Malware Analysis Report

2025-05-28 18:46

Sample ID 241103-dagk5ssldx
Target 8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118
SHA256 e1e68a721a56667f51ef35fb963d5c6a048655b1df85f2af1b996896bc232fd0
Tags
collection discovery evasion persistence privilege_escalation spyware stealer upx
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

e1e68a721a56667f51ef35fb963d5c6a048655b1df85f2af1b996896bc232fd0

Threat Level: Likely malicious

The file 8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

collection discovery evasion persistence privilege_escalation spyware stealer upx

NirSoft MailPassView

Detected Nirsoft tools

Modifies Windows Firewall

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Accesses Microsoft Outlook accounts

Suspicious use of SetThreadContext

UPX packed file

Drops file in Windows directory

System Location Discovery: System Language Discovery

Unsigned PE

Program crash

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-03 02:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-03 02:48

Reported

2024-11-03 02:50

Platform

win7-20240708-en

Max time kernel

122s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118.exe"

Signatures

Detected Nirsoft tools

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{UI1581R0-W213-7V77-SQ12-RGTNGCUN381Y}\StubPath = "C:\\Windows\\Root\\Root.exe Restart" C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{UI1581R0-W213-7V77-SQ12-RGTNGCUN381Y} C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Root = "C:\\Windows\\Root\\Root.exe" C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\Root Server = "C:\\Windows\\Root\\Root.exe" C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2548 set thread context of 1956 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 2376 set thread context of 2752 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 2752 set thread context of 2656 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 2752 set thread context of 1400 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 2752 set thread context of 1928 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 2752 set thread context of 1528 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 2752 set thread context of 1952 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 2752 set thread context of 1736 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 2752 set thread context of 3004 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 2752 set thread context of 2964 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 2752 set thread context of 444 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 2752 set thread context of 944 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Root\logs.dat C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A
File opened for modification C:\Windows\Root\plugin.dat C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A
File created C:\Windows\Root\Root.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A
File opened for modification C:\Windows\Root\Root.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Charset C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Codepage C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2076 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 2076 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 2076 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 2076 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 2076 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 2076 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 2076 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 2076 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 2548 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 2548 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 2548 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 2548 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 2548 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 2548 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 2548 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 2548 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 2548 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 2548 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 2548 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 2548 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 2376 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Windows\SysWOW64\netsh.exe
PID 2376 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Windows\SysWOW64\netsh.exe
PID 2376 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Windows\SysWOW64\netsh.exe
PID 2376 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Windows\SysWOW64\netsh.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1956 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\TestFile1.exe

"C:\Users\Admin\AppData\Local\Temp\TestFile1.exe" -s

C:\Users\Admin\AppData\Local\Temp\TestFile1.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

"C:\Users\Admin\AppData\Local\Temp\TestFile2.exe" -s

C:\Windows\SysWOW64\netsh.exe

C:\Windows\System32\netsh.exe firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\TestFile2.exe" "WinUpdater" ENABLE

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe /scomma C:\Users\Admin\AppData\Local\Temp\msg.txt

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe /scomma C:\Users\Admin\AppData\Local\Temp\cho.txt

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe /scomma C:\Users\Admin\AppData\Local\Temp\mail.txt

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe /scomma C:\Users\Admin\AppData\Local\Temp\ie.txt

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe /shtml C:\Users\Admin\AppData\Local\Temp\ps.txt

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe /shtml C:\Users\Admin\AppData\Local\Temp\dial.txt

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Users\Admin\AppData\Local\Temp\10#dueisnw1.txt

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 mail.gmx.net udp
DE 212.227.17.168:25 mail.gmx.net tcp
DE 212.227.17.190:25 mail.gmx.net tcp

Files

\Users\Admin\AppData\Local\Temp\TestFile1.exe

MD5 67f60ac93ff2f08809bf9ea3c9596fc2
SHA1 cc4807e4070bf5fbcfa0db89e4fe9aee86b06f22
SHA256 a37b026fa4b0399494a2fc95e925cabbee4ce401a14278e56876d15e2fa1d7ad
SHA512 dbf727e4d3866813fb7e747d21ef3fb19d8d1d1b929ea07f088e9b49a3ffa44f133a2a04224c8d34085431aa99924d2c270cad62205be340c5c3931acdf172e1

\Users\Admin\AppData\Local\Temp\TestFile2.exe

MD5 e37ffd8b73109c6759098d9e8c2f7654
SHA1 dd5f7ee81fd5fdd16aa1a36ea80d34f82c55b069
SHA256 a0eaba7f47b5508d2eb6a8e870c966e4a94041d82b594b8841ef3d9ca0efbcca
SHA512 ba0c634b561decbe7c2ba0825cefb13d26bfb121c8b0528a4cdc946b9b80b5ccffb7a3a938d691c70c0ea8b040144e7b4ee0d5e733780ea6129c6a1991f3481f

memory/1956-32-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1956-43-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1956-44-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1956-42-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1956-40-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1956-38-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1956-36-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1956-34-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1956-30-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1956-28-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1956-26-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1956-24-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1956-48-0x0000000010410000-0x000000001043E000-memory.dmp

memory/1956-49-0x0000000010410000-0x000000001043E000-memory.dmp

memory/1956-55-0x00000000005D0000-0x00000000005FE000-memory.dmp

memory/1956-56-0x00000000005D0000-0x00000000005FE000-memory.dmp

memory/1956-64-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2752-67-0x0000000000400000-0x000000000049C000-memory.dmp

memory/2752-75-0x0000000000400000-0x000000000049C000-memory.dmp

memory/2752-72-0x0000000000400000-0x000000000049C000-memory.dmp

memory/2752-70-0x0000000000400000-0x000000000049C000-memory.dmp

memory/2752-68-0x0000000000400000-0x000000000049C000-memory.dmp

memory/2656-89-0x0000000000400000-0x0000000000425000-memory.dmp

memory/2656-88-0x0000000000400000-0x0000000000425000-memory.dmp

memory/2656-90-0x0000000000400000-0x0000000000425000-memory.dmp

memory/2656-86-0x0000000000400000-0x0000000000425000-memory.dmp

memory/2656-83-0x0000000000400000-0x0000000000425000-memory.dmp

memory/2656-81-0x0000000000400000-0x0000000000425000-memory.dmp

memory/2656-79-0x0000000000400000-0x0000000000425000-memory.dmp

memory/2656-91-0x0000000000400000-0x0000000000425000-memory.dmp

memory/1928-106-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1400-105-0x0000000000400000-0x000000000043D000-memory.dmp

memory/1400-108-0x0000000000400000-0x000000000043D000-memory.dmp

memory/1400-98-0x0000000000400000-0x000000000043D000-memory.dmp

memory/1400-96-0x0000000000400000-0x000000000043D000-memory.dmp

memory/1400-94-0x0000000000400000-0x000000000043D000-memory.dmp

memory/1400-111-0x0000000000400000-0x000000000043D000-memory.dmp

memory/1528-134-0x0000000000400000-0x000000000041A000-memory.dmp

memory/1928-128-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1528-137-0x0000000000400000-0x000000000041A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dial.txt

MD5 8a83f57d4efce4941647c65f50402368
SHA1 d5d0e9c550adf30427f13f02a5d71b5e324185db
SHA256 58cdc619d8718e92c4ce6f2871bac0908d6e0abde1bdee6f01145605add5868d
SHA512 39e0d81d127c9de4e298de7087974c91ae9d959ecfe2cc04c59354986473153ce2416d9436023f7071e3e2cdaefdc81315495b0c7224cc2e7782813d37cd5cf4

memory/3004-230-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3004-190-0x0000000000400000-0x000000000041C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ps.txt

MD5 a58b5941ab25b596b96eac942697eccd
SHA1 b1e3a60665e914bcaa746ce1c20fc120845123b3
SHA256 905f66cbd81fbac6a9aba22c604d3057a4cc755fbcbe11941baa728dc1a236d2
SHA512 67675bce2bf3aabc7dfe8ae0ebe61907930c8da8ec13543a94d0318c0e94edb48363f26964b2937bbf94199270a135555cfd2bf651b61c7a311975a2f6f611ed

C:\Users\Admin\AppData\Local\Temp\msg.txt

MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

C:\Users\Admin\AppData\Local\Temp\noip.txt

MD5 877cea35660add216293137fdac9fcc3
SHA1 21e965518bb98d4a23743611a4d4b1d1f8f888a6
SHA256 9e5c367fa1739722eeb54b6dd4a330eb01149089e2725f3800577b0889f2514d
SHA512 955b7de37446df48369232283ecf0407bc6c810034a7811bda17a04316af2d6a494566d572370c2bc38bcc9bc5158ee67259d0bed1847d4bdbe66993581934c5

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-03 02:48

Reported

2024-11-03 02:50

Platform

win10v2004-20241007-en

Max time kernel

136s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118.exe"

Signatures

Detected Nirsoft tools

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{UI1581R0-W213-7V77-SQ12-RGTNGCUN381Y} C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{UI1581R0-W213-7V77-SQ12-RGTNGCUN381Y}\StubPath = "C:\\Windows\\Root\\Root.exe Restart" C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Root = "C:\\Windows\\Root\\Root.exe" C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Root Server = "C:\\Windows\\Root\\Root.exe" C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 736 set thread context of 1188 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 4488 set thread context of 3768 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 3768 set thread context of 3796 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 3768 set thread context of 660 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 3768 set thread context of 2916 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 3768 set thread context of 4808 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 3768 set thread context of 4168 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 3768 set thread context of 4172 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 3768 set thread context of 2428 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 3768 set thread context of 3432 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 3768 set thread context of 4180 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 3768 set thread context of 4072 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Root\Root.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A
File opened for modification C:\Windows\Root\Root.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A
File opened for modification C:\Windows\Root\logs.dat C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A
File opened for modification C:\Windows\Root\plugin.dat C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\MIME\Database C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Charset C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Codepage C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2732 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 2732 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 2732 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 2732 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 2732 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 2732 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\TestFile2.exe
PID 736 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 736 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 736 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 736 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 736 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 736 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 736 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 736 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 736 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 736 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 736 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 736 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 736 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Users\Admin\AppData\Local\Temp\TestFile1.exe
PID 4488 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Windows\SysWOW64\netsh.exe
PID 4488 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Windows\SysWOW64\netsh.exe
PID 4488 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Windows\SysWOW64\netsh.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1188 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\TestFile1.exe C:\Program Files\Internet Explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\8945c4b0a22bdc55e7f5d29840908386_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\TestFile1.exe

"C:\Users\Admin\AppData\Local\Temp\TestFile1.exe" -s

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

"C:\Users\Admin\AppData\Local\Temp\TestFile2.exe" -s

C:\Users\Admin\AppData\Local\Temp\TestFile1.exe

C:\Windows\SysWOW64\netsh.exe

C:\Windows\System32\netsh.exe firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\TestFile2.exe" "WinUpdater" ENABLE

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 1188 -ip 1188

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 556

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe /scomma C:\Users\Admin\AppData\Local\Temp\msg.txt

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe /scomma C:\Users\Admin\AppData\Local\Temp\cho.txt

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe /scomma C:\Users\Admin\AppData\Local\Temp\mail.txt

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe /scomma C:\Users\Admin\AppData\Local\Temp\ie.txt

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe /shtml C:\Users\Admin\AppData\Local\Temp\ps.txt

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe /shtml C:\Users\Admin\AppData\Local\Temp\dial.txt

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe C:\Users\Admin\AppData\Local\Temp\10#dueisnw1.txt

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1188 -ip 1188

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 548

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 mail.gmx.net udp
DE 212.227.17.190:25 mail.gmx.net tcp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
DE 212.227.17.168:25 mail.gmx.net tcp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\TestFile1.exe

MD5 67f60ac93ff2f08809bf9ea3c9596fc2
SHA1 cc4807e4070bf5fbcfa0db89e4fe9aee86b06f22
SHA256 a37b026fa4b0399494a2fc95e925cabbee4ce401a14278e56876d15e2fa1d7ad
SHA512 dbf727e4d3866813fb7e747d21ef3fb19d8d1d1b929ea07f088e9b49a3ffa44f133a2a04224c8d34085431aa99924d2c270cad62205be340c5c3931acdf172e1

C:\Users\Admin\AppData\Local\Temp\TestFile2.exe

MD5 e37ffd8b73109c6759098d9e8c2f7654
SHA1 dd5f7ee81fd5fdd16aa1a36ea80d34f82c55b069
SHA256 a0eaba7f47b5508d2eb6a8e870c966e4a94041d82b594b8841ef3d9ca0efbcca
SHA512 ba0c634b561decbe7c2ba0825cefb13d26bfb121c8b0528a4cdc946b9b80b5ccffb7a3a938d691c70c0ea8b040144e7b4ee0d5e733780ea6129c6a1991f3481f

memory/1188-27-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1188-30-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1188-29-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1188-32-0x0000000010410000-0x000000001043E000-memory.dmp

memory/1188-33-0x0000000010410000-0x000000001043E000-memory.dmp

memory/1188-39-0x0000000000590000-0x00000000005BE000-memory.dmp

memory/1188-40-0x0000000000590000-0x00000000005BE000-memory.dmp

memory/3768-48-0x0000000000400000-0x000000000049C000-memory.dmp

memory/3768-51-0x0000000000400000-0x000000000049C000-memory.dmp

memory/660-57-0x0000000000400000-0x000000000043D000-memory.dmp

memory/660-61-0x0000000000400000-0x000000000043D000-memory.dmp

memory/4808-68-0x0000000000400000-0x000000000041A000-memory.dmp

memory/4168-74-0x0000000000400000-0x0000000000410000-memory.dmp

memory/2916-72-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2916-70-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2916-69-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2916-67-0x0000000000400000-0x000000000041D000-memory.dmp

memory/660-66-0x0000000000400000-0x000000000043D000-memory.dmp

memory/4808-82-0x0000000000400000-0x000000000041A000-memory.dmp

memory/4172-87-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2428-92-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3432-101-0x0000000000400000-0x000000000040A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dial.txt

MD5 8a83f57d4efce4941647c65f50402368
SHA1 d5d0e9c550adf30427f13f02a5d71b5e324185db
SHA256 58cdc619d8718e92c4ce6f2871bac0908d6e0abde1bdee6f01145605add5868d
SHA512 39e0d81d127c9de4e298de7087974c91ae9d959ecfe2cc04c59354986473153ce2416d9436023f7071e3e2cdaefdc81315495b0c7224cc2e7782813d37cd5cf4

memory/4072-120-0x0000000000400000-0x0000000000405000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ps.txt

MD5 a58b5941ab25b596b96eac942697eccd
SHA1 b1e3a60665e914bcaa746ce1c20fc120845123b3
SHA256 905f66cbd81fbac6a9aba22c604d3057a4cc755fbcbe11941baa728dc1a236d2
SHA512 67675bce2bf3aabc7dfe8ae0ebe61907930c8da8ec13543a94d0318c0e94edb48363f26964b2937bbf94199270a135555cfd2bf651b61c7a311975a2f6f611ed

C:\Users\Admin\AppData\Local\Temp\msg.txt

MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

memory/4072-115-0x0000000000400000-0x0000000000405000-memory.dmp

memory/4180-114-0x0000000000400000-0x0000000000405000-memory.dmp

memory/4180-112-0x0000000000400000-0x0000000000405000-memory.dmp

memory/2428-109-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3432-99-0x0000000000400000-0x000000000040A000-memory.dmp

memory/4172-98-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2428-97-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2428-93-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2428-90-0x0000000000400000-0x000000000041C000-memory.dmp

memory/4172-85-0x0000000000400000-0x0000000000407000-memory.dmp

memory/4168-81-0x0000000000400000-0x0000000000410000-memory.dmp

memory/4168-79-0x0000000000400000-0x0000000000410000-memory.dmp

memory/4808-78-0x0000000000400000-0x000000000041A000-memory.dmp

memory/4808-76-0x0000000000400000-0x000000000041A000-memory.dmp

memory/3796-65-0x0000000000400000-0x0000000000425000-memory.dmp

memory/660-60-0x0000000000400000-0x000000000043D000-memory.dmp

memory/3796-59-0x0000000000400000-0x0000000000425000-memory.dmp

memory/3796-56-0x0000000000400000-0x0000000000425000-memory.dmp

memory/3796-54-0x0000000000400000-0x0000000000425000-memory.dmp

memory/4072-133-0x0000000000400000-0x0000000000405000-memory.dmp

memory/3432-130-0x0000000000400000-0x000000000040A000-memory.dmp

memory/4180-131-0x0000000000400000-0x0000000000405000-memory.dmp