Malware Analysis Report

2025-03-15 04:33

Sample ID 241027-1bzvfa1jbv
Target 7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118
SHA256 cf42dfc134484ab1237ec946694cc5c11446c129e64eb6a691f54714a73e2c4c
Tags
collection discovery spyware stealer upx
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

cf42dfc134484ab1237ec946694cc5c11446c129e64eb6a691f54714a73e2c4c

Threat Level: Shows suspicious behavior

The file 7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

collection discovery spyware stealer upx

Checks computer location settings

Executes dropped EXE

Reads WinSCP keys stored on the system

Reads user/profile data of web browsers

Loads dropped DLL

Checks installed software on the system

Accesses Microsoft Outlook profiles

Accesses Microsoft Outlook accounts

UPX packed file

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

outlook_win_path

Modifies registry class

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-27 21:29

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-27 21:29

Reported

2024-10-27 21:32

Platform

win7-20240903-en

Max time kernel

122s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\run.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\install.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\run.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Users\Admin\AppData\Local\Temp\install.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\install.exe N/A

Checks installed software on the system

discovery

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\run.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\install.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\install.exe" C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\install.DocHostUIHandler\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}" C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.mpf\MediaPackageFile C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\BrowserFlags = "8" C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler" C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "install.DocHostUIHandler" C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mpf C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\DefaultIcon C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF} C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\install.DocHostUIHandler\ = "Implements DocHostUIHandler" C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open\command C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32 C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\install.exe \"%1\"" C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\install.DocHostUIHandler C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\install.DocHostUIHandler\Clsid C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.mpf\MediaPackageFile\ShellNew C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.mpf C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mpf\ = "mprf" C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\EditFlags = "0" C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\install.exe,0" C:\Users\Admin\AppData\Local\Temp\install.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\install.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1924 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe
PID 1924 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe
PID 1924 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe
PID 1924 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe
PID 1924 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe
PID 1924 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe
PID 1924 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe
PID 1924 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe
PID 2740 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\run.exe
PID 2720 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\run.exe
PID 2720 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\run.exe
PID 2720 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\run.exe
PID 2656 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\run.exe C:\Users\Admin\AppData\Local\Temp\install.exe
PID 2656 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\run.exe C:\Users\Admin\AppData\Local\Temp\install.exe
PID 2656 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\run.exe C:\Users\Admin\AppData\Local\Temp\install.exe
PID 2656 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\run.exe C:\Users\Admin\AppData\Local\Temp\install.exe
PID 2656 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\run.exe C:\Users\Admin\AppData\Local\Temp\install.exe
PID 2656 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\run.exe C:\Users\Admin\AppData\Local\Temp\install.exe
PID 2656 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\run.exe C:\Users\Admin\AppData\Local\Temp\install.exe

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\install.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\5976.tmp\2.bat" "

C:\Users\Admin\AppData\Local\Temp\run.exe

run.exe

C:\Users\Admin\AppData\Local\Temp\install.exe

install.exe /export

Network

N/A

Files

memory/1924-0-0x0000000000400000-0x0000000000407626-memory.dmp

memory/2740-6-0x0000000000400000-0x00000000004C8000-memory.dmp

memory/1924-5-0x0000000000330000-0x0000000000338000-memory.dmp

memory/2740-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2740-12-0x0000000000400000-0x00000000004C8000-memory.dmp

memory/2740-10-0x0000000000400000-0x00000000004C8000-memory.dmp

memory/2740-8-0x0000000000400000-0x00000000004C8000-memory.dmp

memory/2740-19-0x0000000000400000-0x00000000004C8000-memory.dmp

memory/1924-18-0x0000000000400000-0x0000000000407626-memory.dmp

memory/2740-21-0x0000000000400000-0x00000000004C8000-memory.dmp

memory/2740-20-0x0000000000400000-0x00000000004C8000-memory.dmp

memory/2740-22-0x0000000000400000-0x00000000004C8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5976.tmp\2.bat

MD5 9d5de8f98fd0311929f32e7aa3a034eb
SHA1 b8108a6b09878200c1d2ed2f0877414d15492623
SHA256 48e5ca2d9301779cc4b468c1ff8eaffc4e3bb9d1d8a519b85e38936c5897a027
SHA512 3e625dc924a36bef01a69cf3616fe039c7e425d0c80d8917b19ee118d5315bebfc23167bc8e09c0f7273b57703aeaf6ba220ee27aa7f867232f2530b4ebb6328

C:\Users\Admin\AppData\Local\Temp\run.exe

MD5 387d9272bfbf250e1af885ebe0b607f8
SHA1 5e5f4fd1a67b3e0b7fe96c5802050f972151a488
SHA256 996df105f6c2050ee329d467bdb8ce92479876484c8758a7aec1e2bc86d2a3e7
SHA512 98ca9df82af2fa6f4a19195cd00af57e9bccf40e15a2406860c8d757d0f4932abef9c8f593a4f1154af81a46c3743d9f7f83d9f637a464d6ca2757a8471c1a43

\Users\Admin\AppData\Local\Temp\install.exe

MD5 416685387b6d8925d40b56b6aad1039c
SHA1 c79a7bbe431d2ada8508a81b8deec00c475544fa
SHA256 31a0ab253995c2165a9b0f1b11f85ac0adcc4bee577bbc4439d9f50d2c372424
SHA512 6c1225f197a233e9d1162d357b07fda922c96aa762d228473db5730c8e4425cb6ccfb798890d1e266a493af42e66cda789292b0f99592e4be4876dcfe1476d9a

memory/2656-48-0x0000000001D50000-0x0000000001FBB000-memory.dmp

memory/2556-50-0x0000000000500000-0x000000000076B000-memory.dmp

memory/2556-51-0x0000000000340000-0x0000000000343000-memory.dmp

memory/2556-52-0x0000000000360000-0x0000000000361000-memory.dmp

memory/2740-53-0x0000000000400000-0x00000000004C8000-memory.dmp

memory/2656-54-0x0000000001D50000-0x0000000001FBB000-memory.dmp

memory/2556-61-0x0000000000340000-0x0000000000343000-memory.dmp

memory/2556-60-0x0000000000500000-0x000000000076B000-memory.dmp

memory/2656-62-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SAV_VORHPBAB_10.27.2024_9-30-35_PM.mpf

MD5 e8080f873b4175aff8a5e3bcc1d6a305
SHA1 2f2d213e9cac92472f1bd52d484c644e1c0fda62
SHA256 ef9f302c9a4406381fee0a8547ed7a0311eed008ef2cbf2e0f86d9d7f23b14cb
SHA512 3a6d81c7a8a4311a9b06aefa544d579462dcf6a3b8ba9c7f41714922403ee417b2f795ccf482993708d7652b6e4134a8ead40d17a1ebce1dcaaa7c47d3e9f5fa

memory/2740-64-0x0000000000400000-0x00000000004C8000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-27 21:29

Reported

2024-10-27 21:32

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\run.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\install.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\run.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mpf C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open\command C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32 C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\install.DocHostUIHandler\Clsid C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\BrowserFlags = "8" C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler" C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\install.DocHostUIHandler\ = "Implements DocHostUIHandler" C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "install.DocHostUIHandler" C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mpf\ = "mprf" C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\install.exe,0" C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\install.exe \"%1\"" C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF} C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\install.DocHostUIHandler\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}" C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\EditFlags = "0" C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\DefaultIcon C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\install.exe" C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\install.DocHostUIHandler C:\Users\Admin\AppData\Local\Temp\install.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\install.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4480 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe
PID 4480 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe
PID 4480 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe
PID 4480 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe
PID 4480 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe
PID 4480 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe
PID 4480 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe
PID 4480 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe
PID 5036 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 5036 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 5036 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2972 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\run.exe
PID 2972 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\run.exe
PID 2972 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\run.exe
PID 2736 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\run.exe C:\Users\Admin\AppData\Local\Temp\install.exe
PID 2736 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\run.exe C:\Users\Admin\AppData\Local\Temp\install.exe
PID 2736 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\run.exe C:\Users\Admin\AppData\Local\Temp\install.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\7607a6d222db6ebe28bc0cbe492fe144_JaffaCakes118.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AF2C.tmp\2.bat" "

C:\Users\Admin\AppData\Local\Temp\run.exe

run.exe

C:\Users\Admin\AppData\Local\Temp\install.exe

install.exe /export

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 105.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/4480-0-0x0000000000400000-0x0000000000407626-memory.dmp

memory/5036-7-0x0000000000400000-0x00000000004C8000-memory.dmp

memory/5036-6-0x0000000000400000-0x00000000004C8000-memory.dmp

memory/5036-5-0x0000000000400000-0x00000000004C8000-memory.dmp

memory/5036-11-0x0000000000400000-0x00000000004C8000-memory.dmp

memory/4480-12-0x0000000000400000-0x0000000000407626-memory.dmp

memory/5036-13-0x0000000000400000-0x00000000004C8000-memory.dmp

memory/5036-14-0x0000000000400000-0x00000000004C8000-memory.dmp

memory/5036-15-0x0000000000400000-0x00000000004C8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\AF2C.tmp\2.bat

MD5 9d5de8f98fd0311929f32e7aa3a034eb
SHA1 b8108a6b09878200c1d2ed2f0877414d15492623
SHA256 48e5ca2d9301779cc4b468c1ff8eaffc4e3bb9d1d8a519b85e38936c5897a027
SHA512 3e625dc924a36bef01a69cf3616fe039c7e425d0c80d8917b19ee118d5315bebfc23167bc8e09c0f7273b57703aeaf6ba220ee27aa7f867232f2530b4ebb6328

C:\Users\Admin\AppData\Local\Temp\run.exe

MD5 387d9272bfbf250e1af885ebe0b607f8
SHA1 5e5f4fd1a67b3e0b7fe96c5802050f972151a488
SHA256 996df105f6c2050ee329d467bdb8ce92479876484c8758a7aec1e2bc86d2a3e7
SHA512 98ca9df82af2fa6f4a19195cd00af57e9bccf40e15a2406860c8d757d0f4932abef9c8f593a4f1154af81a46c3743d9f7f83d9f637a464d6ca2757a8471c1a43

C:\Users\Admin\AppData\Local\Temp\install.exe

MD5 416685387b6d8925d40b56b6aad1039c
SHA1 c79a7bbe431d2ada8508a81b8deec00c475544fa
SHA256 31a0ab253995c2165a9b0f1b11f85ac0adcc4bee577bbc4439d9f50d2c372424
SHA512 6c1225f197a233e9d1162d357b07fda922c96aa762d228473db5730c8e4425cb6ccfb798890d1e266a493af42e66cda789292b0f99592e4be4876dcfe1476d9a

memory/1348-30-0x0000000000500000-0x000000000076B000-memory.dmp

memory/1348-31-0x00000000004A0000-0x00000000004A3000-memory.dmp

memory/1348-32-0x0000000000970000-0x0000000000971000-memory.dmp

memory/5036-33-0x0000000000400000-0x00000000004C8000-memory.dmp

memory/1348-34-0x0000000000500000-0x000000000076B000-memory.dmp

memory/1348-35-0x00000000004A0000-0x00000000004A3000-memory.dmp

memory/2736-37-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1348-39-0x0000000000970000-0x0000000000971000-memory.dmp

memory/2736-41-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2736-44-0x0000000000400000-0x0000000000409000-memory.dmp