Malware Analysis Report

2025-04-13 22:44

Sample ID 250228-ygqslswpt9
Target JaffaCakes118_341d254329cf99d1251c66f2bae87c71
SHA256 2896d43819e9b8b9f376018561a2105d1ecd3dfc26042370e89916ee217c3996
Tags
guest16 darkcomet discovery rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2896d43819e9b8b9f376018561a2105d1ecd3dfc26042370e89916ee217c3996

Threat Level: Known bad

The file JaffaCakes118_341d254329cf99d1251c66f2bae87c71 was found to be: Known bad.

Malicious Activity Summary

guest16 darkcomet discovery rat trojan

Darkcomet family

Darkcomet

Checks BIOS information in registry

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Unsigned PE

Enumerates physical storage devices

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-28 19:45

Signatures

Darkcomet family

darkcomet

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-28 19:45

Reported

2025-02-28 19:48

Platform

win7-20240903-en

Max time kernel

149s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe"

Signatures

Darkcomet

trojan rat darkcomet

Darkcomet family

darkcomet

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2336 set thread context of 2696 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe C:\Windows\SysWOW64\explorer.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\DllHost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\DllHost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\DllHost.exe N/A
N/A N/A C:\Windows\SysWOW64\DllHost.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe"

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}

C:\Windows\SysWOW64\explorer.exe

"C:\Windows\SysWOW64\explorer.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 softwareone.no-ip.info udp

Files

memory/2336-0-0x00000000002C0000-0x00000000002C1000-memory.dmp

memory/2336-2-0x00000000024D0000-0x00000000024D2000-memory.dmp

memory/1904-3-0x00000000001C0000-0x00000000001C2000-memory.dmp

memory/1904-4-0x00000000008D0000-0x00000000008D1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DESERT.JPG

MD5 ba45c8f60456a672e003a875e469d0eb
SHA1 30420d1a9afb2bcb60335812569af4435a59ce17
SHA256 010f60d2927a35d0235490136ef9f4953b7ee453073794bcaf153d20a64544ea
SHA512 5d661a7855bc2cf0678aa7e0c4713d0f7f68c1b72bf14660ccee48e8994dbaa6431c81d81184bdbac6e0ee9bd38df06937255f1da277007d77603829465feca1

memory/2696-10-0x0000000013140000-0x00000000132DF000-memory.dmp

memory/2696-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2696-6-0x0000000013140000-0x00000000132DF000-memory.dmp

memory/2336-12-0x0000000013140000-0x00000000132DF000-memory.dmp

memory/2696-13-0x0000000013140000-0x00000000132DF000-memory.dmp

memory/2696-14-0x0000000013140000-0x00000000132DF000-memory.dmp

memory/2696-11-0x0000000013140000-0x00000000132DF000-memory.dmp

memory/2696-15-0x0000000013140000-0x00000000132DF000-memory.dmp

memory/2696-16-0x0000000013140000-0x00000000132DF000-memory.dmp

memory/1904-17-0x00000000008D0000-0x00000000008D1000-memory.dmp

memory/2696-18-0x0000000013140000-0x00000000132DF000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-28 19:45

Reported

2025-02-28 19:48

Platform

win10v2004-20250217-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe"

Signatures

Darkcomet

trojan rat darkcomet

Darkcomet family

darkcomet

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1388 set thread context of 2788 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe C:\Windows\SysWOW64\explorer.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\explorer.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\explorer.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_341d254329cf99d1251c66f2bae87c71.exe"

C:\Windows\SysWOW64\explorer.exe

"C:\Windows\SysWOW64\explorer.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
GB 2.18.66.179:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp
US 8.8.8.8:53 softwareone.no-ip.info udp

Files

memory/1388-0-0x00000000021F0000-0x00000000021F1000-memory.dmp

memory/2788-2-0x0000000013140000-0x00000000132DF000-memory.dmp

memory/2788-4-0x0000000013140000-0x00000000132DF000-memory.dmp

memory/1388-5-0x0000000013140000-0x00000000132DF000-memory.dmp

memory/2788-6-0x0000000013140000-0x00000000132DF000-memory.dmp

memory/2788-9-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

memory/2788-8-0x0000000013140000-0x00000000132DF000-memory.dmp

memory/2788-7-0x0000000013140000-0x00000000132DF000-memory.dmp

memory/2788-3-0x0000000013140000-0x00000000132DF000-memory.dmp

memory/2788-10-0x0000000013140000-0x00000000132DF000-memory.dmp