Malware Analysis Report

2025-04-13 10:35

Sample ID 240325-nr6ayaed94
Target ddeb056ae1107f54f787111be1f88041
SHA256 0679a918d7d020d9487e309fbcf8e55c997f405530f92256b6de7d3ae27eb0b7
Tags
tofsee evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0679a918d7d020d9487e309fbcf8e55c997f405530f92256b6de7d3ae27eb0b7

Threat Level: Known bad

The file ddeb056ae1107f54f787111be1f88041 was found to be: Known bad.

Malicious Activity Summary

tofsee evasion persistence trojan

Windows security bypass

Tofsee

Modifies Windows Firewall

Sets service image path in registry

Creates new service(s)

Deletes itself

Checks computer location settings

Executes dropped EXE

Suspicious use of SetThreadContext

Launches sc.exe

Enumerates physical storage devices

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-25 11:38

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-25 11:38

Reported

2024-03-25 11:41

Platform

win10v2004-20240226-en

Max time kernel

147s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\hzhyimee\ImagePath = "C:\\Windows\\SysWOW64\\hzhyimee\\gbqafkca.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\hzhyimee\gbqafkca.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3280 set thread context of 2308 N/A C:\Windows\SysWOW64\hzhyimee\gbqafkca.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2672 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\cmd.exe
PID 2672 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\cmd.exe
PID 2672 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\cmd.exe
PID 2672 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\cmd.exe
PID 2672 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\cmd.exe
PID 2672 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\cmd.exe
PID 2672 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\sc.exe
PID 2672 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\sc.exe
PID 2672 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\sc.exe
PID 2672 wrote to memory of 4228 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\sc.exe
PID 2672 wrote to memory of 4228 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\sc.exe
PID 2672 wrote to memory of 4228 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\sc.exe
PID 2672 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\sc.exe
PID 2672 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\sc.exe
PID 2672 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\sc.exe
PID 2672 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\netsh.exe
PID 2672 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\netsh.exe
PID 2672 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\netsh.exe
PID 3280 wrote to memory of 2308 N/A C:\Windows\SysWOW64\hzhyimee\gbqafkca.exe C:\Windows\SysWOW64\svchost.exe
PID 3280 wrote to memory of 2308 N/A C:\Windows\SysWOW64\hzhyimee\gbqafkca.exe C:\Windows\SysWOW64\svchost.exe
PID 3280 wrote to memory of 2308 N/A C:\Windows\SysWOW64\hzhyimee\gbqafkca.exe C:\Windows\SysWOW64\svchost.exe
PID 3280 wrote to memory of 2308 N/A C:\Windows\SysWOW64\hzhyimee\gbqafkca.exe C:\Windows\SysWOW64\svchost.exe
PID 3280 wrote to memory of 2308 N/A C:\Windows\SysWOW64\hzhyimee\gbqafkca.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe

"C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hzhyimee\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gbqafkca.exe" C:\Windows\SysWOW64\hzhyimee\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create hzhyimee binPath= "C:\Windows\SysWOW64\hzhyimee\gbqafkca.exe /d\"C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description hzhyimee "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start hzhyimee

C:\Windows\SysWOW64\hzhyimee\gbqafkca.exe

C:\Windows\SysWOW64\hzhyimee\gbqafkca.exe /d"C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2672 -ip 2672

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 1232

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3280 -ip 3280

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 520

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 104.47.53.36:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 133.250.112.20.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 100.5.17.2.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta7.am0.yahoodns.net udp
US 98.136.96.76:25 mta7.am0.yahoodns.net tcp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 184.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
NL 142.250.27.27:25 smtp.google.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp

Files

memory/2672-1-0x0000000000810000-0x0000000000910000-memory.dmp

memory/2672-2-0x00000000005F0000-0x0000000000603000-memory.dmp

memory/2672-3-0x0000000000400000-0x0000000000456000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\gbqafkca.exe

MD5 5d1470caf0cf10f682be43586f909f62
SHA1 8b8e686d21ff3277ce86d9b5f9475eff108875ff
SHA256 39177e8c1255444d714f716028f324d346c3f9ce13e99554ef9a56a9094bdf58
SHA512 c265fee6d74bfaaacd05f790e2f6863362be0f112b2d6deb58803502500a536b5b6ef24b90b8d30732acb4f3f635c69d1ea38282d900d7422cf7b6f1c6e4d174

memory/2672-8-0x0000000000400000-0x0000000000456000-memory.dmp

memory/2672-9-0x00000000005F0000-0x0000000000603000-memory.dmp

memory/3280-10-0x00000000005D0000-0x00000000006D0000-memory.dmp

memory/2308-11-0x0000000001230000-0x0000000001245000-memory.dmp

memory/3280-12-0x0000000000400000-0x0000000000456000-memory.dmp

memory/2308-15-0x0000000001230000-0x0000000001245000-memory.dmp

memory/2308-16-0x0000000001230000-0x0000000001245000-memory.dmp

memory/2308-17-0x0000000001230000-0x0000000001245000-memory.dmp

memory/3280-18-0x0000000000400000-0x0000000000456000-memory.dmp

memory/2308-19-0x0000000001230000-0x0000000001245000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-25 11:38

Reported

2024-03-25 11:41

Platform

win7-20240215-en

Max time kernel

147s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe"

Signatures

Tofsee

trojan tofsee

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\lzsorelz = "0" C:\Windows\SysWOW64\svchost.exe N/A

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\lzsorelz\ImagePath = "C:\\Windows\\SysWOW64\\lzsorelz\\wnngwvwk.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\lzsorelz\wnngwvwk.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1772 set thread context of 2468 N/A C:\Windows\SysWOW64\lzsorelz\wnngwvwk.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2204 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\cmd.exe
PID 2204 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\cmd.exe
PID 2204 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\cmd.exe
PID 2204 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\cmd.exe
PID 2204 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\cmd.exe
PID 2204 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\cmd.exe
PID 2204 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\cmd.exe
PID 2204 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\cmd.exe
PID 2204 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\sc.exe
PID 2204 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\sc.exe
PID 2204 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\sc.exe
PID 2204 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\sc.exe
PID 2204 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\sc.exe
PID 2204 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\sc.exe
PID 2204 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\sc.exe
PID 2204 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\sc.exe
PID 2204 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\sc.exe
PID 2204 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\sc.exe
PID 2204 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\sc.exe
PID 2204 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\sc.exe
PID 2204 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\netsh.exe
PID 2204 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\netsh.exe
PID 2204 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\netsh.exe
PID 2204 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe C:\Windows\SysWOW64\netsh.exe
PID 1772 wrote to memory of 2468 N/A C:\Windows\SysWOW64\lzsorelz\wnngwvwk.exe C:\Windows\SysWOW64\svchost.exe
PID 1772 wrote to memory of 2468 N/A C:\Windows\SysWOW64\lzsorelz\wnngwvwk.exe C:\Windows\SysWOW64\svchost.exe
PID 1772 wrote to memory of 2468 N/A C:\Windows\SysWOW64\lzsorelz\wnngwvwk.exe C:\Windows\SysWOW64\svchost.exe
PID 1772 wrote to memory of 2468 N/A C:\Windows\SysWOW64\lzsorelz\wnngwvwk.exe C:\Windows\SysWOW64\svchost.exe
PID 1772 wrote to memory of 2468 N/A C:\Windows\SysWOW64\lzsorelz\wnngwvwk.exe C:\Windows\SysWOW64\svchost.exe
PID 1772 wrote to memory of 2468 N/A C:\Windows\SysWOW64\lzsorelz\wnngwvwk.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe

"C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\lzsorelz\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wnngwvwk.exe" C:\Windows\SysWOW64\lzsorelz\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create lzsorelz binPath= "C:\Windows\SysWOW64\lzsorelz\wnngwvwk.exe /d\"C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description lzsorelz "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start lzsorelz

C:\Windows\SysWOW64\lzsorelz\wnngwvwk.exe

C:\Windows\SysWOW64\lzsorelz\wnngwvwk.exe /d"C:\Users\Admin\AppData\Local\Temp\ddeb056ae1107f54f787111be1f88041.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 104.47.53.36:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta7.am0.yahoodns.net udp
US 67.195.228.94:25 mta7.am0.yahoodns.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
NL 142.250.27.27:25 smtp.google.com tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp

Files

memory/2204-3-0x00000000002D0000-0x00000000002E3000-memory.dmp

memory/2204-1-0x0000000000500000-0x0000000000600000-memory.dmp

memory/2204-4-0x0000000000400000-0x0000000000456000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\wnngwvwk.exe

MD5 2625bb279b7189f174d33f70d5c9ddd4
SHA1 e2f338df49594891338262769442259554159f10
SHA256 51f0f0284474c28d9b2d5f98cf1f36e654b814006e2de524169991f7d04c3a58
SHA512 eec45aeac1b8ca4865adc23b1f67cb23c97cec4cec35816c5e12b2cb940efc534eafc439863d513e136d86f3c234c9fe97d165b3eaba4054cb6d5fc9c60248fa

C:\Windows\SysWOW64\lzsorelz\wnngwvwk.exe

MD5 3ae4a343926f16dcbffca990846d6615
SHA1 fb8e99883814c5b241d4a1fc4aeb66258e19f419
SHA256 dac7c30c430f1130052962e3a3e5cdddbdefe125daccf9f7717dd72583aa852d
SHA512 d52d13ba0dcfc5b0663887ec25dc2b497f1fa9d1fdf337ba64dbcbf03d3e0aa6254f71f1d033a0a351259142a784f52ef52f2a1928b4cf40a7ad936b477db838

memory/2204-8-0x0000000000400000-0x0000000000456000-memory.dmp

memory/1772-9-0x00000000002D0000-0x00000000003D0000-memory.dmp

memory/1772-10-0x0000000000400000-0x0000000000456000-memory.dmp

memory/2468-14-0x0000000000080000-0x0000000000095000-memory.dmp

memory/1772-16-0x0000000000400000-0x0000000000456000-memory.dmp

memory/2468-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2468-11-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2468-18-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2468-19-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2468-20-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2468-21-0x0000000000080000-0x0000000000095000-memory.dmp