Malware Analysis Report

2025-08-10 18:07

Sample ID 240507-hnkbeagf25
Target 1fcb27b99fc6fcb9b7f83ccc8904e79c_JaffaCakes118
SHA256 1c1c1ff3561ba6eb1db760de8dca6954d15482f66eae931ab2cf79964315e4db
Tags
upx bootkit persistence spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

1c1c1ff3561ba6eb1db760de8dca6954d15482f66eae931ab2cf79964315e4db

Threat Level: Shows suspicious behavior

The file 1fcb27b99fc6fcb9b7f83ccc8904e79c_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

upx bootkit persistence spyware stealer

ACProtect 1.3x - 1.4x DLL software

UPX packed file

Reads user/profile data of web browsers

Writes to the Master Boot Record (MBR)

Enumerates connected drives

Loads dropped DLL

Executes dropped EXE

Program crash

Enumerates physical storage devices

Unsigned PE

NSIS installer

Checks processor information in registry

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-07 06:52

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-05-07 06:52

Reported

2024-05-07 06:55

Platform

win10v2004-20240419-en

Max time kernel

131s

Max time network

100s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Splasher.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4620 wrote to memory of 2456 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4620 wrote to memory of 2456 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4620 wrote to memory of 2456 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Splasher.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Splasher.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2456 -ip 2456

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 600

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 209.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-05-07 06:52

Reported

2024-05-07 06:55

Platform

win10v2004-20240419-en

Max time kernel

149s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2876 wrote to memory of 532 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2876 wrote to memory of 532 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2876 wrote to memory of 532 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 209.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 215.143.182.52.in-addr.arpa udp

Files

memory/532-0-0x0000000010000000-0x000000001009F000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-05-07 06:52

Reported

2024-05-07 06:55

Platform

win7-20240221-en

Max time kernel

122s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 224

Network

N/A

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-05-07 06:52

Reported

2024-05-07 06:55

Platform

win10v2004-20240419-en

Max time kernel

134s

Max time network

103s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4808 wrote to memory of 3240 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4808 wrote to memory of 3240 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4808 wrote to memory of 3240 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3240 -ip 3240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
GB 23.73.138.75:443 www.bing.com tcp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 75.138.73.23.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 209.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-05-07 06:52

Reported

2024-05-07 06:55

Platform

win7-20240419-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe"

Network

N/A

Files

memory/1960-0-0x0000000000400000-0x0000000000553000-memory.dmp

memory/1960-2-0x0000000000400000-0x0000000000553000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2024-05-07 06:52

Reported

2024-05-07 06:55

Platform

win10v2004-20240419-en

Max time kernel

133s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 139.53.16.96.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 51.15.97.104.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-07 06:52

Reported

2024-05-07 06:55

Platform

win10v2004-20240419-en

Max time kernel

140s

Max time network

116s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1fcb27b99fc6fcb9b7f83ccc8904e79c_JaffaCakes118.exe"

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Extensible Cache C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 376 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\1fcb27b99fc6fcb9b7f83ccc8904e79c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 376 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\1fcb27b99fc6fcb9b7f83ccc8904e79c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 376 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\1fcb27b99fc6fcb9b7f83ccc8904e79c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 3924 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2184 wrote to memory of 4140 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2184 wrote to memory of 4140 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2184 wrote to memory of 4140 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4872 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4872 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4872 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 212 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 212 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 212 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 212 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 212 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 212 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3444 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3444 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3444 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4636 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4636 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4636 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4916 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4916 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4916 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4400 wrote to memory of 3624 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4400 wrote to memory of 3624 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4400 wrote to memory of 3624 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1948 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1948 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1948 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3272 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3272 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3272 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3700 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3700 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3700 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3924 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1fcb27b99fc6fcb9b7f83ccc8904e79c_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1fcb27b99fc6fcb9b7f83ccc8904e79c_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe" "u 'http://www.freeridegames.com/spdo/feeds/sdmConfig?camp=%s&serviceId=143&gameId=%d' p '143' c '751350' m 'freegame001' t '0' l 'Default'"

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UHR

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" HR

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

R

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPR

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PR

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

R

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

ER

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

R

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UHW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" HW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

EW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UHW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" HW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

EW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UHW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" HW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

EW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 www.freeridegames.com udp
US 104.19.183.100:80 www.freeridegames.com tcp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 100.183.19.104.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 142.53.16.96.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 209.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nsx4046.tmp\System.dll

MD5 a436db0c473a087eb61ff5c53c34ba27
SHA1 65ea67e424e75f5065132b539c8b2eda88aa0506
SHA256 75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
SHA512 908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

C:\Users\Admin\AppData\Local\Temp\SDM143\Splasher.dll

MD5 41d94c8eb8cb17e04f8ec6e14132f9ca
SHA1 add92b031eb36b26335763780df88bca58636ed7
SHA256 2e522a4da2c291ebcde484b4a04a6ef0691a732b9db454f12399d3e577327c96
SHA512 0561594d671cc64717463d59e2f076453614584ccdd47b4a39cd347e9999ba63463233c75dd9972102a2634b1abfe6c97fa8f682d944bc5cf129724b7595faa7

C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe

MD5 23cad4075e1fd5d47c0434fef549efde
SHA1 d7cdc7cb933466474986ae37fc7ebefdad601aaf
SHA256 18f4519d20252bf579b887adec25554ac412bd79604547cca12f9f589549f952
SHA512 e4176411caac89db8dd073f2b47b7970168dacad4cdecc6edae310591e279149430b10ab1f956a7722ab22677ca893bfc4eb3fe17009b9b73a95e288c12c89b1

memory/3924-44-0x0000000000400000-0x0000000000553000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SDM143\resourceDll.dll

MD5 5cf0fba9e8775382233c8e63e52c838a
SHA1 b2a092f71eff0f6916652d7f3bfde9204eda5636
SHA256 7d940af8950b106227539cd4bdfb62f2d37a4abeaf568ebe2275fd31058c2ca5
SHA512 73489e3638b98ffd7bd516bfed519cfd48758aaaedc11cb202d11822cad609caf9af95e9e864bd8a992be826945e6d018ce081f3970511fd49d7757ca6affd25

memory/3924-47-0x0000000010000000-0x000000001009F000-memory.dmp

memory/3924-50-0x0000000010000000-0x000000001009F000-memory.dmp

memory/3924-52-0x0000000010000000-0x000000001009F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

MD5 3a9774028e1e3968b8c202fd199d0084
SHA1 6e19763c3f42c8d6596135a7566bef07a0cbeadd
SHA256 93a63465ea363661a141043c404f5b94ab9ac6cfeee3fd158bdf4e1fc50e3af5
SHA512 ea7e67887d7b8fd3e6049ee1ba7a786bb895158279e464c5c7a35e323aefac34e81e5515e493acf447953a08f13b94024c4a460ebc77f03ef0d305feb8b81d06

memory/4140-61-0x0000000000AC0000-0x0000000000AFA000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\ietemp1.dat

MD5 4174cb800274e3c271f7e53ae1b9ae35
SHA1 6ac0ca77eef3b68c8db3349f1ceb0c8083450642
SHA256 d5e0a12b015868fdafdbdcef807fee6bf17e326db04c64079833e829bf34112e
SHA512 c73823299a4706ad1feec4497c1e01c598beebe5679a1bbae2cfa6305b282f719c5c14c1fbc3d982db111cda6cdcc7721f22880391155ae9112f6b5f1cdb7cdd

memory/1368-71-0x0000000000D50000-0x0000000000D8A000-memory.dmp

memory/4508-78-0x0000000000F60000-0x0000000000F9A000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\ietemp1.dat

MD5 87f5eca71be2a37d98959a6632edd40a
SHA1 75637b71a595229e9377bbb9c1c2a5943101718a
SHA256 5af2f1c4cbd0c8d527daea8955e0d3fd60a1bbe6921adee05803a6ab68d97ef9
SHA512 b6f11d02aa00eb12fde933ea2167b4fb7a556bc73534ef8d08bcee808752634ba576b281ec20c8230115fac481e740ba02f82d09d23717e01c30555620fe5015

C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

MD5 f8dcc96b63570b723f10863ff2e605f9
SHA1 4be0ec8bae60830aabecea4f78e2f57754bc6579
SHA256 87e98a14eddbdd8a10a10abf7473c8ba4c93e1016721338a564bf51e9f9c971d
SHA512 66db80487de80992386f9a2aa9d363cb043fdba9dbd41cda0dd032776c88689e0636fffdd7478e5d371211aa5f1246d7b40a91da4168c78bd11de58ecbe75f8e

memory/4472-89-0x00000000009C0000-0x00000000009FA000-memory.dmp

memory/3624-96-0x0000000000D40000-0x0000000000D7A000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\ietemp1.dat

MD5 72148b28ea2f36f69cb3245350fb7542
SHA1 732e0c5ebd3ddf9aad123e1a5d9d9bab6506f14a
SHA256 40d32a9ca25a8d667521748973abed610f9da800ee58bc1cac5b522ad134ece9
SHA512 5165d68c12a735d2680d2b7395842d90f45448f518ef0790118d64a4d2e7d53cd1684a7eacf95aad8bb944cdfe271f1ffcfc2b9943b232f3994f8b80ff5f0adb

memory/760-105-0x0000000000780000-0x00000000007BA000-memory.dmp

memory/5036-117-0x00000000004C0000-0x00000000004FA000-memory.dmp

memory/4072-124-0x00000000007E0000-0x000000000081A000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\Temp\ietemp1.dat

MD5 0723e95ce15bd06a583e5c01e6007491
SHA1 b93c4542bfd7290bd1e4bd1842c863758db7b15e
SHA256 62064d609e38f0dcb44edd0b1b293616928922049cdc8b29a2d9670bb7a26060
SHA512 3d1bea0ff2f250861af52da372bf56e7df72441dc9fa1c7ecec33b39492213620167c30e39d074c4dbd4e1b9ea8b52138ec2e73e01264a9b4832205e541922bf

memory/3924-158-0x0000000000400000-0x0000000000553000-memory.dmp

memory/3924-159-0x0000000010000000-0x000000001009F000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-07 06:52

Reported

2024-05-07 06:55

Platform

win7-20231129-en

Max time kernel

140s

Max time network

118s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 220

Network

N/A

Files

memory/936-1-0x0000000075260000-0x0000000075269000-memory.dmp

memory/936-2-0x0000000075480000-0x0000000075489000-memory.dmp

memory/936-0-0x0000000075480000-0x0000000075489000-memory.dmp

memory/936-3-0x0000000075260000-0x0000000075269000-memory.dmp

memory/936-5-0x0000000075480000-0x0000000075489000-memory.dmp

memory/936-6-0x0000000075480000-0x0000000075489000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-07 06:52

Reported

2024-05-07 06:55

Platform

win10v2004-20240426-en

Max time kernel

140s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 236 wrote to memory of 1536 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 236 wrote to memory of 1536 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 236 wrote to memory of 1536 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1536 -ip 1536

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
GB 23.73.138.122:443 www.bing.com tcp
US 8.8.8.8:53 122.138.73.23.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 36.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/1536-0-0x0000000075390000-0x0000000075399000-memory.dmp

memory/1536-1-0x0000000075390000-0x0000000075399000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-05-07 06:52

Reported

2024-05-07 06:55

Platform

win10v2004-20240419-en

Max time kernel

136s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4872 wrote to memory of 2308 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4872 wrote to memory of 2308 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4872 wrote to memory of 2308 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2308 -ip 2308

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 36.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 209.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-05-07 06:52

Reported

2024-05-07 06:55

Platform

win10v2004-20240419-en

Max time kernel

136s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2792 wrote to memory of 1124 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2792 wrote to memory of 1124 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2792 wrote to memory of 1124 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 209.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp

Files

memory/1124-0-0x0000000010000000-0x0000000010063000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-05-07 06:52

Reported

2024-05-07 06:55

Platform

win7-20240221-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe"

Network

N/A

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-07 06:52

Reported

2024-05-07 06:55

Platform

win7-20240220-en

Max time kernel

142s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1fcb27b99fc6fcb9b7f83ccc8904e79c_JaffaCakes118.exe"

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2784 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\1fcb27b99fc6fcb9b7f83ccc8904e79c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 2784 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\1fcb27b99fc6fcb9b7f83ccc8904e79c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 2784 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\1fcb27b99fc6fcb9b7f83ccc8904e79c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 2784 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\1fcb27b99fc6fcb9b7f83ccc8904e79c_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 2584 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2584 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2584 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2584 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2876 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2876 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2876 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2876 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2584 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2584 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2584 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2584 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2520 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2520 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2520 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2520 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2584 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2584 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2584 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2584 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2584 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2584 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2584 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2584 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2140 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2140 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2140 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2140 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1fcb27b99fc6fcb9b7f83ccc8904e79c_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1fcb27b99fc6fcb9b7f83ccc8904e79c_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe" "u 'http://www.freeridegames.com/spdo/feeds/sdmConfig?camp=%s&serviceId=143&gameId=%d' p '143' c '751350' m 'freegame001' t '0' l 'Default'"

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPR

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PR

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

R

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.freeridegames.com udp
US 104.19.183.100:80 www.freeridegames.com tcp
US 8.8.8.8:53 img.exent.com udp
US 104.16.149.233:80 img.exent.com tcp

Files

\Users\Admin\AppData\Local\Temp\nst1814.tmp\System.dll

MD5 a436db0c473a087eb61ff5c53c34ba27
SHA1 65ea67e424e75f5065132b539c8b2eda88aa0506
SHA256 75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
SHA512 908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

\Users\Admin\AppData\Local\Temp\SDM143\Splasher.dll

MD5 41d94c8eb8cb17e04f8ec6e14132f9ca
SHA1 add92b031eb36b26335763780df88bca58636ed7
SHA256 2e522a4da2c291ebcde484b4a04a6ef0691a732b9db454f12399d3e577327c96
SHA512 0561594d671cc64717463d59e2f076453614584ccdd47b4a39cd347e9999ba63463233c75dd9972102a2634b1abfe6c97fa8f682d944bc5cf129724b7595faa7

\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe

MD5 23cad4075e1fd5d47c0434fef549efde
SHA1 d7cdc7cb933466474986ae37fc7ebefdad601aaf
SHA256 18f4519d20252bf579b887adec25554ac412bd79604547cca12f9f589549f952
SHA512 e4176411caac89db8dd073f2b47b7970168dacad4cdecc6edae310591e279149430b10ab1f956a7722ab22677ca893bfc4eb3fe17009b9b73a95e288c12c89b1

memory/2784-43-0x0000000003770000-0x00000000038C3000-memory.dmp

\Users\Admin\AppData\Local\Temp\SDM143\resourceDll.dll

MD5 5cf0fba9e8775382233c8e63e52c838a
SHA1 b2a092f71eff0f6916652d7f3bfde9204eda5636
SHA256 7d940af8950b106227539cd4bdfb62f2d37a4abeaf568ebe2275fd31058c2ca5
SHA512 73489e3638b98ffd7bd516bfed519cfd48758aaaedc11cb202d11822cad609caf9af95e9e864bd8a992be826945e6d018ce081f3970511fd49d7757ca6affd25

memory/2584-47-0x0000000010000000-0x000000001009F000-memory.dmp

memory/2584-51-0x0000000010000000-0x000000001009F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

MD5 3a9774028e1e3968b8c202fd199d0084
SHA1 6e19763c3f42c8d6596135a7566bef07a0cbeadd
SHA256 93a63465ea363661a141043c404f5b94ab9ac6cfeee3fd158bdf4e1fc50e3af5
SHA512 ea7e67887d7b8fd3e6049ee1ba7a786bb895158279e464c5c7a35e323aefac34e81e5515e493acf447953a08f13b94024c4a460ebc77f03ef0d305feb8b81d06

memory/2344-63-0x00000000001D0000-0x00000000001D2000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

MD5 4174cb800274e3c271f7e53ae1b9ae35
SHA1 6ac0ca77eef3b68c8db3349f1ceb0c8083450642
SHA256 d5e0a12b015868fdafdbdcef807fee6bf17e326db04c64079833e829bf34112e
SHA512 c73823299a4706ad1feec4497c1e01c598beebe5679a1bbae2cfa6305b282f719c5c14c1fbc3d982db111cda6cdcc7721f22880391155ae9112f6b5f1cdb7cdd

memory/2500-73-0x00000000003F0000-0x00000000003F2000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

MD5 f63db0e6e8ac6d8d16baaaed4edc4379
SHA1 301de378cbd76b2fc932ba49f4b25c4e6aa45f25
SHA256 33b4eac7a9ea1ee19695069737cd8998466762aeebad0dc2763f44cb7a70f4cd
SHA512 bccac584412907d7dde82b699c9e84be4e8b90d5c583fa10ebbbdcd1ee2556ed7ec1074430511986e123a7cc127f98af28e6f425db3071d0d63218116c1ff65c

C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

MD5 44f77b0e4505f9a8adf11bdbeace9fa0
SHA1 adb3645e42fa4c41968d92e5a06b274db77d2ea5
SHA256 a6c321dab332711be1049753905578f1c35e6f07f7ef8dabe65d5e70b7df8718
SHA512 63c55efc918ba25052aa4c0c8e80e0212e5655b8c6c78e87acc0546ef4021e3a770435f3dd092d2652e04969b80604a6382096f33def4c64ab3994ba2caed5f0

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\XS4XZB8F.txt

MD5 0af09358886c77a760bc1e625df7ee81
SHA1 bd06bc1a8761c852fa3d98ad70b4d5cb5f115891
SHA256 ace3fcdf98fa0dd576df5da5ed66d68630a29776dbf19b4745e141d4eb51127b
SHA512 45d2c558dbf54db343cc4908fc1fc456780c00d416d57cb2b989bf40cf839818348f0090af6b64a6f546e51d4d97792a4a1b0cf5ebbeecafcb5ad8d06d5c9a2d

C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

MD5 22e69cb2048d3e195435ef7fe77206c1
SHA1 5ce30eeabbf07b8878cfad540c117b802eaf1727
SHA256 441544f83a1171b53b1e6500cc268a6fd12d3d72028252457c372f58648411f5
SHA512 c0d5bc9d5c0ece633e12876cd937ec190d1b9ced4554c64c6a82e543af5714c719853db3b1f20539ab33a67c588f539c8ca551ee1c5050152b5df79142d69adf

memory/2584-151-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2784-153-0x0000000003770000-0x00000000038C3000-memory.dmp

memory/2584-154-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2584-155-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2584-157-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2584-159-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2584-161-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2584-163-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2584-165-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2584-167-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2584-169-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2584-171-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2584-173-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2584-175-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2584-177-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2584-179-0x0000000000400000-0x0000000000553000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-05-07 06:52

Reported

2024-05-07 06:55

Platform

win7-20231129-en

Max time kernel

119s

Max time network

120s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Splasher.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2004 wrote to memory of 2312 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2004 wrote to memory of 2312 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2004 wrote to memory of 2312 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2004 wrote to memory of 2312 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2004 wrote to memory of 2312 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2004 wrote to memory of 2312 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2004 wrote to memory of 2312 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Splasher.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Splasher.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-05-07 06:52

Reported

2024-05-07 06:55

Platform

win7-20240215-en

Max time kernel

120s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1804 wrote to memory of 2156 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1804 wrote to memory of 2156 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1804 wrote to memory of 2156 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1804 wrote to memory of 2156 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1804 wrote to memory of 2156 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1804 wrote to memory of 2156 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1804 wrote to memory of 2156 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1

Network

N/A

Files

memory/2156-0-0x0000000010000000-0x000000001009F000-memory.dmp

memory/2156-1-0x0000000010000000-0x000000001009F000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-05-07 06:52

Reported

2024-05-07 06:55

Platform

win10v2004-20240419-en

Max time kernel

134s

Max time network

102s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 209.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/848-0-0x0000000000400000-0x0000000000553000-memory.dmp

memory/848-2-0x0000000000400000-0x0000000000553000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-05-07 06:52

Reported

2024-05-07 06:55

Platform

win7-20240221-en

Max time kernel

120s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 224

Network

N/A

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-05-07 06:52

Reported

2024-05-07 06:55

Platform

win7-20240220-en

Max time kernel

140s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 232

Network

N/A

Files

memory/2320-1-0x0000000010000000-0x0000000010063000-memory.dmp

memory/2320-0-0x0000000010000000-0x0000000010063000-memory.dmp

memory/2320-2-0x0000000010000000-0x0000000010063000-memory.dmp