Malware Analysis Report

2024-10-18 23:06

Sample ID 240725-scxgpsvdrq
Target 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118
SHA256 4a143baf691f9d5edc1694cbb3c232d41d5650d62af636ecc5d31ba9467ae4fd
Tags
ardamax discovery keylogger persistence stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4a143baf691f9d5edc1694cbb3c232d41d5650d62af636ecc5d31ba9467ae4fd

Threat Level: Known bad

The file 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

ardamax discovery keylogger persistence stealer

Ardamax

Ardamax main executable

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Checks installed software on the system

Drops file in System32 directory

System Location Discovery: System Language Discovery

Unsigned PE

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-25 14:59

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-25 14:59

Reported

2024-07-25 15:06

Platform

win7-20240705-en

Max time kernel

15s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe"

Signatures

Ardamax

keylogger stealer ardamax

Ardamax main executable

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Exporer32.exe N/A
N/A N/A C:\Windows\SysWOW64\28463\NPEW.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NPEW Agent = "C:\\Windows\\SysWOW64\\28463\\NPEW.exe" C:\Windows\SysWOW64\28463\NPEW.exe N/A

Checks installed software on the system

discovery

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\28463\NPEW.001 C:\Users\Admin\AppData\Local\Temp\Exporer32.exe N/A
File created C:\Windows\SysWOW64\28463\NPEW.006 C:\Users\Admin\AppData\Local\Temp\Exporer32.exe N/A
File created C:\Windows\SysWOW64\28463\NPEW.007 C:\Users\Admin\AppData\Local\Temp\Exporer32.exe N/A
File created C:\Windows\SysWOW64\28463\NPEW.exe C:\Users\Admin\AppData\Local\Temp\Exporer32.exe N/A
File opened for modification C:\Windows\SysWOW64\28463 C:\Windows\SysWOW64\28463\NPEW.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Exporer32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\28463\NPEW.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Windows\SysWOW64\28463\NPEW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\28463\NPEW.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\Exporer32.exe

"C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"

C:\Windows\SysWOW64\28463\NPEW.exe

"C:\Windows\system32\28463\NPEW.exe"

Network

N/A

Files

memory/2160-0-0x0000000000400000-0x000000000042B000-memory.dmp

C:\ProgramData\jI82l\PCGWIN32.LI5

MD5 4ecbe741bb2676d0147e1103ac18dfcd
SHA1 34b037e313dd0479c14bc51181ad059a74947b75
SHA256 1d1177f03c08284e1598ec92a67dd2f021d5b8cdb39c1d7a87ac348c6a3efef0
SHA512 e33492d6975c838a2fc4914c2b6afdc7ec0e6db5a6966108daf7af248e65c1b0396d27c114385f55909e70229535379736c936639c27d7f66a95f56e9103a5a8

\Users\Admin\AppData\Local\Temp\Exporer32.exe

MD5 a2754b0d71cbe981df8657e277a42d02
SHA1 f5184d67a3744a70323cb8b89fc8aef73231be6e
SHA256 9217b464a2560e1be585bbce827393d600050817718d554f217f6fbcac8fbce2
SHA512 03c8be0b464759cbea7ae82a3e8dbb6773c3dc9dbc383dfcf6bbd63ec173d3d407d40d1ee2d70d9127fbb544ab3131040a513940cc218f09ef6dcd89d31ddc2d

memory/2160-24-0x0000000000400000-0x000000000042B000-memory.dmp

\Users\Admin\AppData\Local\Temp\@232.tmp

MD5 c3679c3ff636d1a6b8c65323540da371
SHA1 d184758721a426467b687bec2a4acc80fe44c6f8
SHA256 d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb
SHA512 494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7

\Windows\SysWOW64\28463\NPEW.exe

MD5 17535dddecf8cb1efdba1f1952126547
SHA1 a862a9a3eb6c201751be1038537522a5281ea6cb
SHA256 1a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd
SHA512 b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8

C:\Windows\SysWOW64\28463\NPEW.006

MD5 43f02e9974b1477c1e6388882f233db0
SHA1 f3e27b231193f8d5b2e1b09d05ae3a62795cf339
SHA256 3c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba
SHA512 e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f

C:\Windows\SysWOW64\28463\NPEW.001

MD5 0a747bd4a40df520c0efdd7af400c17c
SHA1 9559c863d76dca319b7c99f49ce16c03c6701142
SHA256 8512698e9ed8a5bb4b06ed6d65ef98921c15716369fc7a2f9dfb1adbdb06b6be
SHA512 f5400244833caa2f76d8468f0eefe8f311c2033a557d46a04024eea8f37d8468063effc055bc38b52c58c3481055e2c9130beed4622aed6e7690cffda31db0c4

C:\Windows\SysWOW64\28463\NPEW.007

MD5 b5a87d630436f958c6e1d82d15f98f96
SHA1 d3ff5e92198d4df0f98a918071aca53550bf1cff
SHA256 a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2
SHA512 fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce

memory/2724-48-0x0000000000250000-0x0000000000251000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-25 14:59

Reported

2024-07-25 15:06

Platform

win10v2004-20240709-en

Max time kernel

94s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe"

Signatures

Ardamax

keylogger stealer ardamax

Ardamax main executable

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Exporer32.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Exporer32.exe N/A
N/A N/A C:\Windows\SysWOW64\28463\NPEW.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NPEW Agent = "C:\\Windows\\SysWOW64\\28463\\NPEW.exe" C:\Windows\SysWOW64\28463\NPEW.exe N/A

Checks installed software on the system

discovery

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\28463\NPEW.001 C:\Users\Admin\AppData\Local\Temp\Exporer32.exe N/A
File created C:\Windows\SysWOW64\28463\NPEW.006 C:\Users\Admin\AppData\Local\Temp\Exporer32.exe N/A
File created C:\Windows\SysWOW64\28463\NPEW.007 C:\Users\Admin\AppData\Local\Temp\Exporer32.exe N/A
File created C:\Windows\SysWOW64\28463\NPEW.exe C:\Users\Admin\AppData\Local\Temp\Exporer32.exe N/A
File opened for modification C:\Windows\SysWOW64\28463 C:\Windows\SysWOW64\28463\NPEW.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Exporer32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\28463\NPEW.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Windows\SysWOW64\28463\NPEW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\28463\NPEW.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\Exporer32.exe

"C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"

C:\Windows\SysWOW64\28463\NPEW.exe

"C:\Windows\system32\28463\NPEW.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 149.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 96.252.19.2.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/1444-0-0x0000000000400000-0x000000000042B000-memory.dmp

C:\ProgramData\jI82l\PCGWIN32.LI5

MD5 535616f9afecac5c1a47408af7714148
SHA1 1266a18c1f894e9df061982a13db60e57d1f8031
SHA256 8a9fb81cedfc54e8bb248da8200dd728ca50495687131fd956a7172bcedf02c7
SHA512 2f4f41a36fba9796c367e8236bb162f5161caf9e537c600938a320c54cc1660f420210ec6fb2a85210e79127d8e0ebcb3a5710dfe4e8a6b00ada10317c5bfa90

C:\Users\Admin\AppData\Local\Temp\Exporer32.exe

MD5 a2754b0d71cbe981df8657e277a42d02
SHA1 f5184d67a3744a70323cb8b89fc8aef73231be6e
SHA256 9217b464a2560e1be585bbce827393d600050817718d554f217f6fbcac8fbce2
SHA512 03c8be0b464759cbea7ae82a3e8dbb6773c3dc9dbc383dfcf6bbd63ec173d3d407d40d1ee2d70d9127fbb544ab3131040a513940cc218f09ef6dcd89d31ddc2d

C:\Users\Admin\AppData\Local\Temp\@E733.tmp

MD5 c3679c3ff636d1a6b8c65323540da371
SHA1 d184758721a426467b687bec2a4acc80fe44c6f8
SHA256 d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb
SHA512 494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7

memory/1444-32-0x0000000000400000-0x000000000042B000-memory.dmp

C:\Windows\SysWOW64\28463\NPEW.exe

MD5 17535dddecf8cb1efdba1f1952126547
SHA1 a862a9a3eb6c201751be1038537522a5281ea6cb
SHA256 1a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd
SHA512 b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8

C:\Windows\SysWOW64\28463\NPEW.007

MD5 b5a87d630436f958c6e1d82d15f98f96
SHA1 d3ff5e92198d4df0f98a918071aca53550bf1cff
SHA256 a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2
SHA512 fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce

C:\Windows\SysWOW64\28463\NPEW.006

MD5 43f02e9974b1477c1e6388882f233db0
SHA1 f3e27b231193f8d5b2e1b09d05ae3a62795cf339
SHA256 3c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba
SHA512 e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f

C:\Windows\SysWOW64\28463\NPEW.001

MD5 0a747bd4a40df520c0efdd7af400c17c
SHA1 9559c863d76dca319b7c99f49ce16c03c6701142
SHA256 8512698e9ed8a5bb4b06ed6d65ef98921c15716369fc7a2f9dfb1adbdb06b6be
SHA512 f5400244833caa2f76d8468f0eefe8f311c2033a557d46a04024eea8f37d8468063effc055bc38b52c58c3481055e2c9130beed4622aed6e7690cffda31db0c4

memory/1508-45-0x0000000000640000-0x0000000000641000-memory.dmp

memory/1508-49-0x0000000000640000-0x0000000000641000-memory.dmp