Malware Analysis Report

2024-11-13 18:23

Sample ID 241103-l2zj2a1erg
Target 8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118
SHA256 c322745791f5be92d2a7dcd41fbc9196c9615127c4f184323be9efe22c7f2831
Tags
latentbot discovery evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c322745791f5be92d2a7dcd41fbc9196c9615127c4f184323be9efe22c7f2831

Threat Level: Known bad

The file 8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

latentbot discovery evasion persistence trojan

LatentBot

Latentbot family

Modifies firewall policy service

Drops file in Drivers directory

Drops startup file

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies registry key

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-03 10:02

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-03 10:02

Reported

2024-11-03 10:04

Platform

win7-20240903-en

Max time kernel

149s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe"

Signatures

LatentBot

trojan latentbot

Latentbot family

latentbot

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost72.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost72.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Temp\svhost.exe = "C:\\Windows\\Temp\\svhost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rundll32 .exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rundll32 .exe C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Temp\svhost.exe N/A
N/A N/A C:\Windows\Temp\svhost.exe N/A
N/A N/A C:\Windows\Temp\svhost.exe N/A
N/A N/A C:\Windows\Temp\svhost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\rundll32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rundll32 .exe" C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2108 set thread context of 2804 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wscript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Temp\svhost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe N/A
Token: 1 N/A C:\Windows\Temp\svhost.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: 31 N/A C:\Windows\Temp\svhost.exe N/A
Token: 32 N/A C:\Windows\Temp\svhost.exe N/A
Token: 33 N/A C:\Windows\Temp\svhost.exe N/A
Token: 34 N/A C:\Windows\Temp\svhost.exe N/A
Token: 35 N/A C:\Windows\Temp\svhost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Temp\svhost.exe N/A
N/A N/A C:\Windows\Temp\svhost.exe N/A
N/A N/A C:\Windows\Temp\svhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2108 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2144 wrote to memory of 2184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 2144 wrote to memory of 2184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 2144 wrote to memory of 2184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 2144 wrote to memory of 2184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 2108 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 2108 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 2108 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 2108 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 2108 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 2108 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 2108 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 2108 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 2108 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 2108 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 2108 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 2108 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 2108 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 2108 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 2108 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 2108 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 2108 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 2108 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 2108 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 2108 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 2184 wrote to memory of 2820 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2184 wrote to memory of 2820 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2184 wrote to memory of 2820 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2184 wrote to memory of 2820 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2804 wrote to memory of 1988 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2804 wrote to memory of 1988 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2804 wrote to memory of 1988 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2804 wrote to memory of 1988 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2804 wrote to memory of 2560 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2804 wrote to memory of 2560 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2804 wrote to memory of 2560 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2804 wrote to memory of 2560 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2804 wrote to memory of 2576 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2804 wrote to memory of 2576 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2804 wrote to memory of 2576 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2804 wrote to memory of 2576 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2560 wrote to memory of 3008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2560 wrote to memory of 3008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2560 wrote to memory of 3008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2560 wrote to memory of 3008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1988 wrote to memory of 1864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1988 wrote to memory of 1864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1988 wrote to memory of 1864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1988 wrote to memory of 1864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2804 wrote to memory of 620 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2804 wrote to memory of 620 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2804 wrote to memory of 620 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2804 wrote to memory of 620 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 2576 wrote to memory of 2024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2576 wrote to memory of 2024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2576 wrote to memory of 2024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2576 wrote to memory of 2024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 620 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 620 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 620 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 620 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\java.bat" "

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\java2.bat

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\java2.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Temp\svhost.exe" /t REG_SZ /d "C:\Windows\Temp\svhost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Temp\svhost.exe" /t REG_SZ /d "C:\Windows\Temp\svhost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost72.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost72.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost72.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost72.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 nyandcompany.zapto.org udp

Files

memory/2108-0-0x00000000746A1000-0x00000000746A2000-memory.dmp

memory/2108-1-0x00000000746A0000-0x0000000074C4B000-memory.dmp

memory/2108-2-0x00000000746A0000-0x0000000074C4B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\java.bat

MD5 81bf5400486e5da45ba0c6c1399d843f
SHA1 d70a7c4d3f3057a3ef5b8b1c764b40b3d3b4d59d
SHA256 d1a915a5e0286b1648a6e094f52813e2b5766dce3acf6342b297f7ca113545f1
SHA512 ebeee9eb5249ee1b278bf6c1fbcd91e4c073a241203f218dfa2edfa708a37679c6e6a78751de55b4640a024b32ce4389bd5d931401309163950cd15b4a91c140

C:\Users\Admin\AppData\Local\Temp\invs.vbs

MD5 c578d9653b22800c3eb6b6a51219bbb8
SHA1 a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA256 20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA512 3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

\Windows\Temp\svhost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

memory/2804-36-0x0000000000400000-0x0000000000470000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\java2.bat

MD5 ed28c618f7d8306e3736432b58bb5d27
SHA1 441e6dab70e31d9c599fcd9e2d32009038781b42
SHA256 d9aa03911260779b1f8a9b046a7ecf7aa87b0f13c762491fe8e06c482bac09a3
SHA512 4257d8839e881a9ab6de6230a9df1e81456cb796eb9ee2361789fa5fe4c81b297ed1c472f91d97bb0b2ebdb6acadb924617e6ffd32fc96d8ddcebf8fee4a7880

memory/2804-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rundll32 .exe

MD5 8ae4eb2d7e85473257cc09a04ec1c7a7
SHA1 9e3d450fb9d2862101d96118c9bb481e229e9a02
SHA256 c322745791f5be92d2a7dcd41fbc9196c9615127c4f184323be9efe22c7f2831
SHA512 8d4966f1b974bcf88adfbe2db0b99b481aef29e98800b61a557e74ad8fbf796fca099a3782e97b4856123294541366bf74ef45c1ca0fa9d60ac555b9939623fd

memory/2804-29-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2804-28-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2804-26-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2108-56-0x00000000746A0000-0x0000000074C4B000-memory.dmp

memory/2804-57-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2108-59-0x00000000746A0000-0x0000000074C4B000-memory.dmp

memory/2804-60-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2804-61-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2804-62-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2804-63-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2804-64-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2804-65-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2804-69-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2804-70-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2804-71-0x0000000000400000-0x0000000000470000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-03 10:02

Reported

2024-11-03 10:05

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe"

Signatures

LatentBot

trojan latentbot

Latentbot family

latentbot

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost72.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost72.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Temp\svhost.exe = "C:\\Windows\\Temp\\svhost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\wscript.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rundll32 .exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rundll32 .exe C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Temp\svhost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rundll32 .exe" C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1700 set thread context of 4944 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wscript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Temp\svhost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe N/A
Token: 1 N/A C:\Windows\Temp\svhost.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Temp\svhost.exe N/A
Token: 31 N/A C:\Windows\Temp\svhost.exe N/A
Token: 32 N/A C:\Windows\Temp\svhost.exe N/A
Token: 33 N/A C:\Windows\Temp\svhost.exe N/A
Token: 34 N/A C:\Windows\Temp\svhost.exe N/A
Token: 35 N/A C:\Windows\Temp\svhost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Temp\svhost.exe N/A
N/A N/A C:\Windows\Temp\svhost.exe N/A
N/A N/A C:\Windows\Temp\svhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1700 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1700 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1700 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1788 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1788 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1788 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1700 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1700 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1700 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1700 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1700 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1700 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1700 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1700 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1700 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1700 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1700 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1700 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1700 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1700 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1700 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1700 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 1700 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe C:\Windows\Temp\svhost.exe
PID 4944 wrote to memory of 552 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 4944 wrote to memory of 552 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 4944 wrote to memory of 552 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 4944 wrote to memory of 636 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 4944 wrote to memory of 636 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 4944 wrote to memory of 636 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 4944 wrote to memory of 1348 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 4944 wrote to memory of 1348 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 4944 wrote to memory of 1348 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 4944 wrote to memory of 4996 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 4944 wrote to memory of 4996 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 4944 wrote to memory of 4996 N/A C:\Windows\Temp\svhost.exe C:\Windows\SysWOW64\cmd.exe
PID 1720 wrote to memory of 3460 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1720 wrote to memory of 3460 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1720 wrote to memory of 3460 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 636 wrote to memory of 456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 636 wrote to memory of 456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 636 wrote to memory of 456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1348 wrote to memory of 4392 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1348 wrote to memory of 4392 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1348 wrote to memory of 4392 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 552 wrote to memory of 2492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 552 wrote to memory of 2492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 552 wrote to memory of 2492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4996 wrote to memory of 1048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4996 wrote to memory of 1048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4996 wrote to memory of 1048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\java.bat" "

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\java2.bat

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\Temp\svhost.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Temp\svhost.exe" /t REG_SZ /d "C:\Windows\Temp\svhost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost72.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost72.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\java2.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Temp\svhost.exe" /t REG_SZ /d "C:\Windows\Temp\svhost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost72.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost72.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 nyandcompany.zapto.org udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 70.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/1700-0-0x0000000075332000-0x0000000075333000-memory.dmp

memory/1700-1-0x0000000075330000-0x00000000758E1000-memory.dmp

memory/1700-2-0x0000000075330000-0x00000000758E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\java.bat

MD5 81bf5400486e5da45ba0c6c1399d843f
SHA1 d70a7c4d3f3057a3ef5b8b1c764b40b3d3b4d59d
SHA256 d1a915a5e0286b1648a6e094f52813e2b5766dce3acf6342b297f7ca113545f1
SHA512 ebeee9eb5249ee1b278bf6c1fbcd91e4c073a241203f218dfa2edfa708a37679c6e6a78751de55b4640a024b32ce4389bd5d931401309163950cd15b4a91c140

C:\Windows\Temp\svhost.exe

MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

memory/4944-16-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4944-22-0x0000000000400000-0x0000000000470000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\invs.vbs

MD5 c578d9653b22800c3eb6b6a51219bbb8
SHA1 a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA256 20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA512 3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

C:\Users\Admin\AppData\Local\Temp\java2.bat

MD5 ed28c618f7d8306e3736432b58bb5d27
SHA1 441e6dab70e31d9c599fcd9e2d32009038781b42
SHA256 d9aa03911260779b1f8a9b046a7ecf7aa87b0f13c762491fe8e06c482bac09a3
SHA512 4257d8839e881a9ab6de6230a9df1e81456cb796eb9ee2361789fa5fe4c81b297ed1c472f91d97bb0b2ebdb6acadb924617e6ffd32fc96d8ddcebf8fee4a7880

C:\Users\Admin\AppData\Local\Temp\rundll32-.txt

MD5 8ae4eb2d7e85473257cc09a04ec1c7a7
SHA1 9e3d450fb9d2862101d96118c9bb481e229e9a02
SHA256 c322745791f5be92d2a7dcd41fbc9196c9615127c4f184323be9efe22c7f2831
SHA512 8d4966f1b974bcf88adfbe2db0b99b481aef29e98800b61a557e74ad8fbf796fca099a3782e97b4856123294541366bf74ef45c1ca0fa9d60ac555b9939623fd

memory/1700-37-0x0000000075332000-0x0000000075333000-memory.dmp

memory/1700-38-0x0000000075330000-0x00000000758E1000-memory.dmp

memory/4944-39-0x0000000000400000-0x0000000000470000-memory.dmp

memory/1700-42-0x0000000075330000-0x00000000758E1000-memory.dmp

memory/4944-43-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4944-44-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4944-45-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4944-46-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4944-47-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4944-48-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4944-51-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4944-52-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4944-54-0x0000000000400000-0x0000000000470000-memory.dmp