Malware Analysis Report

2025-01-02 14:39

Sample ID 240917-kcktxatdjr
Target e66c1552d355cd52ea8aec4300321f43_JaffaCakes118
SHA256 f8a304c8021beee530dce568d9c6b2a883d9265ca4f8466b823872b03bda9a74
Tags
andromeda backdoor botnet discovery persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f8a304c8021beee530dce568d9c6b2a883d9265ca4f8466b823872b03bda9a74

Threat Level: Known bad

The file e66c1552d355cd52ea8aec4300321f43_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

andromeda backdoor botnet discovery persistence

Andromeda, Gamarue

Detects Andromeda payload.

Adds policy Run key to start application

Executes dropped EXE

Loads dropped DLL

Maps connected drives based on registry

Drops file in System32 directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: MapViewOfSection

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-17 08:27

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-17 08:27

Reported

2024-09-17 08:29

Platform

win7-20240903-en

Max time kernel

140s

Max time network

131s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e66c1552d355cd52ea8aec4300321f43_JaffaCakes118.exe"

Signatures

Andromeda, Gamarue

botnet backdoor andromeda

Detects Andromeda payload.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\syswow64\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\38133 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\msyuoaq.bat" C:\Windows\syswow64\svchost.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum \??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe  N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 \??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe  N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification \??\c:\windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\PROGRA~3\LOCALS~1\Temp\msyuoaq.bat C:\Windows\syswow64\svchost.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e66c1552d355cd52ea8aec4300321f43_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe  N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A \??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe  N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1840 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\e66c1552d355cd52ea8aec4300321f43_JaffaCakes118.exe \??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe 
PID 1840 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\e66c1552d355cd52ea8aec4300321f43_JaffaCakes118.exe \??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe 
PID 1840 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\e66c1552d355cd52ea8aec4300321f43_JaffaCakes118.exe \??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe 
PID 1840 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\e66c1552d355cd52ea8aec4300321f43_JaffaCakes118.exe \??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe 
PID 2800 wrote to memory of 1612 N/A \??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe  C:\Windows\syswow64\svchost.exe
PID 2800 wrote to memory of 1612 N/A \??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe  C:\Windows\syswow64\svchost.exe
PID 2800 wrote to memory of 1612 N/A \??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe  C:\Windows\syswow64\svchost.exe
PID 2800 wrote to memory of 1612 N/A \??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe  C:\Windows\syswow64\svchost.exe
PID 1840 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\e66c1552d355cd52ea8aec4300321f43_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\icsys.icn.exe
PID 1840 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\e66c1552d355cd52ea8aec4300321f43_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\icsys.icn.exe
PID 1840 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\e66c1552d355cd52ea8aec4300321f43_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\icsys.icn.exe
PID 1840 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\e66c1552d355cd52ea8aec4300321f43_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\icsys.icn.exe
PID 2436 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe \??\c:\windows\SysWOW64\explorer.exe
PID 2436 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe \??\c:\windows\SysWOW64\explorer.exe
PID 2436 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe \??\c:\windows\SysWOW64\explorer.exe
PID 2436 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe \??\c:\windows\SysWOW64\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e66c1552d355cd52ea8aec4300321f43_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e66c1552d355cd52ea8aec4300321f43_JaffaCakes118.exe"

\??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe 

c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe 

C:\Windows\syswow64\svchost.exe

C:\Windows\syswow64\svchost.exe

C:\Users\Admin\AppData\Roaming\icsys.icn.exe

C:\Users\Admin\AppData\Roaming\icsys.icn.exe

\??\c:\windows\SysWOW64\explorer.exe

c:\windows\system32\explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.update.microsoft.com udp
US 20.72.235.82:80 www.update.microsoft.com tcp
US 8.8.4.4:53 gusdur.tk udp
US 8.8.8.8:53 gusdur.tk udp
US 8.8.4.4:53 gusdur.tk udp
US 8.8.4.4:53 gusdur.tk udp

Files

\Users\Admin\AppData\Local\Temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe 

MD5 cef96c1a52c7706ecce3314b8ecba811
SHA1 20baa76af09db44ffca7d47c692ab459c54da026
SHA256 1cc6bc3845a509108582fd36615ea6f967f601badc470b38f00cf6a450a73694
SHA512 8b36f6a69e6f08417cac8de52e4f659cb35e40ec5ea9362f2482f745073d20b6cfeeed952ed2dd20f6cf162372e4ef34a6c73efd411a8b08da0725b44cf8cc10

memory/1840-7-0x0000000002530000-0x0000000002535000-memory.dmp

memory/2800-13-0x0000000000020000-0x0000000000022000-memory.dmp

memory/1612-14-0x0000000000AF0000-0x0000000000AF8000-memory.dmp

memory/1612-15-0x0000000000AF0000-0x0000000000AF8000-memory.dmp

\Users\Admin\AppData\Roaming\icsys.icn.exe

MD5 d5b0d13c1be4fd8780202e93f5ff3fde
SHA1 b897b76050ecb42b12cdfa4462e9fb30e6d166b4
SHA256 83f72b745af5bb1cfc94d30e060c8559ab279389c8b747930ea70869e1eb9a84
SHA512 6af90c53066629277b08976c2cfc2b43cab71aa24216eff858b9f1d8025aa213e2769933758e27f1dbb0644def9b4f12640fc0161d70c488443a608bd839b305

memory/1612-29-0x0000000000020000-0x0000000000025000-memory.dmp

memory/1612-33-0x0000000000020000-0x0000000000025000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-17 08:27

Reported

2024-09-17 08:29

Platform

win10v2004-20240802-en

Max time kernel

140s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e66c1552d355cd52ea8aec4300321f43_JaffaCakes118.exe"

Signatures

Andromeda, Gamarue

botnet backdoor andromeda

Detects Andromeda payload.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\53797 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\mssinugaq.pif" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\svchost.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum \??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe  N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 \??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe  N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification \??\c:\windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\PROGRA~3\LOCALS~1\Temp\mssinugaq.pif C:\Windows\SysWOW64\svchost.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe  N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e66c1552d355cd52ea8aec4300321f43_JaffaCakes118.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings \??\c:\windows\SysWOW64\explorer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A \??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe  N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe  N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3572 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\e66c1552d355cd52ea8aec4300321f43_JaffaCakes118.exe \??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe 
PID 3572 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\e66c1552d355cd52ea8aec4300321f43_JaffaCakes118.exe \??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe 
PID 3572 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\e66c1552d355cd52ea8aec4300321f43_JaffaCakes118.exe \??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe 
PID 752 wrote to memory of 1572 N/A \??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe  C:\Windows\SysWOW64\svchost.exe
PID 752 wrote to memory of 1572 N/A \??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe  C:\Windows\SysWOW64\svchost.exe
PID 752 wrote to memory of 1572 N/A \??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe  C:\Windows\SysWOW64\svchost.exe
PID 3572 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\e66c1552d355cd52ea8aec4300321f43_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\icsys.icn.exe
PID 3572 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\e66c1552d355cd52ea8aec4300321f43_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\icsys.icn.exe
PID 3572 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\e66c1552d355cd52ea8aec4300321f43_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\icsys.icn.exe
PID 4692 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe \??\c:\windows\SysWOW64\explorer.exe
PID 4692 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe \??\c:\windows\SysWOW64\explorer.exe
PID 4692 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Roaming\icsys.icn.exe \??\c:\windows\SysWOW64\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e66c1552d355cd52ea8aec4300321f43_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e66c1552d355cd52ea8aec4300321f43_JaffaCakes118.exe"

\??\c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe 

c:\users\admin\appdata\local\temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe 

C:\Windows\SysWOW64\svchost.exe

C:\Windows\syswow64\svchost.exe

C:\Users\Admin\AppData\Roaming\icsys.icn.exe

C:\Users\Admin\AppData\Roaming\icsys.icn.exe

\??\c:\windows\SysWOW64\explorer.exe

c:\windows\system32\explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.update.microsoft.com udp
US 20.72.235.82:80 www.update.microsoft.com tcp
US 8.8.4.4:53 gusdur.tk udp
US 8.8.8.8:53 gusdur.tk udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 82.235.72.20.in-addr.arpa udp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 96.252.19.2.in-addr.arpa udp
US 8.8.4.4:53 gusdur.tk udp
US 8.8.8.8:53 gusdur.tk udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.4.4:53 gusdur.tk udp
US 8.8.8.8:53 gusdur.tk udp

Files

C:\Users\Admin\AppData\Local\Temp\e66c1552d355cd52ea8aec4300321f43_jaffacakes118.exe 

MD5 cef96c1a52c7706ecce3314b8ecba811
SHA1 20baa76af09db44ffca7d47c692ab459c54da026
SHA256 1cc6bc3845a509108582fd36615ea6f967f601badc470b38f00cf6a450a73694
SHA512 8b36f6a69e6f08417cac8de52e4f659cb35e40ec5ea9362f2482f745073d20b6cfeeed952ed2dd20f6cf162372e4ef34a6c73efd411a8b08da0725b44cf8cc10

memory/752-7-0x0000000000400000-0x0000000000405000-memory.dmp

memory/752-9-0x0000000000410000-0x0000000000412000-memory.dmp

memory/1572-10-0x00000000003B0000-0x00000000003BE000-memory.dmp

memory/1572-12-0x00000000003B0000-0x00000000003BE000-memory.dmp

C:\Users\Admin\AppData\Roaming\icsys.icn.exe

MD5 d5b0d13c1be4fd8780202e93f5ff3fde
SHA1 b897b76050ecb42b12cdfa4462e9fb30e6d166b4
SHA256 83f72b745af5bb1cfc94d30e060c8559ab279389c8b747930ea70869e1eb9a84
SHA512 6af90c53066629277b08976c2cfc2b43cab71aa24216eff858b9f1d8025aa213e2769933758e27f1dbb0644def9b4f12640fc0161d70c488443a608bd839b305

memory/1572-20-0x0000000000BE0000-0x0000000000BE5000-memory.dmp

memory/1572-24-0x0000000000BE0000-0x0000000000BE5000-memory.dmp