Malware Analysis Report

2024-11-30 02:42

Sample ID 240407-t6wypsgh9x
Target e5616e35325978498fbbda48538ab23f_JaffaCakes118
SHA256 e4a8662d439ee680d42971b9a2d85fc05c3f3332a63aae59d86939845f59fcb4
Tags
evasion persistence spyware stealer
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

e4a8662d439ee680d42971b9a2d85fc05c3f3332a63aae59d86939845f59fcb4

Threat Level: Likely malicious

The file e5616e35325978498fbbda48538ab23f_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

evasion persistence spyware stealer

Sets file to hidden

Reads user/profile data of web browsers

Deletes itself

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Enumerates connected drives

Drops file in Windows directory

Enumerates physical storage devices

Program crash

Unsigned PE

Runs .reg file with regedit

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Views/modifies file attributes

Suspicious use of SetWindowsHookEx

Runs ping.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 16:40

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 16:40

Reported

2024-04-07 16:43

Platform

win7-20231129-en

Max time kernel

147s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe"

Signatures

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\windows\web\printers\rar.exe N/A
N/A N/A \??\c:\windows\web\printers\rar.exe N/A
N/A N/A \??\c:\windows\dell\lsess.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnceEx\windows\Entry1 = "c:\\windows\\web\\printers\\123.bat" C:\Windows\SysWOW64\regedit.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\e: C:\Windows\SysWOW64\cmd.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\cmd.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\cmd.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created \??\c:\windows\web\printers\124.bat \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\jinshan.vbs \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\ztop\svchost.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification \??\c:\windows\dell\lsess.exe C:\Windows\SysWOW64\cmd.exe N/A
File created \??\c:\windows\web\printers\125.bat C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe N/A
File created \??\c:\windows\web\printers\1.reg \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\5.reg \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\bb.vbs \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\jin.vbs \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\svc.bat \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\intell\1.txt C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe N/A
File created \??\c:\windows\web\printers\svc.bat \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\md5.txt C:\Windows\SysWOW64\cmd.exe N/A
File created \??\c:\windows\web\printers\360s.txt \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\gl.txt \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\jinshan.vbs \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\SVCH0ST.ini \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\124.bat \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\abc.vbs \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\SVCH0ST.EXE \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\3.reg \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\4.reg \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\123.bat \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\360s.txt \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\bb.vbs \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\usbhard.rar C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\web\printers\rar.exe C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\web\printers\1.reg \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\k.bat \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\k.bat \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\dell\lsess.txt \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\QQlog.exe \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\SVCH0ST.ini \??\c:\windows\web\printers\rar.exe N/A
File opened for modification C:\windows\web\printers C:\Windows\SysWOW64\attrib.exe N/A
File created \??\c:\windows\ztop\svchost.exe C:\Windows\SysWOW64\cmd.exe N/A
File created \??\c:\windows\dell\lsess.txt \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\zzz.rar C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe N/A
File created \??\c:\windows\web\printers\5.reg \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\jin.vbs \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\dell\lsess.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification \??\c:\windows\web\printers\abc.vbs \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\gl.txt \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\QQlog.exe \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\SVCH0ST.EXE \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\3.reg \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\4.reg \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\123.bat \??\c:\windows\web\printers\rar.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1072 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1072 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1072 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1072 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2552 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\web\printers\rar.exe
PID 2552 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\web\printers\rar.exe
PID 2552 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\web\printers\rar.exe
PID 2552 wrote to memory of 2696 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\web\printers\rar.exe
PID 2552 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2552 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2552 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2552 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2552 wrote to memory of 2440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2552 wrote to memory of 2440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2552 wrote to memory of 2440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2552 wrote to memory of 2440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2552 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\web\printers\rar.exe
PID 2552 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\web\printers\rar.exe
PID 2552 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\web\printers\rar.exe
PID 2552 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\web\printers\rar.exe
PID 2552 wrote to memory of 3036 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\dell\lsess.exe
PID 2552 wrote to memory of 3036 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\dell\lsess.exe
PID 2552 wrote to memory of 3036 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\dell\lsess.exe
PID 2552 wrote to memory of 3036 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\dell\lsess.exe
PID 2552 wrote to memory of 1924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2552 wrote to memory of 1924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2552 wrote to memory of 1924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2552 wrote to memory of 1924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2552 wrote to memory of 2404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2552 wrote to memory of 2404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2552 wrote to memory of 2404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2552 wrote to memory of 2404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 1072 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1072 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1072 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1072 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 320 wrote to memory of 1744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 320 wrote to memory of 1744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 320 wrote to memory of 1744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 320 wrote to memory of 1744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3036 wrote to memory of 2328 N/A \??\c:\windows\dell\lsess.exe C:\Windows\SysWOW64\WerFault.exe
PID 3036 wrote to memory of 2328 N/A \??\c:\windows\dell\lsess.exe C:\Windows\SysWOW64\WerFault.exe
PID 3036 wrote to memory of 2328 N/A \??\c:\windows\dell\lsess.exe C:\Windows\SysWOW64\WerFault.exe
PID 3036 wrote to memory of 2328 N/A \??\c:\windows\dell\lsess.exe C:\Windows\SysWOW64\WerFault.exe
PID 320 wrote to memory of 2628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 320 wrote to memory of 2628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 320 wrote to memory of 2628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 320 wrote to memory of 2628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2552 wrote to memory of 1272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2552 wrote to memory of 1272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2552 wrote to memory of 1272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2552 wrote to memory of 1272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2552 wrote to memory of 1444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2552 wrote to memory of 1444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2552 wrote to memory of 1444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2552 wrote to memory of 1444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2552 wrote to memory of 1480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2552 wrote to memory of 1480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2552 wrote to memory of 1480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2552 wrote to memory of 1480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2552 wrote to memory of 1236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2552 wrote to memory of 1236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2552 wrote to memory of 1236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2552 wrote to memory of 1236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\windows\web\printers\125.bat

\??\c:\windows\web\printers\rar.exe

"c:\windows\web\printers\Rar.exe" e -y -ping c:\windows\web\printers\usbhard.rar c:\windows\web\printers\

C:\Windows\SysWOW64\attrib.exe

attrib +R +A +S +H c:\windows\web\printers

C:\Windows\SysWOW64\regedit.exe

regedit /s c:\windows\web\printers\1.reg

\??\c:\windows\web\printers\rar.exe

"c:\windows\web\printers\Rar.exe" e -y -ping c:\windows\web\printers\zzz.rar c:\windows\dell\

\??\c:\windows\dell\lsess.exe

c:\windows\dell\lsess.exe

C:\Windows\SysWOW64\regedit.exe

regedit /s c:\windows\web\printers\5.reg

C:\Windows\SysWOW64\regedit.exe

regedit /s c:\windows\web\printers\2.reg

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\11a.bat

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 3

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 184

C:\Windows\SysWOW64\attrib.exe

attrib -S -H c:\ma.exe

C:\Windows\SysWOW64\attrib.exe

attrib -H -R d:\~1

C:\Windows\SysWOW64\attrib.exe

attrib +H +R d:\setprter

C:\Windows\SysWOW64\attrib.exe

attrib -H -R e:\~1

C:\Windows\SysWOW64\attrib.exe

attrib +H +R e:\setprter

C:\Windows\SysWOW64\attrib.exe

attrib -H -R f:\~1

C:\Windows\SysWOW64\attrib.exe

attrib +H +R f:\setprter

C:\Windows\SysWOW64\attrib.exe

attrib -H -R g:\~1

C:\Windows\SysWOW64\attrib.exe

attrib +H +R g:\setprter

C:\Windows\SysWOW64\attrib.exe

attrib -H -R h:\~1

C:\Windows\SysWOW64\attrib.exe

attrib +H +R h:\setprter

Network

N/A

Files

memory/1072-0-0x0000000000400000-0x00000000004DE000-memory.dmp

memory/1072-1-0x0000000000020000-0x0000000000023000-memory.dmp

\??\c:\windows\web\printers\usbhard.rar

MD5 a0f784ad499c07a7b7c3a48fab5afd0b
SHA1 8194f876410f89d3e4cc9ad1f86c89d1138b0d6c
SHA256 89c23b96ac3837d3ee68ff0684f57e14cee8fc3ac3171d65c173ba6417411335
SHA512 a13b015ec263073ddd2aa5ad116f65f7ae38dc592d6fba9ab2fc3dc034c483d53077c83005b9214cecbf8201a5cd50baea33824136903c0604c5cf6ade2f39de

C:\Windows\Web\printers\rar.exe

MD5 0a5680183c0089a64621e211917664d8
SHA1 8525d73c99e28413e97a094c99950e1806786246
SHA256 c7d6bfe9d26d1ecdd9f2e7f3f892a4d32030949937f86938edcb1995655c2814
SHA512 b843b8994c764c3761bef8d34eefb312c9d9567b3f4aadc38008caf42d0cdb82c33276203e4210adcc1e8c567268ebdf01a0a1e839694811932889ac971bb051

\??\c:\windows\web\printers\125.bat

MD5 1af018ff177dfbae562ac429cff786cb
SHA1 81f09865306d8c91d59bbec8a11ac874816f102c
SHA256 dda4aa27c7fd4b793bcadbd94c47dc997d66e293f910af3826de893b0381914a
SHA512 a76fba548576d2c99dac7e040bb140e29a68f55ee024174018345c4236e2a7ebda96d5ed1b66da85ae60d20485847e3cd38d34262be6c45475938f8d2182ab22

memory/2696-55-0x0000000000400000-0x0000000000460000-memory.dmp

\??\c:\Windows\Web\printers\1.reg

MD5 4ad724ba8346d8556e6e884727c0523e
SHA1 b53e2ec83b5b8441667b980fe6a53d69987fca89
SHA256 48c52c0934097cdd0aea155be18a2006f2dd6884d623a51b00baf3e5de3e1412
SHA512 fde2fb90a19fa00d040ade516fef8ca5f4463aee1a8af2fc85f41c3e818365086ff12491c330c8598bf071270bdbd863bbcdb5a5dde3d2523fbd1f6182eb33f3

\??\c:\windows\web\printers\360s.txt

MD5 d3c91ba79104275b8fc182c6e32a7cff
SHA1 094069eacd5d0fb117a40e310beb2b4aa4590420
SHA256 ceae80f544d3ec3ab1211773c601f1ca6eb8319a9e62960bb1fe98ddfbfe0553
SHA512 99cc0918b6029b35dd3a7fbcf8dd50b34c05364e7c4045c5dab7b206f510a95ac428a2fd59137ae1b0279d016f6d6bf0440ae8e5a063b1c32594c070b91a1241

\??\c:\windows\web\printers\zzz.rar

MD5 43f37b9978d9e49e49a0631ac0e6ce73
SHA1 1ee18c506fa9f66fbe0032aaf5474b3d402f2d81
SHA256 433126adae9cd4c985ce970704d4f581fb1c0a3531279c28a89c4f4a7559af3b
SHA512 ac93f47dd5281e3c8345a0062d02bdf55d7b70f49a21729d7f2cafa03cf2909261d6ab4ce2d2eebc2c971964fdccce5736702fc1aab640b76708d5baac1a8477

\??\c:\windows\dell\lsess.txt

MD5 e3c1cea3611ee18e5a552572aca79afa
SHA1 ab192e6c373481e42be63c60f61635fbf73e6c87
SHA256 57d04fde12b8682361f61a731fc413fd1a6e8e30434fb89d4b4755d7783d2462
SHA512 50a9104168b76c9bd79f08f672f9156226ef33e1ba2ece677b06ba544159623f10032b7bae332505598daee5dad17a2bbfb7b1099d7f46ef38f7f0d655433778

memory/2484-67-0x0000000000400000-0x0000000000460000-memory.dmp

memory/2552-78-0x0000000000850000-0x0000000000907000-memory.dmp

\??\c:\Windows\Web\printers\5.reg

MD5 3619b2192d1e0d4907f7d4702b4aa9e1
SHA1 1bb317bea13bb457d9ec71294e5c07c93cc9b8e6
SHA256 7da095327a1e11369d67d4f15d7c2e84cce9fb5d4cbac42d9b70bf0976300893
SHA512 8f2d8420dc2e92a4df42eab89bb612b2562ff6d152c4a6f651c64371089506673bf9f02a37ff1c3ad53a9ae0fe51aa9c47dcdb7e01a319df51306d58a601b7ff

memory/3036-81-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/3036-82-0x0000000000220000-0x0000000000221000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\11a.bat

MD5 1a9684b0cdbceae5e4434fbd91397b17
SHA1 fe71fb9dea1398da3b6563dad519e32672eed153
SHA256 d36c606fa22faeb752cec3528690c6bab9fd536b1a441520597251886c60cc9f
SHA512 7f7255e1825ed44fc579b660d35d0afcff4ec01910d59dcdb3636421afb28080d54cb11d39ac1c7374462e96beff69df973a835cbb589342c1eaea398376eab8

memory/1072-90-0x0000000000400000-0x00000000004DE000-memory.dmp

memory/2552-80-0x0000000000850000-0x0000000000907000-memory.dmp

\Windows\dell\lsess.exe

MD5 b9497541781192767fe5bfc45e7a5604
SHA1 1fb3debd4ba3c0faa922df952eb301ee9efd5b9d
SHA256 408bda25d97117db8319fd51f2c3e94548413ffc2f54b2f944ea056f8eb1930a
SHA512 55ce8ba2d4831cd75cba24e116916669beaa1587540747bfa08fd579392c1a1a3d1733ab32b5383c098f0e7654c79a29a3cbba6148aeb608f07ae066a442a9fc

memory/3036-99-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/3036-101-0x0000000000220000-0x0000000000221000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 16:40

Reported

2024-04-07 16:43

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe"

Signatures

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\windows\web\printers\rar.exe N/A
N/A N/A \??\c:\windows\web\printers\rar.exe N/A
N/A N/A \??\c:\windows\dell\lsess.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnceEx\windows\Entry1 = "c:\\windows\\web\\printers\\123.bat" C:\Windows\SysWOW64\regedit.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\e: C:\Windows\SysWOW64\cmd.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\cmd.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\cmd.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created \??\c:\windows\web\printers\1.reg \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\3.reg \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\360s.txt \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\bb.vbs \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\QQlog.exe \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\ztop\svchost.exe C:\Windows\SysWOW64\cmd.exe N/A
File created \??\c:\windows\web\printers\125.bat C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\web\printers\4.reg \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\bb.vbs \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\k.bat \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\QQlog.exe \??\c:\windows\web\printers\rar.exe N/A
File opened for modification C:\windows\web\printers C:\Windows\SysWOW64\attrib.exe N/A
File created \??\c:\windows\web\printers\abc.vbs \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\gl.txt \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\svc.bat \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\SVCH0ST.ini \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\md5.txt C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification \??\c:\windows\web\printers\rar.exe C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\web\printers\124.bat \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\jinshan.vbs \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\ztop\svchost.exe C:\Windows\SysWOW64\cmd.exe N/A
File created \??\c:\windows\dell\lsess.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification \??\c:\windows\web\printers\1.reg \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\abc.vbs \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\gl.txt \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\usbhard.rar C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe N/A
File created \??\c:\windows\web\printers\5.reg \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\4.reg \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\123.bat \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\jin.vbs \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\svc.bat \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\dell\lsess.txt \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\dell\lsess.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification \??\c:\windows\web\printers\zzz.rar C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe N/A
File created \??\c:\windows\web\printers\3.reg \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\123.bat \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\360s.txt \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\jin.vbs \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\SVCH0ST.ini \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\SVCH0ST.EXE \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\dell\lsess.txt \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\intell\1.txt C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\web\printers\5.reg \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\124.bat \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\jinshan.vbs \??\c:\windows\web\printers\rar.exe N/A
File opened for modification \??\c:\windows\web\printers\k.bat \??\c:\windows\web\printers\rar.exe N/A
File created \??\c:\windows\web\printers\SVCH0ST.EXE \??\c:\windows\web\printers\rar.exe N/A

Enumerates physical storage devices

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A \??\c:\windows\dell\lsess.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1720 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1720 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1720 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 3788 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\web\printers\rar.exe
PID 2240 wrote to memory of 3788 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\web\printers\rar.exe
PID 2240 wrote to memory of 3788 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\web\printers\rar.exe
PID 2240 wrote to memory of 4484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 4484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 4484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 4416 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2240 wrote to memory of 4416 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2240 wrote to memory of 4416 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2240 wrote to memory of 4496 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\web\printers\rar.exe
PID 2240 wrote to memory of 4496 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\web\printers\rar.exe
PID 2240 wrote to memory of 4496 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\web\printers\rar.exe
PID 2240 wrote to memory of 1712 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\dell\lsess.exe
PID 2240 wrote to memory of 1712 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\dell\lsess.exe
PID 2240 wrote to memory of 1712 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\dell\lsess.exe
PID 1720 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1720 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1720 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 3996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2240 wrote to memory of 3996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2240 wrote to memory of 3996 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2196 wrote to memory of 4588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2196 wrote to memory of 4588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2196 wrote to memory of 4588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2240 wrote to memory of 2840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2240 wrote to memory of 2840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2240 wrote to memory of 2840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2196 wrote to memory of 4908 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2196 wrote to memory of 4908 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2196 wrote to memory of 4908 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 5072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 5072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 5072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 2188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 2188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 2188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 4436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 4436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 4436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 4892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 4892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 4892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 8 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 8 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 8 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 4440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 4440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 4440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 4864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 4864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 4864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 4856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 4856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 4856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 2072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 2072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2240 wrote to memory of 2072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\web\printers\125.bat

\??\c:\windows\web\printers\rar.exe

"c:\windows\web\printers\Rar.exe" e -y -ping c:\windows\web\printers\usbhard.rar c:\windows\web\printers\

C:\Windows\SysWOW64\attrib.exe

attrib +R +A +S +H c:\windows\web\printers

C:\Windows\SysWOW64\regedit.exe

regedit /s c:\windows\web\printers\1.reg

\??\c:\windows\web\printers\rar.exe

"c:\windows\web\printers\Rar.exe" e -y -ping c:\windows\web\printers\zzz.rar c:\windows\dell\

\??\c:\windows\dell\lsess.exe

c:\windows\dell\lsess.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\11a.bat

C:\Windows\SysWOW64\regedit.exe

regedit /s c:\windows\web\printers\5.reg

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 3

C:\Windows\SysWOW64\regedit.exe

regedit /s c:\windows\web\printers\2.reg

C:\Windows\SysWOW64\attrib.exe

attrib -S -H c:\ma.exe

C:\Windows\SysWOW64\attrib.exe

attrib -H -R d:\~1

C:\Windows\SysWOW64\attrib.exe

attrib +H +R d:\setprter

C:\Windows\SysWOW64\attrib.exe

attrib -H -R e:\~1

C:\Windows\SysWOW64\attrib.exe

attrib +H +R e:\setprter

C:\Windows\SysWOW64\attrib.exe

attrib -H -R f:\~1

C:\Windows\SysWOW64\attrib.exe

attrib +H +R f:\setprter

C:\Windows\SysWOW64\attrib.exe

attrib -H -R g:\~1

C:\Windows\SysWOW64\attrib.exe

attrib +H +R g:\setprter

C:\Windows\SysWOW64\attrib.exe

attrib -H -R h:\~1

C:\Windows\SysWOW64\attrib.exe

attrib +H +R h:\setprter

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 43.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 he89.3322.org udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 17.143.109.104.in-addr.arpa udp
US 8.8.8.8:53 he89.3322.org udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 he89.3322.org udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 he89.3322.org udp
US 8.8.8.8:53 he89.3322.org udp
US 8.8.8.8:53 120.150.79.40.in-addr.arpa udp

Files

memory/1720-0-0x0000000000400000-0x00000000004DE000-memory.dmp

memory/1720-1-0x00000000001C0000-0x00000000001C3000-memory.dmp

\??\c:\windows\web\printers\125.bat

MD5 1af018ff177dfbae562ac429cff786cb
SHA1 81f09865306d8c91d59bbec8a11ac874816f102c
SHA256 dda4aa27c7fd4b793bcadbd94c47dc997d66e293f910af3826de893b0381914a
SHA512 a76fba548576d2c99dac7e040bb140e29a68f55ee024174018345c4236e2a7ebda96d5ed1b66da85ae60d20485847e3cd38d34262be6c45475938f8d2182ab22

C:\Windows\Web\printers\rar.exe

MD5 0a5680183c0089a64621e211917664d8
SHA1 8525d73c99e28413e97a094c99950e1806786246
SHA256 c7d6bfe9d26d1ecdd9f2e7f3f892a4d32030949937f86938edcb1995655c2814
SHA512 b843b8994c764c3761bef8d34eefb312c9d9567b3f4aadc38008caf42d0cdb82c33276203e4210adcc1e8c567268ebdf01a0a1e839694811932889ac971bb051

\??\c:\windows\web\printers\usbhard.rar

MD5 a0f784ad499c07a7b7c3a48fab5afd0b
SHA1 8194f876410f89d3e4cc9ad1f86c89d1138b0d6c
SHA256 89c23b96ac3837d3ee68ff0684f57e14cee8fc3ac3171d65c173ba6417411335
SHA512 a13b015ec263073ddd2aa5ad116f65f7ae38dc592d6fba9ab2fc3dc034c483d53077c83005b9214cecbf8201a5cd50baea33824136903c0604c5cf6ade2f39de

memory/3788-49-0x0000000000400000-0x0000000000460000-memory.dmp

\??\c:\Windows\Web\printers\1.reg

MD5 4ad724ba8346d8556e6e884727c0523e
SHA1 b53e2ec83b5b8441667b980fe6a53d69987fca89
SHA256 48c52c0934097cdd0aea155be18a2006f2dd6884d623a51b00baf3e5de3e1412
SHA512 fde2fb90a19fa00d040ade516fef8ca5f4463aee1a8af2fc85f41c3e818365086ff12491c330c8598bf071270bdbd863bbcdb5a5dde3d2523fbd1f6182eb33f3

\??\c:\windows\web\printers\360s.txt

MD5 d3c91ba79104275b8fc182c6e32a7cff
SHA1 094069eacd5d0fb117a40e310beb2b4aa4590420
SHA256 ceae80f544d3ec3ab1211773c601f1ca6eb8319a9e62960bb1fe98ddfbfe0553
SHA512 99cc0918b6029b35dd3a7fbcf8dd50b34c05364e7c4045c5dab7b206f510a95ac428a2fd59137ae1b0279d016f6d6bf0440ae8e5a063b1c32594c070b91a1241

\??\c:\windows\web\printers\zzz.rar

MD5 43f37b9978d9e49e49a0631ac0e6ce73
SHA1 1ee18c506fa9f66fbe0032aaf5474b3d402f2d81
SHA256 433126adae9cd4c985ce970704d4f581fb1c0a3531279c28a89c4f4a7559af3b
SHA512 ac93f47dd5281e3c8345a0062d02bdf55d7b70f49a21729d7f2cafa03cf2909261d6ab4ce2d2eebc2c971964fdccce5736702fc1aab640b76708d5baac1a8477

memory/4496-59-0x0000000000400000-0x0000000000460000-memory.dmp

\??\c:\windows\dell\lsess.txt

MD5 e3c1cea3611ee18e5a552572aca79afa
SHA1 ab192e6c373481e42be63c60f61635fbf73e6c87
SHA256 57d04fde12b8682361f61a731fc413fd1a6e8e30434fb89d4b4755d7783d2462
SHA512 50a9104168b76c9bd79f08f672f9156226ef33e1ba2ece677b06ba544159623f10032b7bae332505598daee5dad17a2bbfb7b1099d7f46ef38f7f0d655433778

C:\Windows\dell\lsess.exe

MD5 899ca2b54a11957975db2f3488931b29
SHA1 e5bb0ae61c8c43428e5e431ea929c0cc2b289bea
SHA256 842ed3c90d2ae70b684b8895632b3fc767025ad83106564a461c692fbf77920f
SHA512 80ca235dfd2f4a9f1159b871b449259414a23da6f7257118f77ff9d5512add7129d48a6ca50aa5e860e25969db4359d86d1a9e52ac94a297a5fd936513e1ba7c

memory/1712-66-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1712-67-0x0000000000750000-0x0000000000753000-memory.dmp

memory/1720-70-0x0000000000400000-0x00000000004DE000-memory.dmp

memory/1712-71-0x0000000000770000-0x0000000000771000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\11a.bat

MD5 1a9684b0cdbceae5e4434fbd91397b17
SHA1 fe71fb9dea1398da3b6563dad519e32672eed153
SHA256 d36c606fa22faeb752cec3528690c6bab9fd536b1a441520597251886c60cc9f
SHA512 7f7255e1825ed44fc579b660d35d0afcff4ec01910d59dcdb3636421afb28080d54cb11d39ac1c7374462e96beff69df973a835cbb589342c1eaea398376eab8

\??\c:\Windows\Web\printers\5.reg

MD5 3619b2192d1e0d4907f7d4702b4aa9e1
SHA1 1bb317bea13bb457d9ec71294e5c07c93cc9b8e6
SHA256 7da095327a1e11369d67d4f15d7c2e84cce9fb5d4cbac42d9b70bf0976300893
SHA512 8f2d8420dc2e92a4df42eab89bb612b2562ff6d152c4a6f651c64371089506673bf9f02a37ff1c3ad53a9ae0fe51aa9c47dcdb7e01a319df51306d58a601b7ff

memory/1712-74-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1712-76-0x0000000000750000-0x0000000000753000-memory.dmp

memory/1712-77-0x0000000000770000-0x0000000000771000-memory.dmp

memory/1712-82-0x0000000000400000-0x00000000004B7000-memory.dmp