Malware Analysis Report

2025-04-03 10:10

Sample ID 250202-slsj4sxjgw
Target JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8
SHA256 84f6062e0171ef972c70f230e4b9afc137b5da5ef10b2d0e4ff2eef4aba56776
Tags
discovery persistence blackshades defense_evasion rat upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

84f6062e0171ef972c70f230e4b9afc137b5da5ef10b2d0e4ff2eef4aba56776

Threat Level: Known bad

The file JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8 was found to be: Known bad.

Malicious Activity Summary

discovery persistence blackshades defense_evasion rat upx

Blackshades family

Blackshades payload

Blackshades

Modifies firewall policy service

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

UPX packed file

Suspicious use of SetThreadContext

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Modifies registry key

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-02 15:13

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-02 15:13

Reported

2025-02-02 15:15

Platform

win7-20240903-en

Max time kernel

139s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleChrome\\svchost.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 75064 set thread context of 18524 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1720 wrote to memory of 56752 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8.exe C:\Windows\SysWOW64\cmd.exe
PID 1720 wrote to memory of 56752 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8.exe C:\Windows\SysWOW64\cmd.exe
PID 1720 wrote to memory of 56752 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8.exe C:\Windows\SysWOW64\cmd.exe
PID 1720 wrote to memory of 56752 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8.exe C:\Windows\SysWOW64\cmd.exe
PID 56752 wrote to memory of 47644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 56752 wrote to memory of 47644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 56752 wrote to memory of 47644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 56752 wrote to memory of 47644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1720 wrote to memory of 75064 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 1720 wrote to memory of 75064 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 1720 wrote to memory of 75064 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 1720 wrote to memory of 75064 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 75064 wrote to memory of 18524 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 75064 wrote to memory of 18524 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 75064 wrote to memory of 18524 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 75064 wrote to memory of 18524 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 75064 wrote to memory of 18524 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 75064 wrote to memory of 18524 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 75064 wrote to memory of 18524 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 75064 wrote to memory of 18524 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\259501267.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe" /f

C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe

"C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe"

C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe

"C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe"

Network

N/A

Files

memory/1720-98122-0x0000000000280000-0x0000000000281000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\259501267.bat

MD5 bcaf583ea4e708fd72c67efd18415bd8
SHA1 a229e0a0e98a9c3b653533d8ae05798cac4bb797
SHA256 912b1e8cf3ec86dc187d6fd2d14b46288704839159f98b78d5d89a4cd3034f06
SHA512 01a0878b83998f152c41437e3a885af6241852459e71567b26321849fffa242aadd1dc23f44d50c262cd3782c644b510d95c7467d4109e2b26e505e3fb989395

C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe

MD5 326846b03ed76443129e3c9f21ff71d6
SHA1 8b3e743a6e7d427d72f8c581e8c3ff8a49e3c957
SHA256 8a46fe2d565638dc2c9ba0d70e4b71418f3aa8f432ad17b7e2c4feb728c235dd
SHA512 7c3df9ad2abeaaa7464eb7a20e9b0e8cc0027c64d1bf658467a6a72beced2a7594b3f6eed3b464c53ddc8145b1aa94d68bae1f2c1e88faa8e236670fc93dbe85

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3533259084-2542256011-65585152-1000\699c4b9cdebca7aaea5193cae8a50098_38b42d9b-3e83-45f4-8789-a30be34574b0

MD5 5b63d4dd8c04c88c0e30e494ec6a609a
SHA1 884d5a8bdc25fe794dc22ef9518009dcf0069d09
SHA256 4d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd
SHA512 15ff8551ac6b9de978050569bcdc26f44dfc06a0eaf445ac70fd45453a21bdafa3e4c8b4857d6a1c3226f4102a639682bdfb71d7b255062fb81a51c9126896cb

memory/18524-479303-0x0000000000400000-0x0000000000407000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-02 15:13

Reported

2025-02-02 15:15

Platform

win10v2004-20250129-en

Max time kernel

149s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\MicrosoftManagement\dllhost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\MicrosoftManagement\\dllhost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleChrome\\svchost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4003209913-3868522715-854928974-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4003209913-3868522715-854928974-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleChrome\\svchost.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4436 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8.exe C:\Windows\SysWOW64\cmd.exe
PID 4436 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8.exe C:\Windows\SysWOW64\cmd.exe
PID 4436 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8.exe C:\Windows\SysWOW64\cmd.exe
PID 320 wrote to memory of 792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 320 wrote to memory of 792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 320 wrote to memory of 792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4436 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 4436 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 4436 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 1756 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 1756 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 1756 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 1756 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 1756 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 1756 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 1756 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 1756 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 1756 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 1756 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 1756 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 1756 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 1756 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 1756 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 1756 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe
PID 3640 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 3640 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 3640 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 3640 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 3640 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 3640 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 3640 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 3640 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 3640 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 3640 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 3640 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 3640 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1368 wrote to memory of 4604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1368 wrote to memory of 4604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1368 wrote to memory of 4604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3936 wrote to memory of 3564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3936 wrote to memory of 3564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3936 wrote to memory of 3564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1332 wrote to memory of 2088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1332 wrote to memory of 2088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1332 wrote to memory of 2088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5092 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5092 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5092 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e124e2e3ad0737f9c1a470ba75070a8.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240642859.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe" /f

C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe

"C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe"

C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe

"C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe"

C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe

"C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\MicrosoftManagement\dllhost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\MicrosoftManagement\dllhost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\MicrosoftManagement\dllhost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\MicrosoftManagement\dllhost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 130.159.190.20.in-addr.arpa udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 11.153.16.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
GB 88.221.135.27:443 www.bing.com tcp
US 8.8.8.8:53 27.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 r3dz80.no-ip.biz udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 r3dz80.no-ip.biz udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 1r3dz80.no-ip.biz udp
US 8.8.8.8:53 2r3dz80.no-ip.biz udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 13.153.16.2.in-addr.arpa udp
US 8.8.8.8:53 3r3dz80.no-ip.biz udp
FR 78.159.135.230:100 3r3dz80.no-ip.biz tcp
US 8.8.8.8:53 4r3dz80.no-ip.biz udp
US 8.8.8.8:53 5r3dz80.no-ip.biz udp
US 8.8.8.8:53 6r3dz80.no-ip.biz udp

Files

memory/4436-2-0x00000000021E0000-0x00000000021E1000-memory.dmp

memory/4436-3-0x0000000002240000-0x0000000002241000-memory.dmp

memory/4436-4-0x0000000002260000-0x0000000002261000-memory.dmp

memory/4436-5-0x0000000002270000-0x0000000002271000-memory.dmp

memory/4436-6-0x0000000002280000-0x0000000002281000-memory.dmp

memory/4436-7-0x00000000021E0000-0x00000000021E1000-memory.dmp

memory/4436-8-0x0000000002220000-0x0000000002221000-memory.dmp

memory/4436-9-0x0000000002230000-0x0000000002231000-memory.dmp

memory/4436-11-0x0000000002240000-0x0000000002241000-memory.dmp

memory/4436-12-0x0000000002250000-0x0000000002251000-memory.dmp

memory/4436-13-0x0000000002260000-0x0000000002261000-memory.dmp

memory/4436-14-0x0000000002270000-0x0000000002271000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\240642859.bat

MD5 bcaf583ea4e708fd72c67efd18415bd8
SHA1 a229e0a0e98a9c3b653533d8ae05798cac4bb797
SHA256 912b1e8cf3ec86dc187d6fd2d14b46288704839159f98b78d5d89a4cd3034f06
SHA512 01a0878b83998f152c41437e3a885af6241852459e71567b26321849fffa242aadd1dc23f44d50c262cd3782c644b510d95c7467d4109e2b26e505e3fb989395

memory/4436-19-0x0000000002360000-0x0000000002361000-memory.dmp

C:\Users\Admin\AppData\Roaming\GoogleChrome\svchost.exe

MD5 326846b03ed76443129e3c9f21ff71d6
SHA1 8b3e743a6e7d427d72f8c581e8c3ff8a49e3c957
SHA256 8a46fe2d565638dc2c9ba0d70e4b71418f3aa8f432ad17b7e2c4feb728c235dd
SHA512 7c3df9ad2abeaaa7464eb7a20e9b0e8cc0027c64d1bf658467a6a72beced2a7594b3f6eed3b464c53ddc8145b1aa94d68bae1f2c1e88faa8e236670fc93dbe85

memory/1756-34-0x0000000002D80000-0x0000000002D81000-memory.dmp

memory/1756-35-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

memory/1756-36-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

memory/1756-37-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

memory/1756-38-0x0000000002D80000-0x0000000002D81000-memory.dmp

memory/1756-39-0x0000000002D90000-0x0000000002D91000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4003209913-3868522715-854928974-1000\699c4b9cdebca7aaea5193cae8a50098_3420909f-3934-4e08-9bca-35998dc0babf

MD5 5b63d4dd8c04c88c0e30e494ec6a609a
SHA1 884d5a8bdc25fe794dc22ef9518009dcf0069d09
SHA256 4d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd
SHA512 15ff8551ac6b9de978050569bcdc26f44dfc06a0eaf445ac70fd45453a21bdafa3e4c8b4857d6a1c3226f4102a639682bdfb71d7b255062fb81a51c9126896cb

memory/1756-41-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

memory/1756-42-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

memory/1756-43-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

memory/1756-44-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

memory/1756-45-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

memory/1756-46-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

memory/1756-47-0x00000000030F0000-0x00000000030F1000-memory.dmp

memory/4008-51-0x0000000000400000-0x0000000000407000-memory.dmp

memory/4008-52-0x0000000000400000-0x0000000000407000-memory.dmp

memory/4008-58-0x0000000000400000-0x0000000000407000-memory.dmp

memory/4008-56-0x0000000000400000-0x0000000000407000-memory.dmp

memory/4008-48-0x0000000000400000-0x0000000000407000-memory.dmp

memory/1756-59-0x0000000000400000-0x0000000000457000-memory.dmp

memory/4008-60-0x0000000000400000-0x0000000000407000-memory.dmp

memory/3640-61-0x0000000000400000-0x0000000000474000-memory.dmp

memory/1756-68-0x0000000000400000-0x0000000000457000-memory.dmp

memory/3640-64-0x0000000000400000-0x0000000000474000-memory.dmp

memory/3640-67-0x0000000000400000-0x0000000000474000-memory.dmp

memory/3640-72-0x0000000000400000-0x0000000000474000-memory.dmp

memory/3640-75-0x0000000000400000-0x0000000000474000-memory.dmp

memory/3640-77-0x0000000000400000-0x0000000000474000-memory.dmp

memory/3640-79-0x0000000000400000-0x0000000000474000-memory.dmp

memory/3640-81-0x0000000000400000-0x0000000000474000-memory.dmp

memory/3640-83-0x0000000000400000-0x0000000000474000-memory.dmp

memory/3640-85-0x0000000000400000-0x0000000000474000-memory.dmp

memory/3640-87-0x0000000000400000-0x0000000000474000-memory.dmp

memory/3640-89-0x0000000000400000-0x0000000000474000-memory.dmp

memory/3640-91-0x0000000000400000-0x0000000000474000-memory.dmp