Malware Analysis Report

2024-10-19 08:16

Sample ID 240831-h8l1qssbma
Target cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118
SHA256 deba095b9ba5ffd6ea866849da264d0197efbaf12acd27b900213354d0fa18ff
Tags
expiro backdoor discovery persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

deba095b9ba5ffd6ea866849da264d0197efbaf12acd27b900213354d0fa18ff

Threat Level: Known bad

The file cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

expiro backdoor discovery persistence spyware stealer

Expiro, m0yv

Expiro payload

Executes dropped EXE

Deletes itself

Reads WinSCP keys stored on the system

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

NTFS ADS

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-31 07:24

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-31 07:24

Reported

2024-08-31 07:27

Platform

win7-20240729-en

Max time kernel

150s

Max time network

119s

Command Line

"taskhost.exe"

Signatures

Expiro, m0yv

backdoor expiro

Expiro payload

backdoor
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\legyx.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Hisi\\legyx.exe" C:\Windows\SysWOW64\explorer.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system32\svchost.exe C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\SysWOW64\alg.exe C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\alg.exe C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe N/A
File created \??\c:\windows\system32\ppihcaeh.tmp C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\SysWOW64\svchost.exe C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe N/A
File created \??\c:\windows\SysWOW64\nghmlchp.tmp C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe N/A
File created \??\c:\windows\microsoft.net\framework64\v4.0.30319\nlnenfqi.tmp C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\104D24E4-00000001.eml:OECustomProperty C:\Program Files\Windows Mail\WinMail.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe N/A
Token: SeManageVolumePrivilege N/A C:\Program Files\Windows Mail\WinMail.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Windows Mail\WinMail.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Windows Mail\WinMail.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Windows Mail\WinMail.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2112 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe
PID 2112 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe
PID 2112 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe
PID 2112 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe
PID 2680 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\SysWOW64\explorer.exe
PID 2680 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\SysWOW64\explorer.exe
PID 2680 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\SysWOW64\explorer.exe
PID 2680 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\SysWOW64\explorer.exe
PID 2680 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\SysWOW64\explorer.exe
PID 2680 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\SysWOW64\explorer.exe
PID 2680 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\SysWOW64\explorer.exe
PID 2680 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\SysWOW64\explorer.exe
PID 2680 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\SysWOW64\explorer.exe
PID 2680 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\system32\taskhost.exe
PID 2680 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\system32\taskhost.exe
PID 2680 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\system32\taskhost.exe
PID 2680 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\system32\taskhost.exe
PID 2680 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\system32\taskhost.exe
PID 2680 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\system32\Dwm.exe
PID 2680 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\system32\Dwm.exe
PID 2680 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\system32\Dwm.exe
PID 2680 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\system32\Dwm.exe
PID 2680 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\system32\Dwm.exe
PID 2680 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\Explorer.EXE
PID 2680 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\Explorer.EXE
PID 2680 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\Explorer.EXE
PID 2680 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\Explorer.EXE
PID 2680 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\Explorer.EXE
PID 2680 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\system32\DllHost.exe
PID 2680 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\system32\DllHost.exe
PID 2680 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\system32\DllHost.exe
PID 2680 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\system32\DllHost.exe
PID 2680 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Windows\system32\DllHost.exe
PID 2680 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe
PID 2680 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe
PID 2680 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe
PID 2680 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe
PID 2680 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe
PID 2112 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2112 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2112 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2112 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe

"C:\Users\Admin\AppData\Roaming\Hisi\legyx.exe"

C:\Windows\SysWOW64\explorer.exe

"C:\Windows\SysWOW64\explorer.exe"

C:\Program Files\Windows Mail\WinMail.exe

"C:\Program Files\Windows Mail\WinMail.exe" -Embedding

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp13a692f2.bat"

Network

Country Destination Domain Proto
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.19.252.157:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 184.25.193.234:80 www.microsoft.com tcp

Files

memory/2112-0-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2112-1-0x0000000000403000-0x0000000000404000-memory.dmp

memory/2112-2-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2112-3-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2112-4-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2112-5-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2112-6-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2112-7-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2112-8-0x0000000000400000-0x00000000006A3000-memory.dmp

\Users\Admin\AppData\Roaming\Hisi\legyx.exe

MD5 27aaea6961b53204805127063a36ec4c
SHA1 43c5b46074ae3fb5b7fc26e2686feb2a7e795706
SHA256 dbc0ff2275545db2443f10f17bc5eacaeaf6772d48b1d5a8934f558c39c3d2b7
SHA512 f5ba921b62ee9003e241eea1ef073054d3c7d75323e68a00130fbd358ba71e6e508000618d36cf442f8163997ee31c66e0385c84af0b0138340cabd76e08347a

memory/2112-16-0x00000000033D0000-0x0000000003673000-memory.dmp

memory/2680-18-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2680-17-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2680-19-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2680-22-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2680-20-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2680-36-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2680-35-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2000-34-0x0000000000080000-0x00000000000B1000-memory.dmp

memory/2000-32-0x0000000000080000-0x00000000000B1000-memory.dmp

memory/2000-30-0x0000000000080000-0x00000000000B1000-memory.dmp

memory/2000-26-0x0000000000080000-0x00000000000B1000-memory.dmp

memory/2000-24-0x0000000000080000-0x00000000000B1000-memory.dmp

memory/2680-37-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2000-68-0x0000000000210000-0x0000000000211000-memory.dmp

memory/2000-66-0x0000000000210000-0x0000000000211000-memory.dmp

memory/2000-64-0x0000000000210000-0x0000000000211000-memory.dmp

memory/2000-62-0x0000000000210000-0x0000000000211000-memory.dmp

memory/2000-60-0x0000000000210000-0x0000000000211000-memory.dmp

memory/2000-58-0x0000000000210000-0x0000000000211000-memory.dmp

memory/2000-56-0x0000000000210000-0x0000000000211000-memory.dmp

memory/2000-54-0x0000000000210000-0x0000000000211000-memory.dmp

memory/2000-52-0x0000000000210000-0x0000000000211000-memory.dmp

memory/2000-50-0x0000000000210000-0x0000000000211000-memory.dmp

memory/2000-48-0x0000000000210000-0x0000000000211000-memory.dmp

memory/2000-46-0x0000000000210000-0x0000000000211000-memory.dmp

memory/2000-44-0x0000000000210000-0x0000000000211000-memory.dmp

memory/2000-42-0x0000000000210000-0x0000000000211000-memory.dmp

memory/2000-40-0x0000000000210000-0x0000000000211000-memory.dmp

memory/2000-38-0x0000000000210000-0x0000000000211000-memory.dmp

memory/2000-75-0x0000000000080000-0x00000000000B1000-memory.dmp

memory/2000-74-0x0000000000080000-0x00000000000B1000-memory.dmp

memory/2000-73-0x0000000000080000-0x00000000000B1000-memory.dmp

memory/2000-72-0x0000000000080000-0x00000000000B1000-memory.dmp

memory/2000-71-0x0000000000080000-0x00000000000B1000-memory.dmp

memory/2000-70-0x0000000000080000-0x00000000000B1000-memory.dmp

memory/2000-76-0x0000000000080000-0x00000000000B1000-memory.dmp

memory/2612-83-0x0000000002470000-0x0000000002480000-memory.dmp

memory/2612-77-0x0000000002410000-0x0000000002420000-memory.dmp

memory/2112-92-0x0000000000400000-0x00000000006A3000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb.log

MD5 6fe76f7302781916a954f5bc3c9d2d01
SHA1 0aac4a16200cb346bd78ccdd76b58d65c91ec6d9
SHA256 26cd74722a4c41fa99a5a6f76c0133f2a388ddbd31f4cbccf41ceb65f672febb
SHA512 3cb11580c9e39cd3390febe4f3ae8972217f7efc0b8253ebb61d7da87ea52e6d20e2e2148886822b491bf0287d0122b5aa9a641b35fd75c4c48e24a07cf9e0f0

memory/2112-97-0x0000000000403000-0x0000000000404000-memory.dmp

memory/2112-98-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2680-100-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2112-118-0x00000000033D0000-0x0000000003673000-memory.dmp

memory/2680-135-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2112-257-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2680-256-0x0000000000400000-0x00000000006A3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp13a692f2.bat

MD5 02ae4550ce4d99e40779bdde19ff0cdd
SHA1 31f1f33645cb1fdc4985e6bba1a0349d79d8c583
SHA256 fe0947cf8f9c537f05ed1a115accbd9338d5b7316fe73195f59ed6a6be187c9d
SHA512 063977bd649ffdc39bb1649ff4e97c9663ac2c132b0c58e935e619fd584ab1d36edb17db4efde67265f4bd3ba4610251185d64b9cc4a7292ec290936d42f542f

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-31 07:24

Reported

2024-08-31 07:27

Platform

win10v2004-20240802-en

Max time kernel

144s

Max time network

128s

Command Line

sihost.exe

Signatures

Expiro, m0yv

backdoor expiro

Expiro payload

backdoor
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2864 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe
PID 2864 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe
PID 2864 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe
PID 3676 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\SysWOW64\explorer.exe
PID 3676 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\SysWOW64\explorer.exe
PID 3676 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\SysWOW64\explorer.exe
PID 3676 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\SysWOW64\explorer.exe
PID 3676 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\SysWOW64\explorer.exe
PID 3676 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\SysWOW64\explorer.exe
PID 3676 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\SysWOW64\explorer.exe
PID 3676 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\SysWOW64\explorer.exe
PID 3676 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\sihost.exe
PID 3676 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\sihost.exe
PID 3676 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\sihost.exe
PID 3676 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\sihost.exe
PID 3676 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\sihost.exe
PID 3676 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\svchost.exe
PID 3676 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\svchost.exe
PID 3676 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\svchost.exe
PID 3676 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\svchost.exe
PID 3676 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\svchost.exe
PID 3676 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\taskhostw.exe
PID 3676 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\taskhostw.exe
PID 3676 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\taskhostw.exe
PID 3676 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\taskhostw.exe
PID 3676 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\taskhostw.exe
PID 3676 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\Explorer.EXE
PID 3676 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\Explorer.EXE
PID 3676 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\Explorer.EXE
PID 3676 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\Explorer.EXE
PID 3676 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\Explorer.EXE
PID 3676 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\svchost.exe
PID 3676 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\svchost.exe
PID 3676 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\svchost.exe
PID 3676 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\svchost.exe
PID 3676 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\svchost.exe
PID 3676 wrote to memory of 3752 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\DllHost.exe
PID 3676 wrote to memory of 3752 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\DllHost.exe
PID 3676 wrote to memory of 3752 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\DllHost.exe
PID 3676 wrote to memory of 3752 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\DllHost.exe
PID 3676 wrote to memory of 3752 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\system32\DllHost.exe
PID 3676 wrote to memory of 3844 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 3676 wrote to memory of 3844 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 3676 wrote to memory of 3844 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 3676 wrote to memory of 3844 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 3676 wrote to memory of 3844 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 3676 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\System32\RuntimeBroker.exe
PID 3676 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\System32\RuntimeBroker.exe
PID 3676 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\System32\RuntimeBroker.exe
PID 3676 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\System32\RuntimeBroker.exe
PID 3676 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\System32\RuntimeBroker.exe
PID 3676 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 3676 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 3676 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 3676 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 3676 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 3676 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\System32\RuntimeBroker.exe
PID 3676 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\System32\RuntimeBroker.exe
PID 3676 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\System32\RuntimeBroker.exe
PID 3676 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\System32\RuntimeBroker.exe
PID 3676 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\System32\RuntimeBroker.exe
PID 3676 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\System32\RuntimeBroker.exe
PID 3676 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\System32\RuntimeBroker.exe
PID 3676 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe C:\Windows\System32\RuntimeBroker.exe

Processes

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\cc6962b007a8512fd286d0d50489e3f0_JaffaCakes118.exe"

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe

"C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe"

C:\Windows\SysWOW64\explorer.exe

"C:\Windows\SysWOW64\explorer.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpd948ccaa.bat"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

memory/2864-0-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-1-0x0000000000403000-0x0000000000404000-memory.dmp

memory/2864-2-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-5-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-6-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-8-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-7-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-9-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-10-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-11-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-12-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-13-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-14-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-15-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-16-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-18-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-20-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-19-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-17-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-21-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-22-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-23-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-24-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-25-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-26-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-27-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/3676-32-0x0000000000400000-0x00000000006A3000-memory.dmp

C:\Users\Admin\AppData\Roaming\Vuocig\xoarc.exe

MD5 e3dd74f06cf288452a1f0abbb59c344f
SHA1 08caf81691909c9cfce1cd92b99b70d5d3e48883
SHA256 9f8743ad4df63d5be9a23c328edf1bb8e4ded1da16d0eec413fe94e7d5448ad3
SHA512 09fa6d62ad52d777f16e0bb3e0faebce1b935543f43702a49b96b3b94dd3b8d152a349b9c0dbf9661ebcf4ee0262a9b3235114910a07f961fa49590de328a6d1

memory/3676-34-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/3676-35-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/3676-36-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/3676-38-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/3676-39-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/3676-40-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/3676-43-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/3676-42-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2740-41-0x0000000000460000-0x0000000000491000-memory.dmp

memory/3676-44-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2740-45-0x0000000000460000-0x0000000000491000-memory.dmp

memory/2864-46-0x0000000000900000-0x0000000000931000-memory.dmp

memory/2864-47-0x0000000000900000-0x0000000000931000-memory.dmp

memory/3676-52-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-54-0x0000000000400000-0x00000000006A3000-memory.dmp

memory/2864-55-0x0000000000400000-0x00000000006A3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpd948ccaa.bat

MD5 9a001679c86fef555b96bae5aebef034
SHA1 845a341dc644736b3eb82844e8366f4d9cf73eaa
SHA256 f5916cf16de4f08067573ca5299c4e64c106bef81fd4cddb380705e1616884d1
SHA512 9195c4112921efe681ae95bb02ff5611d23d47ac3145c55e8bc80861963f3a7d33e5bc9a40e7b1a7a68ca591c509cd15e0c1cc2b5db8668756c26c944b49ce00