Malware Analysis Report

2025-04-13 23:37

Sample ID 240729-d97xda1gln
Target 369c1c90402929c1e23929834c521d9a_JaffaCakes118
SHA256 d0908ac9beecf0f2b2abf1316d7d0cc224cfb849f4b4f5a579841ce809515396
Tags
njrat discovery persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d0908ac9beecf0f2b2abf1316d7d0cc224cfb849f4b4f5a579841ce809515396

Threat Level: Known bad

The file 369c1c90402929c1e23929834c521d9a_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

njrat discovery persistence trojan

njRAT/Bladabindi

Njrat family

Checks computer location settings

Drops startup file

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Kills process with taskkill

Suspicious use of WriteProcessMemory

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-29 03:43

Signatures

Njrat family

njrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-29 03:43

Reported

2024-07-31 02:26

Platform

win7-20240708-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Roaming\Client2.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client2.exe C:\Users\Admin\AppData\Roaming\Client2.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client2.exe C:\Users\Admin\AppData\Roaming\Client2.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client2.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Client2.exe\" .." C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Client2.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Client2.exe\" .." C:\Users\Admin\AppData\Roaming\Client2.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TASKKILL.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TASKKILL.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TASKKILL.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TASKKILL.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TASKKILL.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TASKKILL.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TASKKILL.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TASKKILL.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TASKKILL.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TASKKILL.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2468 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2468 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2468 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2468 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2468 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2468 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2468 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2468 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2468 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Client2.exe
PID 2468 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Client2.exe
PID 2468 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Client2.exe
PID 2468 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Client2.exe
PID 1476 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 1476 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 1476 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 1476 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 1476 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 1476 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 1476 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 1476 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 1476 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1476 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1476 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1476 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1476 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1476 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1476 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1476 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 2376 wrote to memory of 3020 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe
PID 2376 wrote to memory of 3020 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe
PID 2376 wrote to memory of 3020 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe
PID 2376 wrote to memory of 3020 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe
PID 3020 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 3020 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 3020 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 3020 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 3020 wrote to memory of 660 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 3020 wrote to memory of 660 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 3020 wrote to memory of 660 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 3020 wrote to memory of 660 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 3020 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3020 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3020 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3020 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3020 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3020 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3020 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3020 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\TASKKILL.exe

Processes

C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe"

C:\Windows\SysWOW64\schtasks.exe

schtasks /Delete /tn NYANP /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe" /sc minute /mo 5

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /IM wscript.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /IM cmd.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /Delete /tn NYAN /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe" /sc minute /mo 1

C:\Users\Admin\AppData\Roaming\Client2.exe

"C:\Users\Admin\AppData\Roaming\Client2.exe"

C:\Windows\SysWOW64\schtasks.exe

schtasks /Delete /tn NYANP /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Roaming\Client2.exe" /sc minute /mo 5

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /IM wscript.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /IM cmd.exe

C:\Windows\system32\taskeng.exe

taskeng.exe {4A70F595-02E2-4150-A7AB-D74ED92A308A} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /Delete /tn NYANP /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe" /sc minute /mo 5

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /IM wscript.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /IM cmd.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /Delete /tn NYAN /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Roaming\Client2.exe" /sc minute /mo 1

C:\Windows\SysWOW64\schtasks.exe

schtasks /Delete /tn NYAN /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe" /sc minute /mo 1

C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /Delete /tn NYANP /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe" /sc minute /mo 5

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /IM wscript.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /IM cmd.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /Delete /tn NYAN /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe" /sc minute /mo 1

C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /Delete /tn NYANP /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe" /sc minute /mo 5

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /IM wscript.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /IM cmd.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /Delete /tn NYAN /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe" /sc minute /mo 1

Network

Country Destination Domain Proto
RU 185.97.201.51:6522 tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.71:80 crl.microsoft.com tcp
RU 185.97.201.51:6522 tcp
RU 185.97.201.51:6522 tcp
RU 185.97.201.51:6522 tcp

Files

memory/2468-0-0x0000000074D91000-0x0000000074D92000-memory.dmp

memory/2468-1-0x0000000074D90000-0x000000007533B000-memory.dmp

memory/2468-2-0x0000000074D90000-0x000000007533B000-memory.dmp

memory/2468-3-0x0000000074D90000-0x000000007533B000-memory.dmp

C:\Users\Admin\AppData\Roaming\Client2.exe

MD5 369c1c90402929c1e23929834c521d9a
SHA1 f8b6eea2eabf95f8ee5f93cdda07818a74f3a875
SHA256 d0908ac9beecf0f2b2abf1316d7d0cc224cfb849f4b4f5a579841ce809515396
SHA512 e522f85b29ee330c29e106f8de6043f5219665865e53cce3de377feab1fdd9391f50d3f87fad8b1926a4c43ded459e74f8477d7724b98dfcb8616b102b5281d6

memory/2468-18-0x0000000074D90000-0x000000007533B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-29 03:43

Reported

2024-07-31 02:27

Platform

win10v2004-20240730-en

Max time kernel

150s

Max time network

134s

Command Line

"C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-857544305-989156968-2929034274-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Roaming\Client2.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client2.exe C:\Users\Admin\AppData\Roaming\Client2.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client2.exe C:\Users\Admin\AppData\Roaming\Client2.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-857544305-989156968-2929034274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client2.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Client2.exe\" .." C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client2.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Client2.exe\" .." C:\Users\Admin\AppData\Roaming\Client2.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TASKKILL.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TASKKILL.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TASKKILL.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TASKKILL.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TASKKILL.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TASKKILL.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TASKKILL.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TASKKILL.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\TASKKILL.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Client2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1568 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1568 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1568 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1568 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1568 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1568 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1568 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1568 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1568 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1568 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1568 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1568 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 1568 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1568 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1568 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1568 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1568 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1568 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1568 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Client2.exe
PID 1568 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Client2.exe
PID 1568 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Client2.exe
PID 3984 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 3984 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 3984 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 3984 wrote to memory of 3672 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 3984 wrote to memory of 3672 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 3984 wrote to memory of 3672 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 3984 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3984 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3984 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3984 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3984 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3984 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 3984 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 3984 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 3984 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 3984 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 3984 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 3984 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 904 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 904 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 904 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 904 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 904 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 904 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 904 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 904 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 904 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 904 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 904 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 904 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\TASKKILL.exe
PID 904 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 904 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 904 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 904 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 904 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 904 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 3188 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 3188 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 3188 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 3188 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 3188 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 3188 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\schtasks.exe
PID 3188 wrote to memory of 3132 N/A C:\Users\Admin\AppData\Roaming\Client2.exe C:\Windows\SysWOW64\TASKKILL.exe

Processes

C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe"

C:\Windows\SysWOW64\schtasks.exe

schtasks /Delete /tn NYANP /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe" /sc minute /mo 5

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /IM wscript.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /IM cmd.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /Delete /tn NYAN /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\369c1c90402929c1e23929834c521d9a_JaffaCakes118.exe" /sc minute /mo 1

C:\Users\Admin\AppData\Roaming\Client2.exe

"C:\Users\Admin\AppData\Roaming\Client2.exe"

C:\Windows\SysWOW64\schtasks.exe

schtasks /Delete /tn NYANP /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Roaming\Client2.exe" /sc minute /mo 5

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /IM wscript.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /IM cmd.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /Delete /tn NYAN /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Roaming\Client2.exe" /sc minute /mo 1

C:\Users\Admin\AppData\Roaming\Client2.exe

C:\Users\Admin\AppData\Roaming\Client2.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /Delete /tn NYANP /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Roaming\Client2.exe" /sc minute /mo 5

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /IM wscript.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /IM cmd.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /Delete /tn NYAN /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Roaming\Client2.exe" /sc minute /mo 1

C:\Users\Admin\AppData\Roaming\Client2.exe

C:\Users\Admin\AppData\Roaming\Client2.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /Delete /tn NYANP /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Roaming\Client2.exe" /sc minute /mo 5

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /IM wscript.exe

C:\Windows\SysWOW64\TASKKILL.exe

TASKKILL /F /IM cmd.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /Delete /tn NYAN /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Roaming\Client2.exe" /sc minute /mo 1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
RU 185.97.201.51:6522 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
RU 185.97.201.51:6522 tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
RU 185.97.201.51:6522 tcp

Files

memory/1568-0-0x0000000074722000-0x0000000074723000-memory.dmp

memory/1568-1-0x0000000074720000-0x0000000074CD1000-memory.dmp

memory/1568-2-0x0000000074720000-0x0000000074CD1000-memory.dmp

memory/1568-3-0x0000000074720000-0x0000000074CD1000-memory.dmp

memory/1568-4-0x0000000074720000-0x0000000074CD1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Client2.exe

MD5 369c1c90402929c1e23929834c521d9a
SHA1 f8b6eea2eabf95f8ee5f93cdda07818a74f3a875
SHA256 d0908ac9beecf0f2b2abf1316d7d0cc224cfb849f4b4f5a579841ce809515396
SHA512 e522f85b29ee330c29e106f8de6043f5219665865e53cce3de377feab1fdd9391f50d3f87fad8b1926a4c43ded459e74f8477d7724b98dfcb8616b102b5281d6

memory/1568-14-0x0000000074720000-0x0000000074CD1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Client2.exe.log

MD5 40b0c3caa1b14a4c83e8475c46bf2016
SHA1 af9575cda4d842f028d18b17063796a894ecd9d0
SHA256 70e88a428d92b6ab5905dac9f324824c4c6f120bc3f385c82b2d12f707a4a867
SHA512 916437df737de4b6063b7116b4d148229d4a975eb4046122d47434b81fba06e88e09e5f273ec496c81ef3feecb843ccad20a7a04074224416c1fa9951acbdac7