Malware Analysis Report

2025-03-15 05:42

Sample ID 240509-3hbsasge82
Target 2c3e975d39b604ffae928c681871fc30_JaffaCakes118
SHA256 00f2fbdaef1ce0a4ec71de4c8d857fa8f4bba669d10414880971cf244f42d6e1
Tags
aspackv2 persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

00f2fbdaef1ce0a4ec71de4c8d857fa8f4bba669d10414880971cf244f42d6e1

Threat Level: Known bad

The file 2c3e975d39b604ffae928c681871fc30_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

aspackv2 persistence

Modifies WinLogon for persistence

Adds policy Run key to start application

Modifies Installed Components in the registry

ASPack v2.12-2.42

Deletes itself

Executes dropped EXE

Loads dropped DLL

Modifies WinLogon

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Runs net.exe

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-09 23:30

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-09 23:30

Reported

2024-05-09 23:32

Platform

win7-20240508-en

Max time kernel

149s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" C:\Windows\services.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\services.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" C:\Windows\services.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" C:\Windows\services.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y} C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ C:\Windows\services.exe N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Windows\services.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ C:\Windows\services.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File opened for modification C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File created C:\Windows\SysWOW64\winkey.dll C:\Windows\services.exe N/A
File created C:\Windows\SysWOW64\reginv.dll C:\Windows\services.exe N/A
File created C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe N/A
File created C:\Windows\SysWOW64\fservice.exe C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\fservice.exe C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\system\sservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File created C:\Windows\system\sservice.exe C:\Windows\services.exe N/A
File opened for modification C:\Windows\system\sservice.exe C:\Windows\services.exe N/A
File created C:\Windows\system\sservice.exe C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system\sservice.exe C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe N/A
File created C:\Windows\services.exe C:\Windows\SysWOW64\fservice.exe N/A
File opened for modification C:\Windows\services.exe C:\Windows\SysWOW64\fservice.exe N/A
File created C:\Windows\system\sservice.exe C:\Windows\SysWOW64\fservice.exe N/A

Runs net.exe

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3068 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe C:\Windows\SysWOW64\fservice.exe
PID 3068 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe C:\Windows\SysWOW64\fservice.exe
PID 3068 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe C:\Windows\SysWOW64\fservice.exe
PID 3068 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe C:\Windows\SysWOW64\fservice.exe
PID 1952 wrote to memory of 2360 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe
PID 1952 wrote to memory of 2360 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe
PID 1952 wrote to memory of 2360 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe
PID 1952 wrote to memory of 2360 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe
PID 2360 wrote to memory of 2176 N/A C:\Windows\services.exe C:\Windows\SysWOW64\NET.exe
PID 2360 wrote to memory of 2176 N/A C:\Windows\services.exe C:\Windows\SysWOW64\NET.exe
PID 2360 wrote to memory of 2176 N/A C:\Windows\services.exe C:\Windows\SysWOW64\NET.exe
PID 2360 wrote to memory of 2176 N/A C:\Windows\services.exe C:\Windows\SysWOW64\NET.exe
PID 2176 wrote to memory of 2724 N/A C:\Windows\SysWOW64\NET.exe C:\Windows\SysWOW64\net1.exe
PID 2176 wrote to memory of 2724 N/A C:\Windows\SysWOW64\NET.exe C:\Windows\SysWOW64\net1.exe
PID 2176 wrote to memory of 2724 N/A C:\Windows\SysWOW64\NET.exe C:\Windows\SysWOW64\net1.exe
PID 2176 wrote to memory of 2724 N/A C:\Windows\SysWOW64\NET.exe C:\Windows\SysWOW64\net1.exe
PID 3068 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3068 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3068 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3068 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe"

C:\Windows\SysWOW64\fservice.exe

C:\Windows\system32\fservice.exe

C:\Windows\services.exe

C:\Windows\services.exe -XP

C:\Windows\SysWOW64\NET.exe

NET STOP srservice

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 STOP srservice

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe.bat

Network

Country Destination Domain Proto
US 8.8.8.8:53 you.no-ip.com udp
US 8.8.8.8:53 you.no-ip.com udp
US 8.8.8.8:53 you.no-ip.com udp
US 8.8.8.8:53 www.icq.com udp
US 8.8.8.8:53 www.yoursite.com udp
US 8.8.8.8:53 tcp
US 172.67.156.222:80 www.yoursite.com tcp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta5.am0.yahoodns.net udp
US 67.195.204.72:25 mta5.am0.yahoodns.net tcp
RU 5.61.236.229:80 www.icq.com tcp

Files

memory/3068-0-0x0000000000260000-0x0000000000261000-memory.dmp

\Windows\SysWOW64\fservice.exe

MD5 2c3e975d39b604ffae928c681871fc30
SHA1 f54562a17ad64dc95ad8066e1fb00aab0c51d2d5
SHA256 00f2fbdaef1ce0a4ec71de4c8d857fa8f4bba669d10414880971cf244f42d6e1
SHA512 d5f03b72d6f2b6a7e91ef1b4927cc9eebdec2151a3fbc162b414abbabe6bf6918b088cfee66f9790fc01a61dbe3692c1981c77e6e571b1dbd10bf6f57498aea2

memory/1952-12-0x0000000000260000-0x0000000000261000-memory.dmp

memory/2360-22-0x0000000000360000-0x0000000000361000-memory.dmp

\Windows\SysWOW64\winkey.dll

MD5 b4c72da9fd1a0dcb0698b7da97daa0cd
SHA1 b25a79e8ea4c723c58caab83aed6ea48de7ed759
SHA256 45d266269634ba2de70f179a26d7224111e677e66b38dff2802851b71ce4458f
SHA512 f5f184416c5381d275bc093c9275e9fdb35c58e2c401d188aef097950013de6e43269da5d4dd5e7baea34735bd7de664d15fe487b2292fd66926c9845b0cd066

memory/2360-26-0x0000000010000000-0x000000001000B000-memory.dmp

\Windows\SysWOW64\reginv.dll

MD5 562e0d01d6571fa2251a1e9f54c6cc69
SHA1 83677ad3bc630aa6327253c7b3deffbd4a8ce905
SHA256 c5b1d800c86d550c0b68c57c0d9911c1dd21df9e5e37e9e7bc032b5e66fdebe6
SHA512 166e132432eca24061f7e7d0c58c0b286e971ae2bc50f7c890b7707dd5dede19fcd83a5f79b6fd3f93dd691e07ad9bc1bd05fe82ccaade1610282188571585ea

C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe.bat

MD5 5cfba43939afa0b58aa1d40b60ea6f6e
SHA1 fa7bf929e05da27f228ea0291c88d8d0d7c0a172
SHA256 4d7e8ba2dfaf05e2fa6834b360e02cdefc6f7eb8209153f999103b5410e54777
SHA512 f382f345a74b15d70623007a7528922d7d354442a18c4ad5dac62852ddda58ce6940f5e0fa0e030f39cf7f8ff9f7586ff1ee29a73a1e26c6b68f84c6cb54bacc

memory/1952-34-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/3068-42-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/2360-46-0x0000000010000000-0x000000001000B000-memory.dmp

memory/2360-45-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/2360-49-0x0000000000360000-0x0000000000361000-memory.dmp

memory/2360-47-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/2360-50-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/2360-52-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/2360-54-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/2360-56-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/2360-58-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/2360-60-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/2360-62-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/2360-64-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/2360-66-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/2360-68-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/2360-70-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/2360-72-0x0000000000400000-0x00000000005F8000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-09 23:30

Reported

2024-05-09 23:33

Platform

win10v2004-20240226-en

Max time kernel

152s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" C:\Windows\services.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\services.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" C:\Windows\services.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y} C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ C:\Windows\services.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" C:\Windows\services.exe N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Windows\services.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ C:\Windows\services.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File created C:\Windows\SysWOW64\winkey.dll C:\Windows\services.exe N/A
File created C:\Windows\SysWOW64\reginv.dll C:\Windows\services.exe N/A
File created C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe N/A
File created C:\Windows\SysWOW64\fservice.exe C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\fservice.exe C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\system\sservice.exe C:\Windows\services.exe N/A
File created C:\Windows\system\sservice.exe C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system\sservice.exe C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe N/A
File created C:\Windows\services.exe C:\Windows\SysWOW64\fservice.exe N/A
File opened for modification C:\Windows\services.exe C:\Windows\SysWOW64\fservice.exe N/A
File created C:\Windows\system\sservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File opened for modification C:\Windows\system\sservice.exe C:\Windows\SysWOW64\fservice.exe N/A

Runs net.exe

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3168 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe C:\Windows\SysWOW64\fservice.exe
PID 3168 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe C:\Windows\SysWOW64\fservice.exe
PID 3168 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe C:\Windows\SysWOW64\fservice.exe
PID 1676 wrote to memory of 4908 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe
PID 1676 wrote to memory of 4908 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe
PID 1676 wrote to memory of 4908 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe
PID 4908 wrote to memory of 5024 N/A C:\Windows\services.exe C:\Windows\SysWOW64\NET.exe
PID 4908 wrote to memory of 5024 N/A C:\Windows\services.exe C:\Windows\SysWOW64\NET.exe
PID 4908 wrote to memory of 5024 N/A C:\Windows\services.exe C:\Windows\SysWOW64\NET.exe
PID 5024 wrote to memory of 3892 N/A C:\Windows\SysWOW64\NET.exe C:\Windows\SysWOW64\net1.exe
PID 5024 wrote to memory of 3892 N/A C:\Windows\SysWOW64\NET.exe C:\Windows\SysWOW64\net1.exe
PID 5024 wrote to memory of 3892 N/A C:\Windows\SysWOW64\NET.exe C:\Windows\SysWOW64\net1.exe
PID 3168 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3168 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3168 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe"

C:\Windows\SysWOW64\fservice.exe

C:\Windows\system32\fservice.exe

C:\Windows\services.exe

C:\Windows\services.exe -XP

C:\Windows\SysWOW64\NET.exe

NET STOP srservice

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 STOP srservice

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe.bat

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 you.no-ip.com udp
US 8.8.8.8:53 76.234.34.23.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 www.yoursite.com udp
US 8.8.8.8:53 www.icq.com udp
US 172.67.156.222:80 www.yoursite.com tcp
RU 5.61.236.229:80 www.icq.com tcp
US 8.8.8.8:53 tcp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta7.am0.yahoodns.net udp
US 67.195.228.106:25 mta7.am0.yahoodns.net tcp
US 8.8.8.8:53 229.236.61.5.in-addr.arpa udp
US 8.8.8.8:53 222.156.67.172.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 35.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 200.79.70.13.in-addr.arpa udp

Files

memory/3168-0-0x0000000000910000-0x0000000000911000-memory.dmp

memory/3168-5-0x0000000000400000-0x00000000005F8000-memory.dmp

C:\Windows\SysWOW64\fservice.exe

MD5 2c3e975d39b604ffae928c681871fc30
SHA1 f54562a17ad64dc95ad8066e1fb00aab0c51d2d5
SHA256 00f2fbdaef1ce0a4ec71de4c8d857fa8f4bba669d10414880971cf244f42d6e1
SHA512 d5f03b72d6f2b6a7e91ef1b4927cc9eebdec2151a3fbc162b414abbabe6bf6918b088cfee66f9790fc01a61dbe3692c1981c77e6e571b1dbd10bf6f57498aea2

memory/1676-9-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

memory/4908-18-0x00000000025B0000-0x00000000025B1000-memory.dmp

memory/4908-22-0x0000000010000000-0x000000001000B000-memory.dmp

C:\Windows\SysWOW64\winkey.dll

MD5 b4c72da9fd1a0dcb0698b7da97daa0cd
SHA1 b25a79e8ea4c723c58caab83aed6ea48de7ed759
SHA256 45d266269634ba2de70f179a26d7224111e677e66b38dff2802851b71ce4458f
SHA512 f5f184416c5381d275bc093c9275e9fdb35c58e2c401d188aef097950013de6e43269da5d4dd5e7baea34735bd7de664d15fe487b2292fd66926c9845b0cd066

C:\Windows\SysWOW64\reginv.dll

MD5 562e0d01d6571fa2251a1e9f54c6cc69
SHA1 83677ad3bc630aa6327253c7b3deffbd4a8ce905
SHA256 c5b1d800c86d550c0b68c57c0d9911c1dd21df9e5e37e9e7bc032b5e66fdebe6
SHA512 166e132432eca24061f7e7d0c58c0b286e971ae2bc50f7c890b7707dd5dede19fcd83a5f79b6fd3f93dd691e07ad9bc1bd05fe82ccaade1610282188571585ea

memory/1676-33-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/3168-36-0x0000000000400000-0x00000000005F8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2c3e975d39b604ffae928c681871fc30_JaffaCakes118.exe.bat

MD5 5cfba43939afa0b58aa1d40b60ea6f6e
SHA1 fa7bf929e05da27f228ea0291c88d8d0d7c0a172
SHA256 4d7e8ba2dfaf05e2fa6834b360e02cdefc6f7eb8209153f999103b5410e54777
SHA512 f382f345a74b15d70623007a7528922d7d354442a18c4ad5dac62852ddda58ce6940f5e0fa0e030f39cf7f8ff9f7586ff1ee29a73a1e26c6b68f84c6cb54bacc

memory/4908-38-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/4908-39-0x0000000010000000-0x000000001000B000-memory.dmp

memory/4908-40-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/4908-42-0x00000000025B0000-0x00000000025B1000-memory.dmp

memory/4908-43-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/4908-45-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/4908-47-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/4908-49-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/4908-51-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/4908-53-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/4908-55-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/4908-57-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/4908-59-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/4908-61-0x0000000000400000-0x00000000005F8000-memory.dmp

memory/4908-63-0x0000000000400000-0x00000000005F8000-memory.dmp