Malware Analysis Report

2024-11-30 23:46

Sample ID 240915-l588msyamh
Target e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118
SHA256 650d7fdcda7e9fd5e63dbf129286101684f74824062e13dede5c6812c58cfe43
Tags
lokibot collection credential_access discovery spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

650d7fdcda7e9fd5e63dbf129286101684f74824062e13dede5c6812c58cfe43

Threat Level: Known bad

The file e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

lokibot collection credential_access discovery spyware stealer trojan

Lokibot

Credentials from Password Stores: Credentials from Web Browsers

Uses the VBS compiler for execution

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

outlook_win_path

Suspicious use of AdjustPrivilegeToken

outlook_office_path

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-15 10:08

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-15 10:08

Reported

2024-09-15 10:10

Platform

win7-20240903-en

Max time kernel

142s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe"

Signatures

Lokibot

trojan spyware stealer lokibot

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Uses the VBS compiler for execution

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2408 set thread context of 2184 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2408 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2408 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2408 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2408 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1956 wrote to memory of 2128 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 1956 wrote to memory of 2128 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 1956 wrote to memory of 2128 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 1956 wrote to memory of 2128 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2408 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2408 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2408 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2408 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2408 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2408 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2408 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2408 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2408 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2408 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\o3oyghf1\o3oyghf1.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC275.tmp" "c:\Users\Admin\AppData\Local\Temp\o3oyghf1\CSC720532B4806C41579494DCFF65C78978.TMP"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ipqbook.com udp

Files

memory/2408-0-0x0000000074A7E000-0x0000000074A7F000-memory.dmp

memory/2408-1-0x0000000001120000-0x0000000001154000-memory.dmp

memory/2408-2-0x0000000000580000-0x0000000000588000-memory.dmp

memory/2408-3-0x0000000074A70000-0x000000007515E000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\o3oyghf1\o3oyghf1.cmdline

MD5 603fdc8545d3604ab638a31bc9e65b0f
SHA1 ac13afe2499b4ed862ead909a96c888a220975fc
SHA256 e949cb3bd7a4ec1acba75be1a300227cf349d48e3158c4faa1747b1266f1825f
SHA512 72bacbaf397f5f1008fd818fb4a8b2b3d012c5e8f080b3b21ffee076b07d237aee204be54bcc5f850bbce74eda1dcb6721f5ce2a68c3056a8a4c936570387452

\??\c:\Users\Admin\AppData\Local\Temp\o3oyghf1\o3oyghf1.0.cs

MD5 1db49232363ab973c220f69639e516e8
SHA1 d4a532d118f6ed97d5165a96c003fd6c0c3285c2
SHA256 b36cd18b7224eab2c4af0500dd5c1a690c3db849e10a8f774fb6afbbd08a40d0
SHA512 07551a80c26d1690e8dd0c651a7171c3249ae49b6edc997f9c6ae11c3c2ff4f5c6134dabeb80c9051b29c68c6140c798e7537a176a4898ffeb58aa4459509bcb

\??\c:\Users\Admin\AppData\Local\Temp\o3oyghf1\CSC720532B4806C41579494DCFF65C78978.TMP

MD5 5396221b48624db716a5e1f458abf1d5
SHA1 00cf5c41e06fc0fba6ecc954d5339182fc10abe5
SHA256 10e7d5f4a053b502a96b5121f99cea6f53c9571fcfaed81ceac25cf7c406fb54
SHA512 43c88d16b6c028a857b55cc434fa5eb9742954e8d173606bc68e008c7363e23005ca0640553431a8e276f4f42de077c75cb93ceb20b2750439abba71b88bd6dc

C:\Users\Admin\AppData\Local\Temp\RESC275.tmp

MD5 09e3bc380406bd94dfd533b4e605cfe6
SHA1 dfe2ffde5b5256c8867d40acc6b719f6e86de926
SHA256 b586c0b0c861c0b68b94c58563477979f600d9c2cd621c5f806cb77d5b047e44
SHA512 c4e3257e492a7f452e59301c760b875cdbf7b3abaf522bc433099d788da522a59de81d47f92ce63fe1165d94718410b619802e2ebbaab269c4a7532f32a731cc

C:\Users\Admin\AppData\Local\Temp\o3oyghf1\o3oyghf1.dll

MD5 6df59141a6424949042b62e62ca81707
SHA1 b99fcc4c251902185404b1edca984bbb8da0798b
SHA256 dccfde08402407b44b7989871064e657d5094bb4ba05a105652beca313268c31
SHA512 85b3ec953d8168177df0895f5913587ac249c7df7853a8aa5bac1b40b61321aacd4dd694294094e3dd7fe5b441b9d7390cd96484ff90a6e370adf847deab55ac

memory/2408-18-0x00000000005E0000-0x00000000005E8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\o3oyghf1\o3oyghf1.pdb

MD5 ae5bb7e464c9a24dc93943a0c001ede8
SHA1 2f4a5b6abba01e083fd42982176371affab071b9
SHA256 0d41fdebd30b52748667bb4fe5084c6315d8a652e55a44cfa4f15ceefc2b5559
SHA512 a8ffa6209cc4d9ab01c792c697cbf22a3952f9a1e7322f415c4b1eb6180511f67462a08647bc792c3c13707aeb390b6c1f94d16d8ce5d056aac9a8a70d22d798

memory/2408-20-0x0000000000D50000-0x0000000000D7A000-memory.dmp

memory/2408-21-0x0000000000600000-0x000000000060C000-memory.dmp

memory/2408-22-0x00000000010D0000-0x0000000001172000-memory.dmp

memory/2184-23-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2184-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2184-32-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2408-36-0x0000000074A70000-0x000000007515E000-memory.dmp

memory/2184-35-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2184-34-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2184-28-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2184-27-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2184-25-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2184-29-0x0000000000400000-0x00000000004A2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2872745919-2748461613-2989606286-1000\0f5007522459c86e95ffcc62f32308f1_4d69f9e1-559c-46cf-82ac-67913db47c55

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2872745919-2748461613-2989606286-1000\0f5007522459c86e95ffcc62f32308f1_4d69f9e1-559c-46cf-82ac-67913db47c55

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

memory/2184-74-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2184-75-0x0000000000400000-0x00000000004A2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-15 10:08

Reported

2024-09-15 10:10

Platform

win10v2004-20240802-en

Max time kernel

141s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe"

Signatures

Lokibot

trojan spyware stealer lokibot

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Uses the VBS compiler for execution

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2560 set thread context of 2280 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2560 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2560 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2560 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 3380 wrote to memory of 396 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3380 wrote to memory of 396 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3380 wrote to memory of 396 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2560 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2560 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2560 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2560 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2560 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2560 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2560 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2560 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2560 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e23b6a4a3f9a691aa57140829b735dec_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\52ajjbnv\52ajjbnv.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD428.tmp" "c:\Users\Admin\AppData\Local\Temp\52ajjbnv\CSCC423084BE38445FA88A8643BB6B027F5.TMP"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 ipqbook.com udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 ipqbook.com udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 ipqbook.com udp

Files

memory/2560-0-0x0000000074D7E000-0x0000000074D7F000-memory.dmp

memory/2560-1-0x00000000005E0000-0x0000000000614000-memory.dmp

memory/2560-2-0x0000000004F60000-0x0000000004FF2000-memory.dmp

memory/2560-3-0x0000000005100000-0x0000000005108000-memory.dmp

memory/2560-4-0x0000000074D70000-0x0000000075520000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\52ajjbnv\52ajjbnv.cmdline

MD5 eb6fdc79e597fd50a53e9bff308dba61
SHA1 dcafa80db14073e95d5c7d9ba81b328b8286b997
SHA256 a6db6e164d5a572d8b3d100f03ac5fbf37358988e70686fa118f31c72a502ab3
SHA512 6fdf48fcb4c4b9423f920512ec3523a94362067d8760cfff457a7cd0f3f2a3808176f3acdf1b4e61822e6e339c409dbca5b438bf7da79a5b07c0539c4e2570f6

\??\c:\Users\Admin\AppData\Local\Temp\52ajjbnv\52ajjbnv.0.cs

MD5 1db49232363ab973c220f69639e516e8
SHA1 d4a532d118f6ed97d5165a96c003fd6c0c3285c2
SHA256 b36cd18b7224eab2c4af0500dd5c1a690c3db849e10a8f774fb6afbbd08a40d0
SHA512 07551a80c26d1690e8dd0c651a7171c3249ae49b6edc997f9c6ae11c3c2ff4f5c6134dabeb80c9051b29c68c6140c798e7537a176a4898ffeb58aa4459509bcb

\??\c:\Users\Admin\AppData\Local\Temp\52ajjbnv\CSCC423084BE38445FA88A8643BB6B027F5.TMP

MD5 58b10c6637cd49f3d5bffce7434def30
SHA1 f0cb5bec219ab90bc2758e5f0900b31e06e023b3
SHA256 dc158c19b2845e77bf2d48cf01be60fbf63897e67faf4561cc4177c910a25a2e
SHA512 694720538504e6ca4716bfa2d2f911fcf5be3fb468c7a5653cb91ea22b2d9274a85f95477e0e8b16fbf8fd5caeb6c6e9446ab68dbfa69af0af36be67d04b4fea

C:\Users\Admin\AppData\Local\Temp\RESD428.tmp

MD5 665ebedece6c02a8de2f5c093e5d6274
SHA1 c4c96f2c2de2a4ad499d728f93b5ec21324c4d9b
SHA256 e0df870f87496410b0cc43c49aec839f16ddc86fcb52d65b72965b9d6b5a524c
SHA512 171a8b8a20c1a7fc7368c9b472bb6feef9d918f8a10a2257f31f9031ba7ac40a50a59fb09a80a677ee4ecc2205baf081e18398254d54448a59407925b873a592

C:\Users\Admin\AppData\Local\Temp\52ajjbnv\52ajjbnv.dll

MD5 56b272e2a846e01e45d670e2a17801ee
SHA1 6e4703db2e2e7c312dd93ec0e9452415db3e5acb
SHA256 9effc19cb574a96750652351a067911b11a1337608e6696f3ee5d0c171c15f0b
SHA512 e17c782dd0bff619c3851b9a965b95e37c41b3404db69b2c9c8275bdc2e0fc3de525e8ea262bb463aff99a0db144239bac2f259838dd0be38b367b1f0599a7c3

memory/2560-19-0x0000000005140000-0x0000000005148000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\52ajjbnv\52ajjbnv.pdb

MD5 5d4a23efdce705a98f02ba65d9feef84
SHA1 cae90ec560f5f9eb76f3a79be3c911237984142f
SHA256 e047ed9d92375bec184fcd253592f8970921d5c3baa77760ac537682e836d08a
SHA512 83c3da9d127b34ca1a8ffc8cfc31a5199fdee5a17bfa9b468e178f328aff2d2bd0616617b42716aba94c46cf29f75ec8966cb9167217a117aa31def8c2360d97

memory/2560-21-0x00000000053E0000-0x000000000540A000-memory.dmp

memory/2560-22-0x0000000005410000-0x000000000541C000-memory.dmp

memory/2560-23-0x0000000005430000-0x00000000054D2000-memory.dmp

memory/2560-24-0x00000000056A0000-0x000000000573C000-memory.dmp

memory/2280-25-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2280-28-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2280-30-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/2560-29-0x0000000074D70000-0x0000000075520000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2718105630-359604950-2820636825-1000\0f5007522459c86e95ffcc62f32308f1_32404286-a0b5-4a93-9620-6f13fd83251a

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2718105630-359604950-2820636825-1000\0f5007522459c86e95ffcc62f32308f1_32404286-a0b5-4a93-9620-6f13fd83251a

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

memory/2280-74-0x0000000000400000-0x00000000004A2000-memory.dmp