Malware Analysis Report

2024-10-23 19:39

Sample ID 240815-hz38nawclm
Target 995847785e475c64d1e81917b89eb646_JaffaCakes118
SHA256 9e08f4bedc659a9e1d7f476cdf1cf63928e09b12cd6b1b2393a16ea2ab7cfe03
Tags
nanocore discovery evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9e08f4bedc659a9e1d7f476cdf1cf63928e09b12cd6b1b2393a16ea2ab7cfe03

Threat Level: Known bad

The file 995847785e475c64d1e81917b89eb646_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

nanocore discovery evasion keylogger persistence spyware stealer trojan

NanoCore

Checks computer location settings

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Drops file in Program Files directory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Scheduled Task/Job: Scheduled Task

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-15 07:11

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-15 07:11

Reported

2024-08-15 07:13

Platform

win7-20240704-en

Max time kernel

134s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ARP Host = "C:\\Program Files (x86)\\ARP Host\\arphost.exe" C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\ARP Host\arphost.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\ARP Host\arphost.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1824 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1824 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1824 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1824 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 1824 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe
PID 1824 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe
PID 1824 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe
PID 1824 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe
PID 1824 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe
PID 1824 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe
PID 1824 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe
PID 1824 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe
PID 1824 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe
PID 1824 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe
PID 1824 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe
PID 1824 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe
PID 1824 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe
PID 648 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 648 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 648 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 648 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 648 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 648 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 648 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 648 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qvogBD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp57C1.tmp"

C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "ARP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp58E9.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "ARP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5B4B.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 office1.servemp3.com udp
US 216.218.135.118:2017 office1.servemp3.com tcp
US 8.8.8.8:53 office1.servemp3.com udp
US 216.218.135.118:2017 office1.servemp3.com tcp
US 8.8.8.8:53 office1.servemp3.com udp
US 216.218.135.118:2017 office1.servemp3.com tcp
US 8.8.8.8:53 office1.servemp3.com udp
US 216.218.135.118:2017 office1.servemp3.com tcp

Files

memory/1824-0-0x0000000074021000-0x0000000074022000-memory.dmp

memory/1824-1-0x0000000074020000-0x00000000745CB000-memory.dmp

memory/1824-2-0x0000000074020000-0x00000000745CB000-memory.dmp

memory/1824-3-0x0000000074020000-0x00000000745CB000-memory.dmp

memory/1824-4-0x0000000074020000-0x00000000745CB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp57C1.tmp

MD5 db637b4da3505cd06afd02717a3e4aa9
SHA1 9ef574dccc564c021c86d7d08ce41b8c329825ef
SHA256 98a9a2a03e2c0fe7938cadacff9316137d5b3a61c69d673adf0c36f7c276477f
SHA512 d38538ba3efeb8dcfc1331569ad17efc8b6eeb0646ac0d7755f7f44ba1037400432f4fd077bf318924bd7d8440e46ffbc072eacab41f190a243b15a3ae728e2a

memory/648-11-0x0000000000400000-0x0000000000438000-memory.dmp

memory/648-14-0x0000000000400000-0x0000000000438000-memory.dmp

memory/648-20-0x0000000000400000-0x0000000000438000-memory.dmp

memory/648-23-0x0000000000400000-0x0000000000438000-memory.dmp

memory/648-28-0x0000000074020000-0x00000000745CB000-memory.dmp

memory/1824-25-0x0000000074020000-0x00000000745CB000-memory.dmp

memory/648-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/648-16-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp58E9.tmp

MD5 6b4fbb24bd193081ba5efd8afa7fd3e2
SHA1 5cce6826322713176dfd4807d8d1b4971a9a691a
SHA256 b82391e4376a6681c2d9395b7c8ce0881ed519c77ffad8d10a0b148af5b1d351
SHA512 5caae6637fdd4d2e53402413829791d5442b4dd84b61051d443ccf1dce8cead7958e2fa8b3dd20e79f5a2919c46b41df5235e7bb3608a039b4f511e9d72f42d6

memory/648-24-0x0000000000400000-0x0000000000438000-memory.dmp

memory/648-12-0x0000000000400000-0x0000000000438000-memory.dmp

memory/648-31-0x0000000074020000-0x00000000745CB000-memory.dmp

memory/648-32-0x0000000074020000-0x00000000745CB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp5B4B.tmp

MD5 447ab194ab36cb1d20078d80e502b1b2
SHA1 a947b3b2c91d7c50bb8d39bd4fc91a0d0cc5b1c0
SHA256 8d5304b20b7d7dea223ce2738e5668054250d57bf6bed86b305b69924bd472f5
SHA512 49ddc557f7f6635627eea9bf0fa12a14b7b13edb235ed560ee0044a7f87fe27b686ff878d347d0273d92eb0b318b8c2bca85c0fbf42d586ed7d7da39eac6a327

memory/648-36-0x0000000074020000-0x00000000745CB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-15 07:11

Reported

2024-08-15 07:13

Platform

win10v2004-20240802-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WPA Subsystem = "C:\\Program Files (x86)\\WPA Subsystem\\wpass.exe" C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\WPA Subsystem\wpass.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\WPA Subsystem\wpass.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3608 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 3608 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 3608 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 3608 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe
PID 3608 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe
PID 3608 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe
PID 3608 wrote to memory of 4308 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe
PID 3608 wrote to memory of 4308 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe
PID 3608 wrote to memory of 4308 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe
PID 3608 wrote to memory of 4308 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe
PID 3608 wrote to memory of 4308 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe
PID 3608 wrote to memory of 4308 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe
PID 3608 wrote to memory of 4308 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe
PID 3608 wrote to memory of 4308 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe
PID 4308 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 4308 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 4308 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 4308 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 4308 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 4308 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qvogBD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4716.tmp"

C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\995847785e475c64d1e81917b89eb646_JaffaCakes118.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "WPA Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4958.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "WPA Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4979.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 192.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 office1.servemp3.com udp
US 216.218.135.118:2017 office1.servemp3.com tcp
US 8.8.8.8:53 118.135.218.216.in-addr.arpa udp
US 8.8.8.8:53 office1.servemp3.com udp
US 216.218.135.118:2017 office1.servemp3.com tcp
US 8.8.8.8:53 office1.servemp3.com udp
US 216.218.135.118:2017 office1.servemp3.com tcp
US 8.8.8.8:53 office1.servemp3.com udp
US 216.218.135.118:2017 office1.servemp3.com tcp
US 8.8.8.8:53 udp

Files

memory/3608-0-0x00000000750C2000-0x00000000750C3000-memory.dmp

memory/3608-1-0x00000000750C0000-0x0000000075671000-memory.dmp

memory/3608-2-0x00000000750C0000-0x0000000075671000-memory.dmp

memory/3608-3-0x00000000750C2000-0x00000000750C3000-memory.dmp

memory/3608-4-0x00000000750C0000-0x0000000075671000-memory.dmp

memory/3608-5-0x00000000750C0000-0x0000000075671000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp4716.tmp

MD5 68802801ef325ffc9d289f5f242887c4
SHA1 d0c3df4f8cc86d0a3821d1b088a2061a3fe15ef0
SHA256 eae680aed2da7664a811e1903b25e6c054bb98b1b213cb639da68a357f1371e2
SHA512 b9018ee60cb34f9d320eeac3bed106b90283c56d609444bd32027d0f5369192ec781aa5fb5f0090c641d51e83eaabdd76d682c984589d944aaa462fe8dc9f89c

memory/4308-11-0x0000000000400000-0x0000000000438000-memory.dmp

memory/4308-12-0x00000000750C0000-0x0000000075671000-memory.dmp

memory/4308-14-0x00000000750C0000-0x0000000075671000-memory.dmp

memory/4308-16-0x00000000750C0000-0x0000000075671000-memory.dmp

memory/3608-15-0x00000000750C0000-0x0000000075671000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp4958.tmp

MD5 6b4fbb24bd193081ba5efd8afa7fd3e2
SHA1 5cce6826322713176dfd4807d8d1b4971a9a691a
SHA256 b82391e4376a6681c2d9395b7c8ce0881ed519c77ffad8d10a0b148af5b1d351
SHA512 5caae6637fdd4d2e53402413829791d5442b4dd84b61051d443ccf1dce8cead7958e2fa8b3dd20e79f5a2919c46b41df5235e7bb3608a039b4f511e9d72f42d6

C:\Users\Admin\AppData\Local\Temp\tmp4979.tmp

MD5 4365cd1ae65923a319ef2683a45891fe
SHA1 85dde233112660e31c53884aedfbad52e4547e09
SHA256 84b6ce4ba26fa6fb57fa70b9ad191f7c42c71e259897955b5d514385bcd91b58
SHA512 d1bd24f504c5c2ecaa3ae98268ccc2e400ea3e16980c6caf394eadf7738225e4d5578fbe62bbe2de3fe0cb56a0d76bb3fc84cef3b9cd2f3d8be6d0becefdc035

memory/4308-24-0x00000000750C0000-0x0000000075671000-memory.dmp

memory/4308-25-0x00000000750C0000-0x0000000075671000-memory.dmp

memory/4308-26-0x00000000750C0000-0x0000000075671000-memory.dmp