Malware Analysis Report

2024-11-13 18:23

Sample ID 241030-w4yqmazajk
Target 80331cb992b4aaf28c0109096c78e137_JaffaCakes118
SHA256 99c3b4f9d4c32256e5ab697c5dc4ff1d753b146c846681e429e2a3eb2f207ada
Tags
darkcomet latentbot getjava defense_evasion discovery persistence rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

99c3b4f9d4c32256e5ab697c5dc4ff1d753b146c846681e429e2a3eb2f207ada

Threat Level: Known bad

The file 80331cb992b4aaf28c0109096c78e137_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

darkcomet latentbot getjava defense_evasion discovery persistence rat trojan upx

Latentbot family

Darkcomet family

Darkcomet

LatentBot

Checks computer location settings

Uses the VBS compiler for execution

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

UPX packed file

Subvert Trust Controls: Mark-of-the-Web Bypass

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Modifies system certificate store

NTFS ADS

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-30 18:29

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-30 18:29

Reported

2024-10-30 18:32

Platform

win7-20240903-en

Max time kernel

150s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

Darkcomet family

darkcomet

LatentBot

trojan latentbot

Latentbot family

latentbot

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\jx.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\javacs = "C:\\Users\\Admin\\AppData\\Roaming\\javamc.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Subvert Trust Controls: Mark-of-the-Web Bypass

defense_evasion
Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\javamc.exe:ZONE.identifier C:\Windows\SysWOW64\cmd.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\jx.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 C:\Users\Admin\AppData\Local\Temp\jx.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde C:\Users\Admin\AppData\Local\Temp\jx.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\javamc.exe:ZONE.identifier C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: 34 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: 35 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1984 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1984 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1984 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1984 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1944 wrote to memory of 1960 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1944 wrote to memory of 1960 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1944 wrote to memory of 1960 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1944 wrote to memory of 1960 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1984 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1984 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1984 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1984 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1984 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1984 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1984 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1984 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1984 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1984 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1984 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1984 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1984 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1984 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\jx.exe
PID 1984 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\jx.exe
PID 1984 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\jx.exe
PID 1984 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\jx.exe
PID 1984 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\jx.exe
PID 1984 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\jx.exe
PID 1984 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\jx.exe
PID 1984 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1984 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1984 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1984 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1984 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1984 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1984 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1984 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qvukih1o.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA767.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA766.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\SysWOW64\cmd.exe

"cmd"

C:\Users\Admin\AppData\Local\Temp\jx.exe

"C:\Users\Admin\AppData\Local\Temp\jx.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 javadl-esd.sun.com udp
GB 2.18.190.69:80 javadl-esd.sun.com tcp
GB 2.18.190.69:80 javadl-esd.sun.com tcp
US 8.8.8.8:53 javadl.sun.com udp
GB 104.103.251.196:80 javadl.sun.com tcp
US 8.8.8.8:53 javadl.oracle.com udp
GB 104.103.251.196:80 javadl.oracle.com tcp
GB 104.103.251.196:443 javadl.oracle.com tcp
US 8.8.8.8:53 rps-svcs.sun.com udp
GB 2.18.190.146:80 rps-svcs.sun.com tcp
US 8.8.8.8:53 sjremetrics.java.com udp
IE 66.235.152.225:443 sjremetrics.java.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.80:80 crl.microsoft.com tcp

Files

memory/1984-0-0x00000000749E1000-0x00000000749E2000-memory.dmp

memory/1984-1-0x00000000749E0000-0x0000000074F8B000-memory.dmp

memory/1984-4-0x00000000749E0000-0x0000000074F8B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\qvukih1o.cmdline

MD5 7fe204c9f29c6876a59c96f1d17e7827
SHA1 806a99861b6dc8f73edcfed206a981019c968831
SHA256 d6cd14665e448e29073b5c0c22c048b66bd1c154ab837b21d2985ee0f920bcdc
SHA512 a1a7e4c47735012247d0799c9a7f3ee7056cba4b0dff43cdbb6dfd456d917e6d8036160e9e505c5de8d5eef9b73374f25803231c70f8facee073cb8d86ef602f

memory/1944-7-0x00000000749E0000-0x0000000074F8B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\qvukih1o.0.vb

MD5 9f362c5084b0126d5460310d3353d13e
SHA1 8617abc0a8c22a109b52e2e3c85b4400ed04b40e
SHA256 83ef5a38a9ddf6fcb030ef4f4f63c0e989a49c83691f18b07f851bf35544f2d0
SHA512 9f701a8cec9297f50533ee6cf72851f2400bc777013b663cacea1b531801446d08ffc9a3f5d120b7e81a0f363c7421b9c2103e26be6606f7fe29de3107c4cbbf

C:\Users\Admin\AppData\Local\Temp\RESA767.tmp

MD5 721cf0847e1f545030ee79187477e450
SHA1 cca027a6f8c331f2e31a030e7ef577b58a916cc2
SHA256 a258c51a3a1c1d3a005f8cf0b925a37acdac952f83d2472a033b53dd575c21b2
SHA512 275aecb86bd7fbe4d6cb08e0fa8f054bb989dbdf3d2359d5c4a0edb1616da4d75fb577db5d57ac0142a39a9be95063b94e55f4349b74033226a02934cf1607d9

C:\Users\Admin\AppData\Local\Temp\vbcA766.tmp

MD5 6936178f5ede1f9b0a6d61307219f981
SHA1 0c9fafe1ad1e05f4fb6a61b6578d0e3da29f19f6
SHA256 269aafb5edadc660ad5b11a6e7bfbe327bcc623de9af18e0bd8a4f4f8fec13b4
SHA512 ff6f27cb85775a30debb66e4c18909c050752caf7884dba1a2adaee6ae2ea8f764b45729481bd2775e2751125a0eb1a5225fb6179f0a282330356ad2f4ffcbaf

C:\Users\Admin\AppData\Local\Temp\qvukih1o.dll

MD5 ad27a54af6e4487f37b73143a3afe06f
SHA1 bb929ec45395bf0442ab22914ead69fe45335640
SHA256 fed906a3798935801800182179ab2897bee1b7e58ee93b2f1d94a289250c807d
SHA512 208ffe8f81e1ad5e7df05b5504446ac6de386649435c4d7e9d73b44c91f3ab25b7661c923815b76c01cdb258b4b84ad818a480408f1665134b2361fcdc86c568

memory/1944-16-0x00000000749E0000-0x0000000074F8B000-memory.dmp

memory/2136-20-0x0000000000400000-0x0000000000405000-memory.dmp

memory/2136-21-0x0000000000400000-0x0000000000405000-memory.dmp

memory/2136-22-0x0000000000400000-0x0000000000405000-memory.dmp

memory/2136-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2136-26-0x0000000000400000-0x0000000000405000-memory.dmp

memory/2136-28-0x0000000000400000-0x0000000000405000-memory.dmp

memory/2136-31-0x0000000000400000-0x0000000000405000-memory.dmp

C:\Users\Admin\AppData\Roaming\fp.txt

MD5 46141ad6a47ab3d59e09d2e191cee4c9
SHA1 8ccccc6069099a080e7d264200d4c6206e5b1fa5
SHA256 7c5221717bcc045387d609cbd4b1801159e417a9908bad7fc89a271371e6f2a4
SHA512 59afd1d01c979a4c75a565da390265ace4f8594f231a8ba9e6091357e143472a9c4d3e363d75a13a771798d35bfcd897bce0e8ae62db175eebf97a750969bb6e

memory/2136-36-0x0000000000400000-0x0000000000405000-memory.dmp

C:\Users\Admin\AppData\Roaming\javamc.exe:ZONE.identifier

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

\Users\Admin\AppData\Local\Temp\jx.exe

MD5 f6167efc4d1ef0d0e2739a521f6c87d0
SHA1 c8d1a4b74fd774718ad5d2210e5db1a8c57f931c
SHA256 ec3357953ca575beffae55678548f8348cbeaef6a753d3de151007862962e03e
SHA512 ce39f11229ed14011acfd0a0edb9bf4bcf9f043b72e8d14320c3235f6889e05ec4dffc521af8ad481326140e31a475badff86a54be45740b857e84fd42342901

memory/1984-45-0x0000000006E70000-0x000000000702B000-memory.dmp

memory/2740-46-0x0000000000400000-0x00000000005BB000-memory.dmp

memory/2504-49-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2504-51-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2504-53-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2504-56-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2504-57-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1984-60-0x00000000749E0000-0x0000000074F8B000-memory.dmp

memory/2504-59-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2504-58-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2504-62-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2504-61-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2740-76-0x0000000000400000-0x00000000005BB000-memory.dmp

memory/2504-77-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2504-78-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2740-90-0x0000000000400000-0x00000000005BB000-memory.dmp

memory/2504-91-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2504-92-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2504-93-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2504-94-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2504-95-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2504-96-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2504-97-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2504-98-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2504-99-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2504-100-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2504-101-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2504-102-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2504-103-0x0000000000400000-0x00000000004B7000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-30 18:29

Reported

2024-10-30 18:32

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

Darkcomet family

darkcomet

LatentBot

trojan latentbot

Latentbot family

latentbot

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\jx.exe N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\javacs = "C:\\Users\\Admin\\AppData\\Roaming\\javamc.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Subvert Trust Controls: Mark-of-the-Web Bypass

defense_evasion
Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\javamc.exe:ZONE.identifier C:\Windows\SysWOW64\cmd.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\jx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\javamc.exe:ZONE.identifier C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: 34 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: 35 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: 36 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3500 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3500 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3500 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4500 wrote to memory of 2596 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4500 wrote to memory of 2596 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4500 wrote to memory of 2596 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3500 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3500 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3500 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3500 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3500 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3500 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3500 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3500 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3500 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3500 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3500 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3500 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\jx.exe
PID 3500 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\jx.exe
PID 3500 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\jx.exe
PID 3500 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3500 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3500 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3500 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3500 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3500 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3500 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3500 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\80331cb992b4aaf28c0109096c78e137_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bonse633.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA1AE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAC3B0D4CC3934B5092D6DE8BE9A56353.TMP"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\SysWOW64\cmd.exe

"cmd"

C:\Users\Admin\AppData\Local\Temp\jx.exe

"C:\Users\Admin\AppData\Local\Temp\jx.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 104.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 javadl-esd.sun.com udp
GB 2.18.190.73:80 javadl-esd.sun.com tcp
GB 2.18.190.73:80 javadl-esd.sun.com tcp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 javadl.sun.com udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
GB 104.103.251.196:80 javadl.sun.com tcp
US 8.8.8.8:53 javadl.oracle.com udp
GB 104.103.251.196:80 javadl.oracle.com tcp
GB 104.103.251.196:443 javadl.oracle.com tcp
US 8.8.8.8:53 196.251.103.104.in-addr.arpa udp
US 8.8.8.8:53 rps-svcs.sun.com udp
GB 2.18.190.136:80 rps-svcs.sun.com tcp
US 8.8.8.8:53 136.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 sjremetrics.java.com udp
IE 66.235.152.221:443 sjremetrics.java.com tcp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 221.152.235.66.in-addr.arpa udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 106.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 essstzttztz.zapto.org udp
US 8.8.8.8:53 essstzttztz.zapto.org udp

Files

memory/3500-0-0x0000000074AD2000-0x0000000074AD3000-memory.dmp

memory/3500-1-0x0000000074AD0000-0x0000000075081000-memory.dmp

memory/3500-2-0x0000000074AD0000-0x0000000075081000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\bonse633.cmdline

MD5 1946a7420d7fb634775ed5283e2e7c37
SHA1 56a7542764bc122fc71c64df05c66bd10a3c7d22
SHA256 619e7d544a276db787ba64697948c26062e95cb35880a404bc889c48f00eaee8
SHA512 f3de7bc30167f8033a0196c9aca6efd3f58c64b6f94ea01fabc2783fd2ad1cec8ddf456d1f3564c24e75b98fe57b5f86bd3651a60d5c682eb3bb74c427de7e3f

memory/4500-7-0x0000000074AD0000-0x0000000075081000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\bonse633.0.vb

MD5 9f362c5084b0126d5460310d3353d13e
SHA1 8617abc0a8c22a109b52e2e3c85b4400ed04b40e
SHA256 83ef5a38a9ddf6fcb030ef4f4f63c0e989a49c83691f18b07f851bf35544f2d0
SHA512 9f701a8cec9297f50533ee6cf72851f2400bc777013b663cacea1b531801446d08ffc9a3f5d120b7e81a0f363c7421b9c2103e26be6606f7fe29de3107c4cbbf

C:\Users\Admin\AppData\Local\Temp\RESA1AE.tmp

MD5 21bb8ddd5033d2350888358dcc6055e9
SHA1 ede850ddde52f5ba5335f907599a0900163f96c9
SHA256 6d66e6da8081eac444200d8bfbb78fd1bb69cca4327a051b0049c84dde6c84ed
SHA512 3fa5ad3815aad1cc07bede703c2f705f4b726747ddd01de1ac4bd29df0087e626e003d1c7e6c986d1d16aa3498c7fd7b728090734091f0af9736687673468f30

C:\Users\Admin\AppData\Local\Temp\vbcAC3B0D4CC3934B5092D6DE8BE9A56353.TMP

MD5 1d3b82fcea659b062e08244adad5caf1
SHA1 3c514f4544f14209a09e87e28885c861e8d25f43
SHA256 cfbefa9a36449f11682f5ddd80d0aaca7bcd32a292571f3d57e4b306e00ab108
SHA512 543a64052e0b489d0637f0b4ac1ebea5607f1617d5501d1df021f6778a966e7e1dd6208fbea1b00a2c6e9605ec5f85f5584039a78e2c05113de696c4c9690878

C:\Users\Admin\AppData\Local\Temp\bonse633.dll

MD5 9bd14c0f061acbf72e71bc651241fbde
SHA1 79a4261973598d063fb878f938e1f283d376b7e8
SHA256 94851a3ae75bc60b507872025b2938c2df02931542cad9504444d7910a20f13a
SHA512 4939e79c49aabc56d2d36c0a00a82abe940edd55e9c6df1c27986f96b9a7caa3b611b864aed4d954c80d4b35566ac30b844d86ecccb4c99aef616ad4a49e7012

memory/4500-16-0x0000000074AD0000-0x0000000075081000-memory.dmp

memory/3732-20-0x0000000000400000-0x0000000000405000-memory.dmp

memory/3732-22-0x0000000000400000-0x0000000000405000-memory.dmp

memory/3732-30-0x0000000000400000-0x0000000000405000-memory.dmp

C:\Users\Admin\AppData\Roaming\javamc.exe:ZONE.identifier

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Roaming\fp.txt

MD5 46141ad6a47ab3d59e09d2e191cee4c9
SHA1 8ccccc6069099a080e7d264200d4c6206e5b1fa5
SHA256 7c5221717bcc045387d609cbd4b1801159e417a9908bad7fc89a271371e6f2a4
SHA512 59afd1d01c979a4c75a565da390265ace4f8594f231a8ba9e6091357e143472a9c4d3e363d75a13a771798d35bfcd897bce0e8ae62db175eebf97a750969bb6e

C:\Users\Admin\AppData\Local\Temp\jx.exe

MD5 f6167efc4d1ef0d0e2739a521f6c87d0
SHA1 c8d1a4b74fd774718ad5d2210e5db1a8c57f931c
SHA256 ec3357953ca575beffae55678548f8348cbeaef6a753d3de151007862962e03e
SHA512 ce39f11229ed14011acfd0a0edb9bf4bcf9f043b72e8d14320c3235f6889e05ec4dffc521af8ad481326140e31a475badff86a54be45740b857e84fd42342901

memory/5036-44-0x0000000000400000-0x00000000005BB000-memory.dmp

memory/4340-48-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4340-55-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4340-54-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/3500-53-0x0000000074AD0000-0x0000000075081000-memory.dmp

memory/4340-51-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4340-50-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/5036-61-0x0000000000400000-0x00000000005BB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\jusched.log

MD5 286d788cbfc076f0e661a7ea37380f7b
SHA1 ce05b510fce4f15f6cc057e735b84d3668773cda
SHA256 7883a10de8b37568d96e653c0654350820322c5f1e99f6d207313fc3304ecbd9
SHA512 83fc1dde2e0e3b94dbdc0dcd1a836716d3f08b0420e14afac7fbc2887776bf6437e4b5da761420c32f099d619979e386daf4ffac94ec4fa2df7d365461007c44

memory/4340-65-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4340-64-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/5036-72-0x0000000000400000-0x00000000005BB000-memory.dmp

memory/4340-73-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4340-74-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4340-75-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4340-76-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4340-77-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4340-78-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4340-79-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4340-80-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4340-81-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4340-82-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4340-83-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4340-84-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4340-85-0x0000000000400000-0x00000000004B7000-memory.dmp