Malware Analysis Report

2025-04-13 10:35

Sample ID 240325-vmjdyagd9y
Target de8324c81f580d5f1f3f313224f9cee2
SHA256 ee9b872015d916a29d3cb56629f02477d60ad22e62013ded3914fd72ea97f966
Tags
tofsee evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ee9b872015d916a29d3cb56629f02477d60ad22e62013ded3914fd72ea97f966

Threat Level: Known bad

The file de8324c81f580d5f1f3f313224f9cee2 was found to be: Known bad.

Malicious Activity Summary

tofsee evasion persistence trojan

Tofsee

Windows security bypass

Creates new service(s)

Sets service image path in registry

Modifies Windows Firewall

Checks computer location settings

Executes dropped EXE

Deletes itself

Suspicious use of SetThreadContext

Launches sc.exe

Enumerates physical storage devices

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-25 17:06

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-25 17:06

Reported

2024-03-25 17:09

Platform

win10v2004-20240226-en

Max time kernel

147s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\jipiujwz\ImagePath = "C:\\Windows\\SysWOW64\\jipiujwz\\wwpcolkm.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\jipiujwz\wwpcolkm.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1516 set thread context of 796 N/A C:\Windows\SysWOW64\jipiujwz\wwpcolkm.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4968 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\cmd.exe
PID 4968 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\cmd.exe
PID 4968 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\cmd.exe
PID 4968 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\cmd.exe
PID 4968 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\cmd.exe
PID 4968 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\cmd.exe
PID 4968 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\sc.exe
PID 4968 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\sc.exe
PID 4968 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\sc.exe
PID 4968 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\sc.exe
PID 4968 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\sc.exe
PID 4968 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\sc.exe
PID 4968 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\sc.exe
PID 4968 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\sc.exe
PID 4968 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\sc.exe
PID 4968 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\netsh.exe
PID 4968 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\netsh.exe
PID 4968 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\netsh.exe
PID 1516 wrote to memory of 796 N/A C:\Windows\SysWOW64\jipiujwz\wwpcolkm.exe C:\Windows\SysWOW64\svchost.exe
PID 1516 wrote to memory of 796 N/A C:\Windows\SysWOW64\jipiujwz\wwpcolkm.exe C:\Windows\SysWOW64\svchost.exe
PID 1516 wrote to memory of 796 N/A C:\Windows\SysWOW64\jipiujwz\wwpcolkm.exe C:\Windows\SysWOW64\svchost.exe
PID 1516 wrote to memory of 796 N/A C:\Windows\SysWOW64\jipiujwz\wwpcolkm.exe C:\Windows\SysWOW64\svchost.exe
PID 1516 wrote to memory of 796 N/A C:\Windows\SysWOW64\jipiujwz\wwpcolkm.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe

"C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jipiujwz\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wwpcolkm.exe" C:\Windows\SysWOW64\jipiujwz\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create jipiujwz binPath= "C:\Windows\SysWOW64\jipiujwz\wwpcolkm.exe /d\"C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description jipiujwz "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start jipiujwz

C:\Windows\SysWOW64\jipiujwz\wwpcolkm.exe

C:\Windows\SysWOW64\jipiujwz\wwpcolkm.exe /d"C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4968 -ip 4968

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1036

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1516 -ip 1516

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 520

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 107.211.222.173.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 133.250.112.20.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 104.47.53.36:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta5.am0.yahoodns.net udp
US 98.136.96.77:25 mta5.am0.yahoodns.net tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
BE 64.233.166.26:25 smtp.google.com tcp
US 8.8.8.8:53 181.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 6.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp

Files

memory/4968-1-0x0000000002E00000-0x0000000002F00000-memory.dmp

memory/4968-2-0x0000000002DD0000-0x0000000002DE3000-memory.dmp

memory/4968-4-0x0000000000400000-0x0000000002C6D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\wwpcolkm.exe

MD5 3e6edafd689bee933af82111d2136fc1
SHA1 378dbcdcf9b5c84204d6777c51344b86b3514bb9
SHA256 724e17e98ee73346c2fbb70d4c7757036f5d62a6a9355dda6b9940afb501f3e8
SHA512 214f97b81625e4d4b8c1381a2d7b424bfd26d09b6a8dfec893facf4edf9d8e063b5601a15648c07322fffefcfec3072c4ac9d258bf0cea5457f1a4c35efc170a

C:\Windows\SysWOW64\jipiujwz\wwpcolkm.exe

MD5 9120cba4bee0547cf74ca130452af1a6
SHA1 35545928284e78502dc2a41f6691223c2b27d25e
SHA256 68bd29510e1eb6e0f31623787a195c2080b037722909634515f9c702bf91b804
SHA512 fa0c972688aafc588a828abe2521f2b7c1e5df4ab14517a7bb0c11084db3e9e5b1e2e917123d13c81c5aaa0a56068eda0c34d57e7d2bb6f61abf3e2339383de4

memory/4968-8-0x0000000000400000-0x0000000002C6D000-memory.dmp

memory/4968-10-0x0000000002DD0000-0x0000000002DE3000-memory.dmp

memory/796-12-0x0000000000440000-0x0000000000455000-memory.dmp

memory/1516-11-0x0000000000400000-0x0000000002C6D000-memory.dmp

memory/1516-14-0x0000000002CD0000-0x0000000002DD0000-memory.dmp

memory/796-16-0x0000000000440000-0x0000000000455000-memory.dmp

memory/796-18-0x0000000000440000-0x0000000000455000-memory.dmp

memory/1516-19-0x0000000000400000-0x0000000002C6D000-memory.dmp

memory/796-20-0x0000000000440000-0x0000000000455000-memory.dmp

memory/796-21-0x0000000000440000-0x0000000000455000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-25 17:06

Reported

2024-03-25 17:08

Platform

win7-20231129-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe"

Signatures

Tofsee

trojan tofsee

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\jtqwrirc = "0" C:\Windows\SysWOW64\svchost.exe N/A

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\jtqwrirc\ImagePath = "C:\\Windows\\SysWOW64\\jtqwrirc\\ddwjvsrt.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\jtqwrirc\ddwjvsrt.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1420 set thread context of 2524 N/A C:\Windows\SysWOW64\jtqwrirc\ddwjvsrt.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2924 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\sc.exe
PID 2924 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\sc.exe
PID 2924 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\sc.exe
PID 2924 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\sc.exe
PID 2924 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\sc.exe
PID 2924 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\sc.exe
PID 2924 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\sc.exe
PID 2924 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\sc.exe
PID 2924 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\sc.exe
PID 2924 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\sc.exe
PID 2924 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\sc.exe
PID 2924 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\sc.exe
PID 2924 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\netsh.exe
PID 2924 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\netsh.exe
PID 2924 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\netsh.exe
PID 2924 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe C:\Windows\SysWOW64\netsh.exe
PID 1420 wrote to memory of 2524 N/A C:\Windows\SysWOW64\jtqwrirc\ddwjvsrt.exe C:\Windows\SysWOW64\svchost.exe
PID 1420 wrote to memory of 2524 N/A C:\Windows\SysWOW64\jtqwrirc\ddwjvsrt.exe C:\Windows\SysWOW64\svchost.exe
PID 1420 wrote to memory of 2524 N/A C:\Windows\SysWOW64\jtqwrirc\ddwjvsrt.exe C:\Windows\SysWOW64\svchost.exe
PID 1420 wrote to memory of 2524 N/A C:\Windows\SysWOW64\jtqwrirc\ddwjvsrt.exe C:\Windows\SysWOW64\svchost.exe
PID 1420 wrote to memory of 2524 N/A C:\Windows\SysWOW64\jtqwrirc\ddwjvsrt.exe C:\Windows\SysWOW64\svchost.exe
PID 1420 wrote to memory of 2524 N/A C:\Windows\SysWOW64\jtqwrirc\ddwjvsrt.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe

"C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jtqwrirc\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ddwjvsrt.exe" C:\Windows\SysWOW64\jtqwrirc\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create jtqwrirc binPath= "C:\Windows\SysWOW64\jtqwrirc\ddwjvsrt.exe /d\"C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description jtqwrirc "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start jtqwrirc

C:\Windows\SysWOW64\jtqwrirc\ddwjvsrt.exe

C:\Windows\SysWOW64\jtqwrirc\ddwjvsrt.exe /d"C:\Users\Admin\AppData\Local\Temp\de8324c81f580d5f1f3f313224f9cee2.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.11.0:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta5.am0.yahoodns.net udp
US 67.195.228.94:25 mta5.am0.yahoodns.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
BE 64.233.166.26:25 smtp.google.com tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 94.100.180.31:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp

Files

memory/2924-1-0x0000000002D80000-0x0000000002E80000-memory.dmp

memory/2924-3-0x0000000000220000-0x0000000000233000-memory.dmp

memory/2924-4-0x0000000000400000-0x0000000002C6D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ddwjvsrt.exe

MD5 15955627bb0532349314f9dd256f5625
SHA1 358a42d0eb46b601f5f6ccd4a53c1654402f706b
SHA256 7d3055e4e20d9b0232ca87992744baeefd6fe0522f8a1b35c82f930f4cd9d9b8
SHA512 8ff8c2df63cfed5f8da2c250dd4fc360b2ae5f1d7a5c2529bd83cc644e6a291d25bc8b2ee10f3d19c580495c016d7992ed12f98ac2d8d06686355bfd2f1b7c82

C:\Windows\SysWOW64\jtqwrirc\ddwjvsrt.exe

MD5 2b112cfa3c7d070d5c21b6b7712fdde3
SHA1 5d3f4810619830b3ca591987d717df1f862a7e29
SHA256 46b06219996222655f87edbad59fbf4875c3b25c0b94f13e8a6fcc95453ad7de
SHA512 246fb3c00f3658849bd0918c96b23414c0d885c767895dcf65e6a523e1246247ef12213b0af2073269c9e866c692e7975513df957778ecc7e36fc94f54d6e32b

memory/2924-8-0x0000000000400000-0x0000000002C6D000-memory.dmp

memory/2524-13-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2524-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2524-10-0x0000000000080000-0x0000000000095000-memory.dmp

memory/1420-9-0x0000000000290000-0x0000000000390000-memory.dmp

memory/1420-16-0x0000000000400000-0x0000000002C6D000-memory.dmp

memory/2524-19-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2524-20-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2524-21-0x0000000000080000-0x0000000000095000-memory.dmp