Malware Analysis Report

2024-11-13 18:24

Sample ID 241103-b14ggs1jev
Target 88ff7f6d554b21bfca8145796f779da0_JaffaCakes118
SHA256 839937b17343a4d77d15b88d2acfa5a56a51a1cbe06c94cbd8925b2237f4c615
Tags
latentbot discovery evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

839937b17343a4d77d15b88d2acfa5a56a51a1cbe06c94cbd8925b2237f4c615

Threat Level: Known bad

The file 88ff7f6d554b21bfca8145796f779da0_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

latentbot discovery evasion persistence trojan

Modifies firewall policy service

LatentBot

Latentbot family

Drops file in Drivers directory

Executes dropped EXE

Checks computer location settings

Drops startup file

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Modifies registry key

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-03 01:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-03 01:37

Reported

2024-11-03 01:40

Platform

win7-20240903-en

Max time kernel

148s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe"

Signatures

LatentBot

trojan latentbot

Latentbot family

latentbot

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\test2.exe = "C:\\Users\\Admin\\AppData\\Roaming\\test2.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Temp\svhost.exe = "C:\\Windows\\Temp\\svhost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rundll32 .exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rundll32 .exe C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Temp\svhost.exe N/A
N/A N/A C:\Windows\Temp\svhost.exe N/A
N/A N/A C:\Windows\Temp\svhost.exe N/A
N/A N/A C:\Windows\Temp\svhost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\rundll32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rundll32 .exe" C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1724 set thread context of 568 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wscript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Temp\svhost.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
Token: 1 N/A C:\Windows\Temp\svhost.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: 31 N/A C:\Windows\Temp\svhost.exe N/A
Token: 32 N/A C:\Windows\Temp\svhost.exe N/A
Token: 33 N/A C:\Windows\Temp\svhost.exe N/A
Token: 34 N/A C:\Windows\Temp\svhost.exe N/A
Token: 35 N/A C:\Windows\Temp\svhost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Temp\svhost.exe N/A
N/A N/A C:\Windows\Temp\svhost.exe N/A
N/A N/A C:\Windows\Temp\svhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1724 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1724 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1724 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1724 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3032 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 3032 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 3032 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 3032 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1724 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1724 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1724 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1724 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1724 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1724 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1724 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1724 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1724 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1724 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1724 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1724 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1724 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1724 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1724 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1724 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1724 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1724 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1724 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1724 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 2496 wrote to memory of 3040 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2496 wrote to memory of 3040 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2496 wrote to memory of 3040 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2496 wrote to memory of 3040 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 568 wrote to memory of 2784 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 568 wrote to memory of 2784 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 568 wrote to memory of 2784 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 568 wrote to memory of 2784 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 568 wrote to memory of 2672 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 568 wrote to memory of 2672 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 568 wrote to memory of 2672 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 568 wrote to memory of 2672 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 568 wrote to memory of 2872 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 568 wrote to memory of 2872 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 568 wrote to memory of 2872 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 568 wrote to memory of 2872 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 568 wrote to memory of 2616 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 568 wrote to memory of 2616 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 568 wrote to memory of 2616 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 568 wrote to memory of 2616 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2784 wrote to memory of 2324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2784 wrote to memory of 2324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2784 wrote to memory of 2324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2784 wrote to memory of 2324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2616 wrote to memory of 2212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2616 wrote to memory of 2212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2616 wrote to memory of 2212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2616 wrote to memory of 2212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2872 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2872 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2872 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2872 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2672 wrote to memory of 2340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2672 wrote to memory of 2340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2672 wrote to memory of 2340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2672 wrote to memory of 2340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\java.bat" "

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\java2.bat

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\java2.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Temp\svhost.exe" /t REG_SZ /d "C:\Windows\Temp\svhost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\test2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\test2.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\test2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\test2.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Temp\svhost.exe" /t REG_SZ /d "C:\Windows\Temp\svhost.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 nyandcompany.zapto.org udp
US 8.8.8.8:53 1nyandcompany.zapto.org udp
US 8.8.8.8:53 2nyandcompany.zapto.org udp
US 8.8.8.8:53 3nyandcompany.zapto.org udp
US 8.8.8.8:53 4nyandcompany.zapto.org udp
US 8.8.8.8:53 5nyandcompany.zapto.org udp
US 8.8.8.8:53 6nyandcompany.zapto.org udp
US 8.8.8.8:53 7nyandcompany.zapto.org udp
US 8.8.8.8:53 8nyandcompany.zapto.org udp

Files

memory/1724-0-0x0000000074771000-0x0000000074772000-memory.dmp

memory/1724-1-0x0000000074770000-0x0000000074D1B000-memory.dmp

memory/1724-2-0x0000000074770000-0x0000000074D1B000-memory.dmp

memory/1724-8-0x0000000074770000-0x0000000074D1B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\java.bat

MD5 81bf5400486e5da45ba0c6c1399d843f
SHA1 d70a7c4d3f3057a3ef5b8b1c764b40b3d3b4d59d
SHA256 d1a915a5e0286b1648a6e094f52813e2b5766dce3acf6342b297f7ca113545f1
SHA512 ebeee9eb5249ee1b278bf6c1fbcd91e4c073a241203f218dfa2edfa708a37679c6e6a78751de55b4640a024b32ce4389bd5d931401309163950cd15b4a91c140

C:\Windows\Temp\svhost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

C:\Users\Admin\AppData\Local\Temp\invs.vbs

MD5 c578d9653b22800c3eb6b6a51219bbb8
SHA1 a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA256 20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA512 3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

memory/568-38-0x0000000000400000-0x0000000000470000-memory.dmp

memory/568-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/568-30-0x0000000000400000-0x0000000000470000-memory.dmp

memory/568-29-0x0000000000400000-0x0000000000470000-memory.dmp

memory/568-27-0x0000000000400000-0x0000000000470000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\java2.bat

MD5 ed28c618f7d8306e3736432b58bb5d27
SHA1 441e6dab70e31d9c599fcd9e2d32009038781b42
SHA256 d9aa03911260779b1f8a9b046a7ecf7aa87b0f13c762491fe8e06c482bac09a3
SHA512 4257d8839e881a9ab6de6230a9df1e81456cb796eb9ee2361789fa5fe4c81b297ed1c472f91d97bb0b2ebdb6acadb924617e6ffd32fc96d8ddcebf8fee4a7880

C:\Users\Admin\AppData\Local\Temp\rundll32 .exe

MD5 88ff7f6d554b21bfca8145796f779da0
SHA1 a28b1964e02dfebb3fbacd566c04b8cc4c808db2
SHA256 839937b17343a4d77d15b88d2acfa5a56a51a1cbe06c94cbd8925b2237f4c615
SHA512 22eb17829d054c8755996eb6ffa120aee872c203127dce5330efb131823ee33268d8df08884229b4f21f10f4c7bd426ba70826be1ee7392762ce2fd722ab2431

memory/1724-60-0x0000000074770000-0x0000000074D1B000-memory.dmp

memory/568-61-0x0000000000400000-0x0000000000470000-memory.dmp

memory/1724-63-0x0000000074770000-0x0000000074D1B000-memory.dmp

memory/568-64-0x0000000000400000-0x0000000000470000-memory.dmp

memory/568-65-0x0000000000400000-0x0000000000470000-memory.dmp

memory/568-66-0x0000000000400000-0x0000000000470000-memory.dmp

memory/568-67-0x0000000000400000-0x0000000000470000-memory.dmp

memory/568-68-0x0000000000400000-0x0000000000470000-memory.dmp

memory/568-69-0x0000000000400000-0x0000000000470000-memory.dmp

memory/568-70-0x0000000000400000-0x0000000000470000-memory.dmp

memory/568-73-0x0000000000400000-0x0000000000470000-memory.dmp

memory/568-74-0x0000000000400000-0x0000000000470000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-03 01:37

Reported

2024-11-03 01:40

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe"

Signatures

LatentBot

trojan latentbot

Latentbot family

latentbot

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Temp\svhost.exe = "C:\\Windows\\Temp\\svhost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\test2.exe = "C:\\Users\\Admin\\AppData\\Roaming\\test2.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\wscript.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rundll32 .exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rundll32 .exe C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Temp\svhost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rundll32 .exe" C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4440 set thread context of 3656 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wscript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Temp\svhost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe N/A
Token: 1 N/A C:\Windows\Temp\svhost.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: 31 N/A C:\Windows\Temp\svhost.exe N/A
Token: 32 N/A C:\Windows\Temp\svhost.exe N/A
Token: 33 N/A C:\Windows\Temp\svhost.exe N/A
Token: 34 N/A C:\Windows\Temp\svhost.exe N/A
Token: 35 N/A C:\Windows\Temp\svhost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Temp\svhost.exe N/A
N/A N/A C:\Windows\Temp\svhost.exe N/A
N/A N/A C:\Windows\Temp\svhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4440 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4440 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4440 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 3136 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 3136 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 4440 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 4440 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 4440 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 4440 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 4440 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 4440 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 4440 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 4440 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 4440 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 4440 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 4440 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 4440 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 4440 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 4440 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 4440 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 4440 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 4440 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 3656 wrote to memory of 4044 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 3656 wrote to memory of 4044 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 3656 wrote to memory of 4044 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 3656 wrote to memory of 2332 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 3656 wrote to memory of 2332 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 3656 wrote to memory of 2332 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 3656 wrote to memory of 1048 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 3656 wrote to memory of 1048 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 3656 wrote to memory of 1048 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 3656 wrote to memory of 2032 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 3656 wrote to memory of 2032 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 3656 wrote to memory of 2032 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2476 wrote to memory of 4036 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2476 wrote to memory of 4036 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2476 wrote to memory of 4036 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1048 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1048 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1048 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4044 wrote to memory of 1464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4044 wrote to memory of 1464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4044 wrote to memory of 1464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2032 wrote to memory of 4676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2032 wrote to memory of 4676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2032 wrote to memory of 4676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2332 wrote to memory of 2676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2332 wrote to memory of 2676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2332 wrote to memory of 2676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\88ff7f6d554b21bfca8145796f779da0_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\java.bat" "

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\java2.bat

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Temp\svhost.exe" /t REG_SZ /d "C:\Windows\Temp\svhost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\test2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\test2.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\java2.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\test2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\test2.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Temp\svhost.exe" /t REG_SZ /d "C:\Windows\Temp\svhost.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 nyandcompany.zapto.org udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 1nyandcompany.zapto.org udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 2nyandcompany.zapto.org udp
US 8.8.8.8:53 3nyandcompany.zapto.org udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 4nyandcompany.zapto.org udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 5nyandcompany.zapto.org udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 6nyandcompany.zapto.org udp
US 8.8.8.8:53 7nyandcompany.zapto.org udp
US 8.8.8.8:53 8nyandcompany.zapto.org udp

Files

memory/4440-0-0x0000000074DA2000-0x0000000074DA3000-memory.dmp

memory/4440-1-0x0000000074DA0000-0x0000000075351000-memory.dmp

memory/4440-2-0x0000000074DA0000-0x0000000075351000-memory.dmp

memory/4440-3-0x0000000074DA0000-0x0000000075351000-memory.dmp

memory/4440-4-0x0000000074DA0000-0x0000000075351000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\java.bat

MD5 81bf5400486e5da45ba0c6c1399d843f
SHA1 d70a7c4d3f3057a3ef5b8b1c764b40b3d3b4d59d
SHA256 d1a915a5e0286b1648a6e094f52813e2b5766dce3acf6342b297f7ca113545f1
SHA512 ebeee9eb5249ee1b278bf6c1fbcd91e4c073a241203f218dfa2edfa708a37679c6e6a78751de55b4640a024b32ce4389bd5d931401309163950cd15b4a91c140

C:\Windows\Temp\svhost.exe

MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

memory/3656-18-0x0000000000400000-0x0000000000470000-memory.dmp

memory/3656-23-0x0000000000400000-0x0000000000470000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\invs.vbs

MD5 c578d9653b22800c3eb6b6a51219bbb8
SHA1 a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA256 20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA512 3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

C:\Users\Admin\AppData\Local\Temp\java2.bat

MD5 ed28c618f7d8306e3736432b58bb5d27
SHA1 441e6dab70e31d9c599fcd9e2d32009038781b42
SHA256 d9aa03911260779b1f8a9b046a7ecf7aa87b0f13c762491fe8e06c482bac09a3
SHA512 4257d8839e881a9ab6de6230a9df1e81456cb796eb9ee2361789fa5fe4c81b297ed1c472f91d97bb0b2ebdb6acadb924617e6ffd32fc96d8ddcebf8fee4a7880

C:\Users\Admin\AppData\Local\Temp\rundll32-.txt

MD5 88ff7f6d554b21bfca8145796f779da0
SHA1 a28b1964e02dfebb3fbacd566c04b8cc4c808db2
SHA256 839937b17343a4d77d15b88d2acfa5a56a51a1cbe06c94cbd8925b2237f4c615
SHA512 22eb17829d054c8755996eb6ffa120aee872c203127dce5330efb131823ee33268d8df08884229b4f21f10f4c7bd426ba70826be1ee7392762ce2fd722ab2431

memory/4440-38-0x0000000074DA2000-0x0000000074DA3000-memory.dmp

memory/4440-39-0x0000000074DA0000-0x0000000075351000-memory.dmp

memory/3656-40-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4440-43-0x0000000074DA0000-0x0000000075351000-memory.dmp

memory/3656-44-0x0000000000400000-0x0000000000470000-memory.dmp

memory/3656-45-0x0000000000400000-0x0000000000470000-memory.dmp

memory/3656-46-0x0000000000400000-0x0000000000470000-memory.dmp

memory/3656-47-0x0000000000400000-0x0000000000470000-memory.dmp

memory/3656-48-0x0000000000400000-0x0000000000470000-memory.dmp

memory/3656-49-0x0000000000400000-0x0000000000470000-memory.dmp

memory/3656-50-0x0000000000400000-0x0000000000470000-memory.dmp