Malware Analysis Report

2025-05-06 00:17

Sample ID 250421-j2k1jawshw
Target JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e
SHA256 16d6fd6bec6386c9b156fa85ce981db98a976e97409f32ce9827f62d5378c76b
Tags
latentbot discovery persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

16d6fd6bec6386c9b156fa85ce981db98a976e97409f32ce9827f62d5378c76b

Threat Level: Known bad

The file JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e was found to be: Known bad.

Malicious Activity Summary

latentbot discovery persistence trojan

LatentBot

Latentbot family

Adds policy Run key to start application

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Modifies registry key

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-04-21 08:09

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-04-21 08:09

Reported

2025-04-21 08:12

Platform

win10v2004-20250314-en

Max time kernel

141s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe"

Signatures

LatentBot

trojan latentbot

Latentbot family

latentbot

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rundll.exe = "\"C:\\Users\\Admin\\AppData\\Local\\rundll.exe \"" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rundll.exe = "\"C:\\Users\\Admin\\AppData\\Local\\rundll.exe \"" C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\rundll.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\rundll.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\rundll.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\rundll.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\rundll.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\rundll.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\rundll.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\rundll.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\rundll.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3988 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe C:\Users\Admin\AppData\Local\rundll.exe
PID 3988 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe C:\Users\Admin\AppData\Local\rundll.exe
PID 3988 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe C:\Users\Admin\AppData\Local\rundll.exe
PID 3988 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe C:\Windows\SysWOW64\cmd.exe
PID 3988 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe C:\Windows\SysWOW64\cmd.exe
PID 3988 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe C:\Windows\SysWOW64\cmd.exe
PID 636 wrote to memory of 5400 N/A C:\Users\Admin\AppData\Local\rundll.exe C:\Windows\SysWOW64\cmd.exe
PID 636 wrote to memory of 5400 N/A C:\Users\Admin\AppData\Local\rundll.exe C:\Windows\SysWOW64\cmd.exe
PID 636 wrote to memory of 5400 N/A C:\Users\Admin\AppData\Local\rundll.exe C:\Windows\SysWOW64\cmd.exe
PID 3052 wrote to memory of 1548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3052 wrote to memory of 1548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3052 wrote to memory of 1548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1548 wrote to memory of 2936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1548 wrote to memory of 2936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1548 wrote to memory of 2936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5400 wrote to memory of 228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5400 wrote to memory of 228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5400 wrote to memory of 228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 228 wrote to memory of 216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 228 wrote to memory of 216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 228 wrote to memory of 216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe"

C:\Users\Admin\AppData\Local\rundll.exe

"C:\Users\Admin\AppData\Local\rundll.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c syscheck.bat

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c syscheck.bat

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /V rundll.exe /D "\"C:\Users\Admin\AppData\Local\rundll.exe \"" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /V rundll.exe /D "\"C:\Users\Admin\AppData\Local\rundll.exe \"" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /V rundll.exe /D "\"C:\Users\Admin\AppData\Local\rundll.exe \"" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /V rundll.exe /D "\"C:\Users\Admin\AppData\Local\rundll.exe \"" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 birazsiradan.zapto.org udp
US 8.8.8.8:53 birazsiradan.zapto.org udp
US 8.8.8.8:53 birazsiradan.zapto.org udp
US 8.8.8.8:53 birazsiradan.zapto.org udp
US 8.8.8.8:53 birazsiradan.zapto.org udp
US 8.8.8.8:53 birazsiradan.zapto.org udp
US 8.8.8.8:53 birazsiradan.zapto.org udp
US 8.8.8.8:53 birazsiradan.zapto.org udp
US 8.8.8.8:53 birazsiradan.zapto.org udp
US 8.8.8.8:53 c.pki.goog udp
DE 172.217.16.67:80 c.pki.goog tcp
US 8.8.8.8:53 birazsiradan.zapto.org udp
US 8.8.8.8:53 birazsiradan.zapto.org udp
US 8.8.8.8:53 birazsiradan.zapto.org udp
US 8.8.8.8:53 birazsiradan.zapto.org udp
US 8.8.8.8:53 birazsiradan.zapto.org udp
US 8.8.8.8:53 birazsiradan.zapto.org udp

Files

memory/3988-0-0x00000000006F0000-0x00000000006F1000-memory.dmp

C:\Users\Admin\AppData\Local\rundll.exe

MD5 6ed55d1f33d1527b87fcb2f8c207c07f
SHA1 aef79aadf470cf3a0e0d8f34211f7bfc7e0bc240
SHA256 5fccdbe0f66f612a1c674ba28c6c788b3ea45ac7b70f5e23f3af2dbf1e33fdbe
SHA512 379ed920f7b72329296cc0d84e9c6fb107726ead875765c848564e9f94dd4b3f0cd75b2a80a74249bd618f58631830e0ed0bba0ddf7f781d6d58eee6a11cfd9a

C:\Users\Admin\AppData\Local\ntdata.dll

MD5 fe2232f82e4beb5ae483da8e699e1a51
SHA1 ed2131d0f70e709f8791bfff64d2b8a4cb658ed5
SHA256 0cb462094392aeb31dd7588d95de2577efd0987315be0ce84a531c26bee3b49e
SHA512 df9ab5afb94cff850dd5c4b4ba0cfcd77d4a5887ac85a60db223eba8c5d1d64467d77c6133b8e1f5ca795deae3623717ff4cc669919d9f96ef6df193187fcc0b

memory/636-16-0x0000000000A40000-0x0000000000A8C000-memory.dmp

C:\Users\Admin\AppData\Local\ntldr.dll

MD5 4ca8f1c13f632b1168649967e6a97452
SHA1 9c5404d99f280a8f6349a3834c0ac167b2c2d6e6
SHA256 dff25e133d2e25b2b9a713c5f69a9b59d6a3da22a172368adfbd6a6ba7f701cb
SHA512 25d601b57054e29e6b77ce7b3ead18f756a0f931445d927919d4297d3d5f77cb447161ad46d9e523bb2a91566734db927eb0d06f258f9a93f02093826ee60bcb

C:\Users\Admin\AppData\Local\Temp\syscheck.bat

MD5 d53c75977954601b591dba8be2f53cd1
SHA1 5073b31394b4bb63af3d7ec0985d3a66d209abbe
SHA256 789c15d1350284cf0270658c414fa4ed204473644675cb13f9e3981d89724090
SHA512 baa379fc240cc3e26155eaf71fa61fad78ba781f00615055e5227ccaf81bcde74723231d20b157ed2a78bf354b617da5d9d21a0badb11eb1bb3a87a86cf40ca9

memory/3988-26-0x0000000000400000-0x000000000055B000-memory.dmp

memory/636-21-0x00000000022C0000-0x00000000022E9000-memory.dmp

memory/636-17-0x0000000002260000-0x0000000002261000-memory.dmp

memory/636-30-0x0000000002260000-0x0000000002261000-memory.dmp

memory/636-28-0x0000000000A40000-0x0000000000A8C000-memory.dmp

memory/636-29-0x00000000022C0000-0x00000000022E9000-memory.dmp

memory/636-27-0x0000000000400000-0x000000000047F000-memory.dmp

memory/636-31-0x0000000000400000-0x000000000047F000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-04-21 08:09

Reported

2025-04-21 08:12

Platform

win11-20250410-en

Max time kernel

141s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe"

Signatures

LatentBot

trojan latentbot

Latentbot family

latentbot

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rundll.exe = "\"C:\\Users\\Admin\\AppData\\Local\\rundll.exe \"" C:\Windows\SysWOW64\reg.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\rundll.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\rundll.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\rundll.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\rundll.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\rundll.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\rundll.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\rundll.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\rundll.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\rundll.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 244 wrote to memory of 5492 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe C:\Users\Admin\AppData\Local\rundll.exe
PID 244 wrote to memory of 5492 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe C:\Users\Admin\AppData\Local\rundll.exe
PID 244 wrote to memory of 5492 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe C:\Users\Admin\AppData\Local\rundll.exe
PID 244 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe C:\Windows\SysWOW64\cmd.exe
PID 244 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe C:\Windows\SysWOW64\cmd.exe
PID 244 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe C:\Windows\SysWOW64\cmd.exe
PID 5492 wrote to memory of 3532 N/A C:\Users\Admin\AppData\Local\rundll.exe C:\Windows\SysWOW64\cmd.exe
PID 5492 wrote to memory of 3532 N/A C:\Users\Admin\AppData\Local\rundll.exe C:\Windows\SysWOW64\cmd.exe
PID 5492 wrote to memory of 3532 N/A C:\Users\Admin\AppData\Local\rundll.exe C:\Windows\SysWOW64\cmd.exe
PID 2208 wrote to memory of 3500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2208 wrote to memory of 3500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2208 wrote to memory of 3500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3500 wrote to memory of 6112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3500 wrote to memory of 6112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3500 wrote to memory of 6112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c872b3edf73ce17ead51aaeaa802ad9e.exe"

C:\Users\Admin\AppData\Local\rundll.exe

"C:\Users\Admin\AppData\Local\rundll.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c syscheck.bat

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c syscheck.bat

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /V rundll.exe /D "\"C:\Users\Admin\AppData\Local\rundll.exe \"" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /V rundll.exe /D "\"C:\Users\Admin\AppData\Local\rundll.exe \"" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 birazsiradan.zapto.org udp

Files

memory/244-0-0x00000000022A0000-0x00000000022A1000-memory.dmp

C:\Users\Admin\AppData\Local\rundll.exe

MD5 6ed55d1f33d1527b87fcb2f8c207c07f
SHA1 aef79aadf470cf3a0e0d8f34211f7bfc7e0bc240
SHA256 5fccdbe0f66f612a1c674ba28c6c788b3ea45ac7b70f5e23f3af2dbf1e33fdbe
SHA512 379ed920f7b72329296cc0d84e9c6fb107726ead875765c848564e9f94dd4b3f0cd75b2a80a74249bd618f58631830e0ed0bba0ddf7f781d6d58eee6a11cfd9a

C:\Users\Admin\AppData\Local\ntldr.dll

MD5 4ca8f1c13f632b1168649967e6a97452
SHA1 9c5404d99f280a8f6349a3834c0ac167b2c2d6e6
SHA256 dff25e133d2e25b2b9a713c5f69a9b59d6a3da22a172368adfbd6a6ba7f701cb
SHA512 25d601b57054e29e6b77ce7b3ead18f756a0f931445d927919d4297d3d5f77cb447161ad46d9e523bb2a91566734db927eb0d06f258f9a93f02093826ee60bcb

memory/244-26-0x0000000000400000-0x000000000055B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\syscheck.bat

MD5 d53c75977954601b591dba8be2f53cd1
SHA1 5073b31394b4bb63af3d7ec0985d3a66d209abbe
SHA256 789c15d1350284cf0270658c414fa4ed204473644675cb13f9e3981d89724090
SHA512 baa379fc240cc3e26155eaf71fa61fad78ba781f00615055e5227ccaf81bcde74723231d20b157ed2a78bf354b617da5d9d21a0badb11eb1bb3a87a86cf40ca9

memory/5492-21-0x0000000002480000-0x00000000024A9000-memory.dmp

memory/5492-17-0x0000000002230000-0x0000000002231000-memory.dmp

C:\Users\Admin\AppData\Local\ntdata.dll

MD5 fe2232f82e4beb5ae483da8e699e1a51
SHA1 ed2131d0f70e709f8791bfff64d2b8a4cb658ed5
SHA256 0cb462094392aeb31dd7588d95de2577efd0987315be0ce84a531c26bee3b49e
SHA512 df9ab5afb94cff850dd5c4b4ba0cfcd77d4a5887ac85a60db223eba8c5d1d64467d77c6133b8e1f5ca795deae3623717ff4cc669919d9f96ef6df193187fcc0b

memory/5492-16-0x00000000009E0000-0x0000000000A2C000-memory.dmp

memory/5492-27-0x0000000000400000-0x000000000047F000-memory.dmp

memory/5492-29-0x0000000002480000-0x00000000024A9000-memory.dmp

memory/5492-30-0x0000000002230000-0x0000000002231000-memory.dmp

memory/5492-28-0x00000000009E0000-0x0000000000A2C000-memory.dmp

memory/5492-31-0x0000000000400000-0x000000000047F000-memory.dmp