/2312-29-0x0000000000820000-0x0000000000821000-memory.dmp

memory/2312-27-0x0000000000400000-0x00000000004C9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe

MD5 efcf28f05a96d7718bbe1961a37d88ba
SHA1 68fd8bb335b7fe6d3623fcb1a11bafdbfbf9684f
SHA256 048879506d846d463bee545d62ccc444863831e8f158a850699d6ca1dad9b804
SHA512 f0c113524caf77599a409220d08e22bd8ab2a525416e95c1f940bb9d873b3246e9ee1f8600fa5eb767dbe00df5f24c00c1d37298506d577837206ad96f2aff06

memory/5076-48-0x0000000074E40000-0x00000000753F1000-memory.dmp