Malware Analysis Report

2025-06-15 23:34

Sample ID 241031-tjsmrs1fnn
Target 837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118
SHA256 e356e0ab1bc38eac26f1e4caea3acae40f70b910a961555ae1c6ffa02a4d20a8
Tags
bootkit defense_evasion discovery persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

e356e0ab1bc38eac26f1e4caea3acae40f70b910a961555ae1c6ffa02a4d20a8

Threat Level: Shows suspicious behavior

The file 837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

bootkit defense_evasion discovery persistence

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Writes to the Master Boot Record (MBR)

Indicator Removal: File Deletion

Suspicious use of SetThreadContext

Unsigned PE

Program crash

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-31 16:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-31 16:05

Reported

2024-10-31 16:10

Platform

win7-20240903-en

Max time kernel

121s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe"

Signatures

Indicator Removal: File Deletion

defense_evasion

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1281085013.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\install.48596.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\your_exe.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\your_exe.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2848 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe
PID 2848 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe
PID 2848 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe
PID 2848 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe
PID 2848 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe
PID 2848 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe
PID 1720 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\your_exe.exe
PID 1720 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\your_exe.exe
PID 1720 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\your_exe.exe
PID 1720 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\your_exe.exe
PID 1720 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1281085013.exe
PID 1720 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1281085013.exe
PID 1720 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1281085013.exe
PID 1720 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1281085013.exe
PID 1720 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1281085013.exe
PID 1720 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1281085013.exe
PID 1720 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1281085013.exe
PID 1720 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\install.48596.exe
PID 1720 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\install.48596.exe
PID 1720 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\install.48596.exe
PID 1720 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\install.48596.exe
PID 1720 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\install.48596.exe
PID 1720 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\install.48596.exe
PID 1720 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\install.48596.exe
PID 2772 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\your_exe.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\your_exe.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\your_exe.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\your_exe.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\install.48596.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\install.48596.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\install.48596.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\install.48596.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\install.48596.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\install.48596.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\install.48596.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\your_exe.exe

"C:\Users\Admin\AppData\Local\Temp\your_exe.exe"

C:\Users\Admin\AppData\Local\Temp\1281085013.exe

"C:\Users\Admin\AppData\Local\Temp\1281085013.exe"

C:\Users\Admin\AppData\Local\Temp\install.48596.exe

"C:\Users\Admin\AppData\Local\Temp\install.48596.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\your_exe.exe > nul

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Zxp..bat" > nul 2> nul

Network

Country Destination Domain Proto
US 8.8.8.8:53 msn.com udp
US 8.8.8.8:53 aebankonline.com udp
US 8.8.8.8:53 nichtadden.in udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 bedayton.com udp
US 8.8.8.8:53 qualattice.com udp
US 3.130.204.160:80 bedayton.com tcp
US 3.130.204.160:80 bedayton.com tcp
US 8.8.8.8:53 www.hugedomains.com udp
US 8.8.8.8:53 borderspot.net udp
US 172.67.70.191:443 www.hugedomains.com tcp
US 172.67.70.191:443 www.hugedomains.com tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.187.227:80 c.pki.goog tcp
GB 142.250.187.227:80 c.pki.goog tcp
US 8.8.8.8:53 tanderplus.com udp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.19.252.157:80 crl.microsoft.com tcp

Files

memory/1720-2-0x0000000000400000-0x0000000000449000-memory.dmp

memory/1720-6-0x0000000000400000-0x0000000000449000-memory.dmp

memory/1720-8-0x0000000000400000-0x0000000000449000-memory.dmp

memory/1720-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

\Users\Admin\AppData\Local\Temp\your_exe.exe

MD5 75ecb408da996d0d7f33dd77f6eb1c9c
SHA1 b836e9125bd643358bda960e50637a8ea172b495
SHA256 fa8652151b8bb6daeb86b97c5c705886028e587a5be366e0c228849c9bcbd078
SHA512 f9933923ccfbc04ddb95090a78698737355128aff01fd2713a1cd029c5c32bc37d29c01714c663eaa89ca604efdd80b16a27ec8ed7eb2769837a7130fa7bbccd

memory/2772-23-0x0000000000400000-0x000000000040D000-memory.dmp

memory/1720-16-0x0000000000880000-0x000000000088D000-memory.dmp

\Users\Admin\AppData\Local\Temp\1281085013.exe

MD5 73ab199d7ab02007c908122e892ca1c3
SHA1 01614a27abc6a64ed6479ca2f6596b8b6d2d31a6
SHA256 3d0932127b9ae4643a8040b11deff670ce00844a0a4dc9bccc2cd6f4c715cd5f
SHA512 b506ad5d819d4d289148a91c5905cf9e65846c2a4a7f1f51585218728f54dc334c605df5d434f2c97e1bb353d6ec737fbbd3ba7763be107c969a0ff2de7346fb

memory/2772-27-0x0000000000400000-0x000000000040D000-memory.dmp

\Users\Admin\AppData\Local\Temp\install.48596.exe

MD5 4eea964cf5ee8eaaa4561798f69ed259
SHA1 f6fa8f310f8a439941acbeb25d3653c8cd130318
SHA256 3f9ea9e74b1a280508dacd0312b144b1c44d6f08077783656dd45f1b0df9144f
SHA512 96d080102bf3e99581b4e8dd98e40174a0709bb237ff042b869fb404ad24ebc4b74e33844bd10c378692c561298dafa346577094b6ae763e5e3740b8c6fb4b20

memory/1720-37-0x0000000000400000-0x0000000000449000-memory.dmp

memory/2896-43-0x0000000000250000-0x000000000027C000-memory.dmp

memory/2896-44-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2688-45-0x0000000000F90000-0x0000000000FAB000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPUI9R2R\domain_profile[1].htm

MD5 e13dc56e321e22d0cd5dd7334ea994ce
SHA1 135c2d6c420e891b6132671dcf59c21579096789
SHA256 0a5ea53bc287ecb32d41eaa6bf3cd6aea27bfeef0c0f65ed04362e58dad3422a
SHA512 8cf29a3426b8201928f26ae5bbf2217a44bad3fef82cb2d9abffa0382d82e8f3b800b70c419083e1001e4b2d5f688768218184330bd570f3eb211a57b026de96

memory/2896-87-0x0000000000400000-0x0000000000423000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Zxp..bat

MD5 c33eea8a46d07a704cb779c6dc84c12a
SHA1 649151c6d4416f693a74857693e16e2195fb2d7c
SHA256 3568407aa5d11fb1219fc6f1e4e8f4d90acef87a178cd886b2b379f7279de3c5
SHA512 5171f18a5fde3a37877f35ac4dc1715428754c35b4ea3a1d2d3646c7ddebc2b7ae38d03af4146270d70c4274895c74fbfa1d43fb152532b4cef01ce1841f7350

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-31 16:05

Reported

2024-10-31 16:08

Platform

win10v2004-20241007-en

Max time kernel

127s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\your_exe.exe N/A

Indicator Removal: File Deletion

defense_evasion

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\install.48596.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\your_exe.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1281085013.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\your_exe.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2844 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe
PID 2844 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe
PID 2844 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe
PID 2844 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe
PID 2844 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe
PID 372 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\your_exe.exe
PID 372 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\your_exe.exe
PID 372 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\your_exe.exe
PID 372 wrote to memory of 5052 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1281085013.exe
PID 372 wrote to memory of 5052 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1281085013.exe
PID 372 wrote to memory of 5052 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1281085013.exe
PID 372 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\install.48596.exe
PID 372 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\install.48596.exe
PID 372 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\install.48596.exe
PID 3120 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\your_exe.exe C:\Windows\SysWOW64\cmd.exe
PID 3120 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\your_exe.exe C:\Windows\SysWOW64\cmd.exe
PID 3120 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\your_exe.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\837b3ee12cc0ddd81bfcf0c7b57e3dfc_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\your_exe.exe

"C:\Users\Admin\AppData\Local\Temp\your_exe.exe"

C:\Users\Admin\AppData\Local\Temp\1281085013.exe

"C:\Users\Admin\AppData\Local\Temp\1281085013.exe"

C:\Users\Admin\AppData\Local\Temp\install.48596.exe

"C:\Users\Admin\AppData\Local\Temp\install.48596.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2092 -ip 2092

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5052 -ip 5052

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 580

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 408

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\your_exe.exe > nul

Network

Country Destination Domain Proto
US 8.8.8.8:53 aebankonline.com udp
US 8.8.8.8:53 bedayton.com udp
US 54.161.222.85:80 bedayton.com tcp
US 54.161.222.85:80 bedayton.com tcp
US 8.8.8.8:53 www.hugedomains.com udp
US 104.26.6.37:443 www.hugedomains.com tcp
US 104.26.6.37:443 www.hugedomains.com tcp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 85.222.161.54.in-addr.arpa udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 37.6.26.104.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.187.227:80 c.pki.goog tcp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 aebankonline.com udp
US 54.161.222.85:80 bedayton.com tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/372-2-0x0000000000400000-0x0000000000449000-memory.dmp

memory/372-4-0x0000000000400000-0x0000000000449000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\your_exe.exe

MD5 75ecb408da996d0d7f33dd77f6eb1c9c
SHA1 b836e9125bd643358bda960e50637a8ea172b495
SHA256 fa8652151b8bb6daeb86b97c5c705886028e587a5be366e0c228849c9bcbd078
SHA512 f9933923ccfbc04ddb95090a78698737355128aff01fd2713a1cd029c5c32bc37d29c01714c663eaa89ca604efdd80b16a27ec8ed7eb2769837a7130fa7bbccd

memory/3120-20-0x0000000000400000-0x000000000040D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1281085013.exe

MD5 73ab199d7ab02007c908122e892ca1c3
SHA1 01614a27abc6a64ed6479ca2f6596b8b6d2d31a6
SHA256 3d0932127b9ae4643a8040b11deff670ce00844a0a4dc9bccc2cd6f4c715cd5f
SHA512 b506ad5d819d4d289148a91c5905cf9e65846c2a4a7f1f51585218728f54dc334c605df5d434f2c97e1bb353d6ec737fbbd3ba7763be107c969a0ff2de7346fb

memory/3120-27-0x0000000000400000-0x000000000040D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\install.48596.exe

MD5 4eea964cf5ee8eaaa4561798f69ed259
SHA1 f6fa8f310f8a439941acbeb25d3653c8cd130318
SHA256 3f9ea9e74b1a280508dacd0312b144b1c44d6f08077783656dd45f1b0df9144f
SHA512 96d080102bf3e99581b4e8dd98e40174a0709bb237ff042b869fb404ad24ebc4b74e33844bd10c378692c561298dafa346577094b6ae763e5e3740b8c6fb4b20

memory/3120-40-0x0000000000400000-0x000000000040D000-memory.dmp

memory/2092-43-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2092-44-0x0000000002040000-0x000000000206C000-memory.dmp

memory/372-47-0x0000000000400000-0x0000000000449000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6IJLDY7V\domain_profile[1].htm

MD5 f1f2b7aaee1e44a366db28c98a515f94
SHA1 953fd34b1ca2e3558cda001be4adbb2d5d033134
SHA256 1963792c0cd11a3817682cf30395d90e49869d8c31030622585dce3053da259b
SHA512 2a9f6235fbb59046b3ad2f6483ea7b8d7f48c90ae57e4e704732fc9d9b2fdda8a9f9e6a27bba697e96b99f32bafe9a4ce96bac6310586c54a9e2e433e3f535e9

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W9QJOIKH\domain_profile[1].htm

MD5 3fa9af629784122319066f2d1cae66d8
SHA1 98737ac0c9f86fcdbf94e2dd162663bdbd26c5e1
SHA256 067506f7c94f53c20c3a289dda6e8812babbf5dc9a1a140e3a00b0f35a571f33
SHA512 dcea7c1a3ed124fcbb4aa0c1d38cdb46c0d703f08ab0ac0b9394a6cb22a398cb6221fc4d594aaa792f589ca2f6bf9b0b49622faf3b7de7a795339f0525a5096e