Malware Analysis Report

2025-04-03 10:26

Sample ID 250228-erjbqszycz
Target JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee
SHA256 26328dfb9a898af730bfeb1585185e61c59c8bb78a07e9b44d56d87fd10aca75
Tags
latentbot discovery trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

26328dfb9a898af730bfeb1585185e61c59c8bb78a07e9b44d56d87fd10aca75

Threat Level: Known bad

The file JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee was found to be: Known bad.

Malicious Activity Summary

latentbot discovery trojan upx

Latentbot family

LatentBot

AutoIT Executable

UPX packed file

Drops file in System32 directory

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-28 04:10

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-28 04:10

Reported

2025-02-28 04:12

Platform

win10v2004-20250217-en

Max time kernel

148s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe"

Signatures

LatentBot

trojan latentbot

Latentbot family

latentbot

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Spy-Net\server.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe N/A
File opened for modification C:\Windows\SysWOW64\Spy-Net\server.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe N/A
File created C:\Windows\SysWOW64\Spy-Net\logs.dat C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe N/A
File opened for modification C:\Windows\SysWOW64\Spy-Net\logs.dat C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1888 wrote to memory of 880 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 1888 wrote to memory of 880 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 1888 wrote to memory of 880 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 1888 wrote to memory of 880 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 1888 wrote to memory of 880 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 880 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 880 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 880 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 880 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 880 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 880 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 880 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 880 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3448 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe"

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe"

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe

Network

Country Destination Domain Proto
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 samismsmsami.zapto.org udp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 samismsmsami.zapto.org udp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 samismsmsami.zapto.org udp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 samismsmsami.zapto.org udp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 samismsmsami.zapto.org udp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 samismsmsami.zapto.org udp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 samismsmsami.zapto.org udp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 samismsmsami.zapto.org udp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 samismsmsami.zapto.org udp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 samismsmsami.zapto.org udp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 samismsmsami.zapto.org udp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 samismsmsami.zapto.org udp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 samismsmsami.zapto.org udp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 samismsmsami.zapto.org udp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 samismsmsami.zapto.org udp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 samismsmsami.zapto.org udp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 samismsmsami.zapto.org udp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 samismsmsami.zapto.org udp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 samismsmsami.zapto.org udp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 samismsmsami.zapto.org udp
N/A 127.0.0.1:81 tcp

Files

memory/1888-0-0x0000000000400000-0x00000000004B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PE-SCRYPTED.BIN

MD5 b6076077f354c689d04ea74cc95c4a9e
SHA1 4ef9939d8bf9a46a09ac112dd849228e431f4abd
SHA256 6e455c7681c0e056a670329865f8319e104e63cb034832cf252e3de394756b0f
SHA512 94c292bd5b23f520253ac249b3fe05133286f186df61421e166fc11fdd2602d8ff833337f32a193858daeacfdfe100af588e0e663160637efedece1083d42ecb

memory/880-8-0x0000000000400000-0x0000000000405000-memory.dmp

memory/880-12-0x0000000000400000-0x0000000000405000-memory.dmp

memory/1888-14-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/880-16-0x00007FF9ED230000-0x00007FF9ED425000-memory.dmp

memory/3448-18-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3448-21-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3448-20-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3448-23-0x00007FF9ED230000-0x00007FF9ED425000-memory.dmp

memory/880-22-0x0000000000400000-0x0000000000405000-memory.dmp

memory/3136-30-0x0000000000160000-0x0000000000161000-memory.dmp

memory/3136-29-0x00000000000E0000-0x00000000000E1000-memory.dmp

memory/3448-28-0x0000000010450000-0x0000000010485000-memory.dmp

memory/3448-24-0x0000000010410000-0x0000000010445000-memory.dmp

memory/3136-35-0x00007FF9ED230000-0x00007FF9ED425000-memory.dmp

memory/3136-77-0x0000000006620000-0x0000000006621000-memory.dmp

memory/3136-78-0x0000000010450000-0x0000000010485000-memory.dmp

memory/3448-81-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3448-80-0x0000000000400000-0x0000000000423000-memory.dmp

memory/3448-74-0x0000000010450000-0x0000000010485000-memory.dmp

memory/3136-88-0x0000000000400000-0x00000000004B6000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-28 04:10

Reported

2025-02-28 04:12

Platform

win7-20240903-en

Max time kernel

149s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe"

Signatures

LatentBot

trojan latentbot

Latentbot family

latentbot

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\Spy-Net\logs.dat C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe N/A
File created C:\Windows\SysWOW64\Spy-Net\server.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe N/A
File opened for modification C:\Windows\SysWOW64\Spy-Net\server.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe N/A
File created C:\Windows\SysWOW64\Spy-Net\logs.dat C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1836 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 1836 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 1836 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 1836 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 1836 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 1836 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 1280 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 1280 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 1280 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 1280 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 1280 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 1280 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 1280 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 1280 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2520 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe C:\Program Files\Internet Explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe"

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe"

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ecf00ea1a8e42905770bf3ebb6bee.exe

Network

Country Destination Domain Proto
N/A 127.0.0.1:81 tcp
US 8.8.8.8:53 samismsmsami.zapto.org udp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp
N/A 127.0.0.1:81 tcp

Files

memory/1836-0-0x0000000000400000-0x00000000004B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PE-SCRYPTED.BIN

MD5 b6076077f354c689d04ea74cc95c4a9e
SHA1 4ef9939d8bf9a46a09ac112dd849228e431f4abd
SHA256 6e455c7681c0e056a670329865f8319e104e63cb034832cf252e3de394756b0f
SHA512 94c292bd5b23f520253ac249b3fe05133286f186df61421e166fc11fdd2602d8ff833337f32a193858daeacfdfe100af588e0e663160637efedece1083d42ecb

memory/1280-9-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1836-17-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/1280-18-0x0000000000400000-0x0000000000405000-memory.dmp

memory/1280-7-0x0000000000400000-0x0000000000405000-memory.dmp

memory/1280-35-0x0000000000400000-0x0000000000405000-memory.dmp

memory/2520-33-0x0000000000400000-0x0000000000423000-memory.dmp

memory/1280-32-0x0000000002C10000-0x0000000002CC6000-memory.dmp

memory/2520-31-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2520-30-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2520-29-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2520-27-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2520-24-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2520-23-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2520-21-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2860-52-0x0000000000150000-0x0000000000151000-memory.dmp

memory/2520-264-0x0000000000400000-0x0000000000423000-memory.dmp

memory/2860-55-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2520-53-0x00000000008C0000-0x0000000000976000-memory.dmp

memory/2860-47-0x00000000000D0000-0x00000000000D1000-memory.dmp

memory/2860-41-0x00000000000B0000-0x00000000000B1000-memory.dmp

memory/2520-40-0x0000000010450000-0x0000000010485000-memory.dmp

memory/2520-36-0x0000000010410000-0x0000000010445000-memory.dmp