Malware Analysis Report

2024-09-22 10:49

Sample ID 240731-1hhjqszamg
Target 7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118
SHA256 961e10de552361ed6da39826e2c634251e0218f3eea9ddba83a99e56338f77a1
Tags
hawkeye discovery evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

961e10de552361ed6da39826e2c634251e0218f3eea9ddba83a99e56338f77a1

Threat Level: Known bad

The file 7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

hawkeye discovery evasion keylogger persistence spyware stealer trojan

Modifies firewall policy service

HawkEye

Deletes itself

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Modifies registry key

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-07-31 21:38

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-31 21:38

Reported

2024-07-31 21:41

Platform

win7-20240729-en

Max time kernel

149s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\No$Crypter.exe = "C:\\Users\\Admin\\AppData\\Roaming\\No$Crypter.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\nvxdsinc.exe" C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
Token: 1 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 31 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 32 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 34 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 35 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2732 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 2732 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 2732 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 2732 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 2700 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2700 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2700 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2700 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2700 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2700 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2700 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2700 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2700 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2700 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2700 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2700 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe
PID 2700 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe
PID 2700 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe
PID 2700 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe
PID 2620 wrote to memory of 580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 580 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 3024 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 3024 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 3024 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 3024 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 3024 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 3024 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 3024 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 856 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 856 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 856 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 856 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 856 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 856 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 856 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 1700 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 1700 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 1700 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 1700 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 1700 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 1700 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 1700 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 1800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 856 wrote to memory of 1800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 856 wrote to memory of 1800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 856 wrote to memory of 1800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 856 wrote to memory of 1800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 856 wrote to memory of 1800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 856 wrote to memory of 1800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3024 wrote to memory of 2368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3024 wrote to memory of 2368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3024 wrote to memory of 2368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3024 wrote to memory of 2368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3024 wrote to memory of 2368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3024 wrote to memory of 2368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3024 wrote to memory of 2368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 580 wrote to memory of 1140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 580 wrote to memory of 1140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 580 wrote to memory of 1140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe

"C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\No$Crypter.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\No$Crypter.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\No$Crypter.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\No$Crypter.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe

"C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 egotus.myftp.org udp
US 8.8.8.8:53 1egotus.myftp.org udp
US 8.8.8.8:53 2egotus.myftp.org udp
US 8.8.8.8:53 3egotus.myftp.org udp
US 8.8.8.8:53 4egotus.myftp.org udp
US 8.8.8.8:53 5egotus.myftp.org udp
US 8.8.8.8:53 6egotus.myftp.org udp
US 8.8.8.8:53 7egotus.myftp.org udp
US 8.8.8.8:53 8egotus.myftp.org udp

Files

memory/2732-0-0x0000000074011000-0x0000000074012000-memory.dmp

memory/2732-1-0x0000000074010000-0x00000000745BB000-memory.dmp

memory/2732-2-0x0000000074010000-0x00000000745BB000-memory.dmp

\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

MD5 7e0a79cad98add88070148fb9ddb12aa
SHA1 75effc9d69686bf3a5937ffe48e2711b8d2828e3
SHA256 961e10de552361ed6da39826e2c634251e0218f3eea9ddba83a99e56338f77a1
SHA512 ac2cd4fd7fd9a67c813f86d7a3bc5d46f5067a8cc310eeb42f940e96688090d4a6e0e2b8f751ce830fd0be9ebc93ee7e53e2f92a1fdea044971a0351352534ad

memory/2700-14-0x0000000074010000-0x00000000745BB000-memory.dmp

memory/2700-15-0x0000000074010000-0x00000000745BB000-memory.dmp

memory/2732-16-0x0000000074010000-0x00000000745BB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

MD5 4538db5dab04a07ad6385a2166c65cf0
SHA1 98c7e4588d9418643df5bc7d4e7d1cef2ff4423e
SHA256 82bbdff4d25adb230894bab9f72df55f044cf9ea063a48f99055a599af819bb5
SHA512 c4d0098b9ca2862cd053cd722fb8be9b3229bc5c4617036571c145fe33762856806ecb8eb73f3bcf3279ae8e8e5d8500722ef08eb611cf101cdcb5d74cf6cb26

memory/2620-24-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2620-28-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2620-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2620-23-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2620-22-0x0000000000400000-0x0000000000470000-memory.dmp

\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe

MD5 96fafbeae063dcf2947958423ca42d3f
SHA1 da7b4d92877bedfe6238e04eb7ec8662e0d5e4e5
SHA256 9a768bfedb5c7f3f1bae0171d6ef7f002a41ec3545e54e25824edbf423efafee
SHA512 d083b327fc9f9a5c998706d3ec4137fa96a80f9f1dd1d622363d587dc225ba206f99d7878cdc67b93746f73b31e87509fb88dd3a55537a1cde39476cd872f277

memory/2700-60-0x0000000074010000-0x00000000745BB000-memory.dmp

memory/2700-61-0x0000000074010000-0x00000000745BB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-31 21:38

Reported

2024-07-31 21:41

Platform

win10v2004-20240730-en

Max time kernel

150s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe"

Signatures

HawkEye

keylogger trojan stealer spyware hawkeye

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\No$Crypter.exe = "C:\\Users\\Admin\\AppData\\Roaming\\No$Crypter.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2951562807-3718269429-4208157415-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2951562807-3718269429-4208157415-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2951562807-3718269429-4208157415-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2951562807-3718269429-4208157415-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\nvxdsinc.exe" C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
Token: 1 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 31 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 32 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 34 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 35 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3284 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 3284 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 3284 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 2208 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2208 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2208 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2208 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2208 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2208 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2208 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2208 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 4348 wrote to memory of 4140 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4348 wrote to memory of 4140 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4348 wrote to memory of 4140 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4348 wrote to memory of 2316 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4348 wrote to memory of 2316 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4348 wrote to memory of 2316 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4348 wrote to memory of 4048 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4348 wrote to memory of 4048 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4348 wrote to memory of 4048 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4348 wrote to memory of 3504 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4348 wrote to memory of 3504 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4348 wrote to memory of 3504 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4140 wrote to memory of 3156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4140 wrote to memory of 3156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4140 wrote to memory of 3156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4048 wrote to memory of 5068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4048 wrote to memory of 5068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4048 wrote to memory of 5068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3504 wrote to memory of 1408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3504 wrote to memory of 1408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3504 wrote to memory of 1408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2316 wrote to memory of 3536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2316 wrote to memory of 3536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2316 wrote to memory of 3536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2208 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe
PID 2208 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe
PID 2208 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe
PID 3744 wrote to memory of 3152 N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe
PID 3744 wrote to memory of 3152 N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe
PID 3744 wrote to memory of 3152 N/A C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe
PID 3152 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3152 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3152 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3152 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3152 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3152 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3152 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3152 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\No$Crypter.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\No$Crypter.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\No$Crypter.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\No$Crypter.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f

C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe

"C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe"

C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe

"C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
US 8.8.8.8:53 egotus.myftp.org udp
US 8.8.8.8:53 egotus.myftp.org udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 1egotus.myftp.org udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 2egotus.myftp.org udp
US 8.8.8.8:53 3egotus.myftp.org udp
US 8.8.8.8:53 22.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 4egotus.myftp.org udp
US 8.8.8.8:53 5egotus.myftp.org udp
US 8.8.8.8:53 6egotus.myftp.org udp
US 8.8.8.8:53 7egotus.myftp.org udp
US 8.8.8.8:53 8egotus.myftp.org udp

Files

memory/3284-0-0x0000000074632000-0x0000000074633000-memory.dmp

memory/3284-1-0x0000000074630000-0x0000000074BE1000-memory.dmp

memory/3284-2-0x0000000074630000-0x0000000074BE1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

MD5 7e0a79cad98add88070148fb9ddb12aa
SHA1 75effc9d69686bf3a5937ffe48e2711b8d2828e3
SHA256 961e10de552361ed6da39826e2c634251e0218f3eea9ddba83a99e56338f77a1
SHA512 ac2cd4fd7fd9a67c813f86d7a3bc5d46f5067a8cc310eeb42f940e96688090d4a6e0e2b8f751ce830fd0be9ebc93ee7e53e2f92a1fdea044971a0351352534ad

memory/3284-13-0x0000000074630000-0x0000000074BE1000-memory.dmp

memory/2208-14-0x0000000074630000-0x0000000074BE1000-memory.dmp

memory/2208-15-0x0000000074630000-0x0000000074BE1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

MD5 4538db5dab04a07ad6385a2166c65cf0
SHA1 98c7e4588d9418643df5bc7d4e7d1cef2ff4423e
SHA256 82bbdff4d25adb230894bab9f72df55f044cf9ea063a48f99055a599af819bb5
SHA512 c4d0098b9ca2862cd053cd722fb8be9b3229bc5c4617036571c145fe33762856806ecb8eb73f3bcf3279ae8e8e5d8500722ef08eb611cf101cdcb5d74cf6cb26

memory/4348-21-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4348-23-0x0000000000400000-0x0000000000470000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe

MD5 96fafbeae063dcf2947958423ca42d3f
SHA1 da7b4d92877bedfe6238e04eb7ec8662e0d5e4e5
SHA256 9a768bfedb5c7f3f1bae0171d6ef7f002a41ec3545e54e25824edbf423efafee
SHA512 d083b327fc9f9a5c998706d3ec4137fa96a80f9f1dd1d622363d587dc225ba206f99d7878cdc67b93746f73b31e87509fb88dd3a55537a1cde39476cd872f277

memory/2208-48-0x0000000074630000-0x0000000074BE1000-memory.dmp