Malware Analysis Report

2025-03-15 06:03

Sample ID 240510-16ccmacg2v
Target 314c0ebd520a6431f89af4505f288a66_JaffaCakes118
SHA256 f0231b41ac1add2e3b8f831ccdb2311de4ed1cf9e8d919b51ca7bef4d7c40419
Tags
blackmoon banker trojan vmprotect
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f0231b41ac1add2e3b8f831ccdb2311de4ed1cf9e8d919b51ca7bef4d7c40419

Threat Level: Known bad

The file 314c0ebd520a6431f89af4505f288a66_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

blackmoon banker trojan vmprotect

Detect Blackmoon payload

Blackmoon, KrBanker

Checks computer location settings

VMProtect packed file

Loads dropped DLL

Executes dropped EXE

Deletes itself

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Runs ping.exe

Gathers network information

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-10 22:15

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-10 22:15

Reported

2024-05-10 22:17

Platform

win7-20231129-en

Max time kernel

149s

Max time network

143s

Command Line

C:\Windows\Explorer.EXE

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\utgza.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\94rb3ue.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Doxve32.dll C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\qwton.dll C:\Windows\syswow64\svchost.exe N/A
File created C:\Windows\SysWOW64\hnpon.dll C:\Windows\syswow64\svchost.exe N/A
File created C:\Windows\SysWOW64\onml.dll C:\Windows\syswow64\svchost.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\svchost.exe N/A

Enumerates physical storage devices

Gathers network information

Description Indicator Process Target
N/A N/A C:\windows\SysWOW64\ipconfig.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\syswow64\svchost.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\syswow64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\syswow64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\utgza.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\94rb3ue.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2028 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe C:\Windows\syswow64\svchost.exe
PID 2028 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe C:\Windows\syswow64\svchost.exe
PID 2028 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe C:\Windows\syswow64\svchost.exe
PID 2028 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe C:\Windows\syswow64\svchost.exe
PID 2028 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe C:\Windows\syswow64\svchost.exe
PID 2028 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2028 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2028 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2028 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2796 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2796 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2796 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2752 wrote to memory of 2616 N/A C:\Windows\syswow64\svchost.exe C:\Users\Admin\AppData\Local\Temp\utgza.exe
PID 2752 wrote to memory of 2616 N/A C:\Windows\syswow64\svchost.exe C:\Users\Admin\AppData\Local\Temp\utgza.exe
PID 2752 wrote to memory of 2616 N/A C:\Windows\syswow64\svchost.exe C:\Users\Admin\AppData\Local\Temp\utgza.exe
PID 2752 wrote to memory of 2616 N/A C:\Windows\syswow64\svchost.exe C:\Users\Admin\AppData\Local\Temp\utgza.exe
PID 2752 wrote to memory of 1816 N/A C:\Windows\syswow64\svchost.exe C:\windows\SysWOW64\ipconfig.exe
PID 2752 wrote to memory of 1816 N/A C:\Windows\syswow64\svchost.exe C:\windows\SysWOW64\ipconfig.exe
PID 2752 wrote to memory of 1816 N/A C:\Windows\syswow64\svchost.exe C:\windows\SysWOW64\ipconfig.exe
PID 2752 wrote to memory of 1816 N/A C:\Windows\syswow64\svchost.exe C:\windows\SysWOW64\ipconfig.exe
PID 2616 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\utgza.exe C:\Users\Admin\AppData\Local\Temp\94rb3ue.exe
PID 2616 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\utgza.exe C:\Users\Admin\AppData\Local\Temp\94rb3ue.exe
PID 2616 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\utgza.exe C:\Users\Admin\AppData\Local\Temp\94rb3ue.exe
PID 2616 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\utgza.exe C:\Users\Admin\AppData\Local\Temp\94rb3ue.exe
PID 1160 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\94rb3ue.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe"

C:\Windows\syswow64\svchost.exe

C:\Windows\syswow64\svchost.exe -k LocalFileCaches

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\4001.bat" "

C:\Windows\SysWOW64\PING.EXE

ping 1.0.0.1 -n

C:\Users\Admin\AppData\Local\Temp\utgza.exe

C:\Users\Admin\AppData\Local\Temp\utgza.exe

C:\windows\SysWOW64\ipconfig.exe

/flushdns

C:\Users\Admin\AppData\Local\Temp\94rb3ue.exe

"C:\Users\Admin\AppData\Local\Temp\94rb3ue.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 list.58guyu.com udp
US 8.8.8.8:53 ipaddress.58guyu.com udp
US 8.8.8.8:53 tongji.58guyu.com udp
US 8.8.8.8:53 www.mteng.top udp
US 8.8.8.8:53 2.dsds334.com udp
US 8.8.8.8:53 apps.game.qq.com udp
CN 101.227.134.49:80 apps.game.qq.com tcp
US 8.8.8.8:53 mteng.mmj7.com udp
CN 101.227.134.27:80 apps.game.qq.com tcp
US 8.8.8.8:53 www.mteng.top udp
US 8.8.8.8:53 www.mteng.top udp
US 8.8.8.8:53 www.mteng.top udp
US 8.8.8.8:53 www.mteng.top udp
US 8.8.8.8:53 e2266ed37dade9d4.58su.cn udp
US 8.8.8.8:53 e2266ed37dade9d4.58su.cn udp
US 8.8.8.8:53 e2266ed37dade9d4.58su.cn udp
US 8.8.8.8:53 58.common.58su.cn udp
US 8.8.8.8:53 58.common.58su.cn udp
US 8.8.8.8:53 58.common.58su.cn udp
US 8.8.8.8:53 map.baidu.com udp
HK 103.235.46.82:80 map.baidu.com tcp
US 8.8.8.8:53 z8.cnzz.com udp
CN 36.156.202.70:443 z8.cnzz.com tcp
US 8.8.8.8:53 www.mteng.top udp
US 8.8.8.8:53 1.ghgh775.com udp

Files

memory/2028-0-0x00000000009B0000-0x0000000000D09000-memory.dmp

memory/2752-3-0x0000000000080000-0x0000000000081000-memory.dmp

\Windows\SysWOW64\Doxve32.dll

MD5 2e35797527c224f0409e6ace46b52ad8
SHA1 60171b7f19a655459a26928e311336378c70187b
SHA256 039645c31edd141b7c3f5d236bdb7559e78f2b97813bdd76c949892be658343a
SHA512 f1fc44e531ec39012e8ffbe02a282b57569f29d9b8151751d7d32ec2f80c22d606ad968b63f62fbb0e316aa2e63f0159d671d3fb1cdcbfa4323cba7da204c442

memory/2752-2-0x0000000000080000-0x0000000000081000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4001.bat

MD5 92152fe6aec0d0c2695044b6b9ecffb1
SHA1 10557e97735893fa7640ec4c57ec948e14637620
SHA256 8a745607489806b2f0f67127fccf752e097861d8a6bb15ed7627fe0ee6bc2d84
SHA512 def4a2d8802bcc0c8643f6dd83e54efd6b4702025fff64584a783700da26c6d742aa3b3d655f845b77b29c566300f015e6d91a713d759c2350cddffa390128bb

memory/2028-18-0x00000000009B0000-0x0000000000D09000-memory.dmp

memory/2752-24-0x0000000074D20000-0x0000000074D9D000-memory.dmp

memory/2752-29-0x0000000010000000-0x00000000100A0000-memory.dmp

memory/2752-30-0x0000000010000000-0x00000000100A0000-memory.dmp

\Windows\SysWOW64\onml.dll

MD5 533c576e9622676592ba7cdecd982ffc
SHA1 c8d82cc98d21fee91fed171d4e1754ceb1d55690
SHA256 226c52ccad247ddbe7a5a406c3c07083357a994a0b7aadbe8364af8137524e70
SHA512 0fb671922fa5b9140374beafd3164d9a1a464e3c2b2d292c6455bfad967bbbf4d41ac83541387824bf769939539fc254054932b177b596950e5003d2553fc0d3

\Windows\SysWOW64\hnpon.dll

MD5 6994b4d30d8bb307efefbf46a1f8a769
SHA1 31d27b327fd651bd78ca05c0d15f890d51522882
SHA256 a54b6f59359984bc45a1f8c9fb768d70aa89df251c78d8aabffaef3e7831b6ca
SHA512 37c53a81870600f468023f2e68cd142fbf2581d069973073d72fc8661271996edab3e586e4b451febc8538fd52bd325ff9190465731f25a97ac770cebb191870

memory/2752-33-0x0000000000540000-0x0000000000597000-memory.dmp

memory/2752-25-0x00000000001A0000-0x00000000001A3000-memory.dmp

\Windows\SysWOW64\qwton.dll

MD5 2a18d61af1776e7394920ad72e875f4a
SHA1 3a450945571a09985ddcb30b93a3902d06bf7be7
SHA256 dd80d8e96c5e4cdf9cecc1447a5995ff0eea15f4584df4f8cd9a2281a908ce19
SHA512 85b551b32424a1055e8acec01a065ec8a8936df79e9a3fd243457c582b2fb9c58fdd25a99287c6f242e1fbf6f72c86853ab5d70eb99af8b683d0907814bcb55b

memory/2616-58-0x00000000013A0000-0x00000000013D8000-memory.dmp

memory/2616-59-0x00000000013A0000-0x00000000013D8000-memory.dmp

\Users\Admin\AppData\Local\Temp\t60owyk.dll

MD5 2b1d708d7b7f91693816bcc2982c8026
SHA1 b05e7af14b64e596cf4e3f58bf2eaa36944e1ad5
SHA256 9c7b6e675a78f287d397312a4b1518ad63ca87600229f365de93ccc420faa2c2
SHA512 4880728d44f349b2eb479bf3fe71e5dbc5bab85125337ef470400051d07965654ae28aa19caee2d2d4193632677b577614446f546b1c413bbf61c22432ef5b6d

memory/2616-53-0x0000000010000000-0x0000000010093000-memory.dmp

memory/2616-52-0x0000000010000000-0x0000000010093000-memory.dmp

\Users\Admin\AppData\Local\Temp\jd49dts.dll

MD5 4c79bec47fc84b793f8d040192172be0
SHA1 eb6e96946331f87fb351bac8dd3c4b9dc14bb0d6
SHA256 2c2d53629d7c8dbacf6442bc82aab4a7f0abd288af662baf8576f9ca6aee7fe8
SHA512 8053d76c48f9a701b0bfc103b90731029f48bebcf8295a5593aa2427b53e7919186104bf6d63156037d35f4f62962fed9f05594181c49d75b65ef3d59fbdccbd

\Users\Admin\AppData\Local\Temp\6fafy4l.dll

MD5 81f8e0675d9ff9083f90b70fa17b155e
SHA1 47e8d4f683fb3ccd851e315c5276ef83704abd64
SHA256 f421cbd7f1521246423e85d8f9ea61724a69fb72f1df382a6d348afb58dcb7e6
SHA512 8786783357bf88bd3915a6d3104a94099aaba852a9392bd426a2c673041059b0787baf0668654efe27653d73c5cabe8178dbba7711f9cbf0d369f7abec889068

C:\Users\Admin\AppData\Local\Temp\94rb3ue.exe

MD5 aaa751bfb600e81c2ea1e8277548dab0
SHA1 b3fa454236c8db5c27dfcaa17cfd6c1d3b1e964a
SHA256 01630522218f49ae3e253f937e17fcf76661d0eb54633b372c93bbc268039668
SHA512 4591172ed479ba4d95d94a0dc78f121c18a765fb9dd270813e1b0ca1cad96d658f3f6245f9661109db28fc376f0c3a5d618fc4aa54e3e6064ce47d5bb586f131

C:\Users\Admin\AppData\Local\Temp\ascfgv

MD5 48aa5869fa1604d82016738d443ae274
SHA1 b93ebef756f12f60b6d794ccd659dbfb53e82050
SHA256 882565171518339cb13fd5415998019f789b3ecfc6037370379f8231b636fb81
SHA512 18ef0e097b8bddc4d507e864d9787ac1a3a1fca53ebd4914edb7bb6258a20210ad4141fc1b33b11e3c6f4733096cbcc093a2898e20bdd3efb1d0ed33d07441b7

C:\Users\Admin\AppData\Local\Temp\utgza.exe

MD5 0ecda55bba11531d985331ba1f305df7
SHA1 32f3ad9ec0f42e4dc7941c42d7692a27451c9efa
SHA256 a989f658857dded278159103ce137225ff5f3009fade413191da5662476c0885
SHA512 14059c971890e2a592839c883a286240ec9311cc3b7e893a1a06d6568e1aadea2cfbbd2c722c0cffb3fdc156167498220182526e936f9288b6587d2f5b4d2c6e

C:\Users\Admin\AppData\Local\XbBrowser\User Data\Default\Preferences

MD5 043e7923f4eab953ee0bb05f8c7629ee
SHA1 109485b80493aa42bd703f816224479a4520efb4
SHA256 2a7a698ec8fcc8460bd123f530cf7b74bf8686427a06c4e3c684d6f5b8b8ccce
SHA512 eaf18868da7bd658dfa2af554d552599232e94cb09d506020e38877f98ca018c7545f35876910cc387dd2adc164e77865f1fd934c967c20db79bec68be84ebd8

memory/2752-78-0x0000000074D20000-0x0000000074D9D000-memory.dmp

memory/2752-89-0x00000000001A0000-0x00000000001A3000-memory.dmp

memory/2752-92-0x0000000074D20000-0x0000000074D9D000-memory.dmp

memory/2752-93-0x0000000010000000-0x00000000100A0000-memory.dmp

memory/2616-96-0x0000000010000000-0x0000000010093000-memory.dmp

memory/2616-100-0x00000000013A0000-0x00000000013D8000-memory.dmp

memory/2752-105-0x0000000074D20000-0x0000000074D9D000-memory.dmp

memory/2752-126-0x0000000074D20000-0x0000000074D9D000-memory.dmp

memory/2752-149-0x0000000074D20000-0x0000000074D9D000-memory.dmp

memory/2752-170-0x0000000074D20000-0x0000000074D9D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-10 22:15

Reported

2024-05-10 22:17

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

155s

Command Line

C:\Windows\Explorer.EXE

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\94rb3ue.exe N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Doxve32.dll C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\mhjdb.dll C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Windows\SysWOW64\ipkb.dll C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Windows\SysWOW64\laftk.dll C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Enumerates physical storage devices

Gathers network information

Description Indicator Process Target
N/A N/A C:\windows\SysWOW64\ipconfig.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\94rb3ue.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\94rb3ue.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\94rb3ue.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 116 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 116 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 116 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 116 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe C:\Windows\SysWOW64\svchost.exe
PID 116 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 116 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 116 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 2096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2960 wrote to memory of 2096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2960 wrote to memory of 2096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4864 wrote to memory of 5000 N/A C:\Windows\SysWOW64\svchost.exe C:\Users\Admin\AppData\Local\Temp\trsxm.exe
PID 4864 wrote to memory of 5000 N/A C:\Windows\SysWOW64\svchost.exe C:\Users\Admin\AppData\Local\Temp\trsxm.exe
PID 4864 wrote to memory of 5000 N/A C:\Windows\SysWOW64\svchost.exe C:\Users\Admin\AppData\Local\Temp\trsxm.exe
PID 4864 wrote to memory of 4116 N/A C:\Windows\SysWOW64\svchost.exe C:\windows\SysWOW64\ipconfig.exe
PID 4864 wrote to memory of 4116 N/A C:\Windows\SysWOW64\svchost.exe C:\windows\SysWOW64\ipconfig.exe
PID 4864 wrote to memory of 4116 N/A C:\Windows\SysWOW64\svchost.exe C:\windows\SysWOW64\ipconfig.exe
PID 5000 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe C:\Users\Admin\AppData\Local\Temp\94rb3ue.exe
PID 5000 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\trsxm.exe C:\Users\Admin\AppData\Local\Temp\94rb3ue.exe
PID 2008 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\94rb3ue.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\314c0ebd520a6431f89af4505f288a66_JaffaCakes118.exe"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\syswow64\svchost.exe -k LocalFileCaches

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\719.bat" "

C:\Windows\SysWOW64\PING.EXE

ping 1.0.0.1 -n

C:\Users\Admin\AppData\Local\Temp\trsxm.exe

C:\Users\Admin\AppData\Local\Temp\trsxm.exe

C:\windows\SysWOW64\ipconfig.exe

/flushdns

C:\Users\Admin\AppData\Local\Temp\94rb3ue.exe

"C:\Users\Admin\AppData\Local\Temp\94rb3ue.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 list.58guyu.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 ipaddress.58guyu.com udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.121:443 www.bing.com tcp
US 8.8.8.8:53 tongji.58guyu.com udp
US 8.8.8.8:53 121.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 apps.game.qq.com udp
US 8.8.8.8:53 2.dsds334.com udp
US 8.8.8.8:53 www.mteng.top udp
CN 101.227.134.49:80 apps.game.qq.com tcp
US 8.8.8.8:53 mteng.mmj7.com udp
US 8.8.8.8:53 www.mteng.top udp
US 8.8.8.8:53 www.mteng.top udp
US 8.8.8.8:53 www.mteng.top udp
US 8.8.8.8:53 www.mteng.top udp
US 8.8.8.8:53 e2266ed37dade9d4.58su.cn udp
US 8.8.8.8:53 e2266ed37dade9d4.58su.cn udp
US 8.8.8.8:53 e2266ed37dade9d4.58su.cn udp
US 8.8.8.8:53 2.dsds334.com udp
US 8.8.8.8:53 58.common.58su.cn udp
US 8.8.8.8:53 58.common.58su.cn udp
US 8.8.8.8:53 58.common.58su.cn udp
US 8.8.8.8:53 z8.cnzz.com udp
CN 223.109.148.175:443 z8.cnzz.com tcp
US 8.8.8.8:53 2.dsds334.com udp
CN 101.227.134.27:80 apps.game.qq.com tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 2.dsds334.com udp
US 8.8.8.8:53 map.baidu.com udp
HK 103.235.46.82:80 map.baidu.com tcp
CN 223.109.148.175:443 z8.cnzz.com tcp
US 8.8.8.8:53 82.46.235.103.in-addr.arpa udp
US 8.8.8.8:53 2.dsds334.com udp
US 8.8.8.8:53 www.mteng.top udp
US 8.8.8.8:53 2.dsds334.com udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 2.dsds334.com udp
US 52.111.229.48:443 tcp
US 8.8.8.8:53 2.dsds334.com udp
US 8.8.8.8:53 2.dsds334.com udp
US 8.8.8.8:53 2.dsds334.com udp
US 8.8.8.8:53 1.ghgh775.com udp
US 8.8.8.8:53 1.ghgh775.com udp
US 8.8.8.8:53 1.ghgh775.com udp
US 8.8.8.8:53 udp

Files

memory/116-0-0x0000000000100000-0x0000000000459000-memory.dmp

memory/4864-2-0x0000000000810000-0x0000000000811000-memory.dmp

C:\Windows\SysWOW64\Doxve32.dll

MD5 2e35797527c224f0409e6ace46b52ad8
SHA1 60171b7f19a655459a26928e311336378c70187b
SHA256 039645c31edd141b7c3f5d236bdb7559e78f2b97813bdd76c949892be658343a
SHA512 f1fc44e531ec39012e8ffbe02a282b57569f29d9b8151751d7d32ec2f80c22d606ad968b63f62fbb0e316aa2e63f0159d671d3fb1cdcbfa4323cba7da204c442

memory/116-12-0x0000000000100000-0x0000000000459000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\719.bat

MD5 a21940fb2e694e1d9c7113e3efc40663
SHA1 3b9cf6a2563f778ea27c2911a054dd162f18b3bf
SHA256 914b6d1ea0d0916d22d7f56a7b10fa05479dea0bb560828730624abfcec92b4f
SHA512 7f33615343b32595247000d6df8aed76e0a1d97710336d0ab3ffb2d5548ef7f2c7e65f5a046879f3bb6cd400582b62cd2ce542c1292a6d249294b9d5e8bae749

C:\Windows\SysWOW64\laftk.dll

MD5 6994b4d30d8bb307efefbf46a1f8a769
SHA1 31d27b327fd651bd78ca05c0d15f890d51522882
SHA256 a54b6f59359984bc45a1f8c9fb768d70aa89df251c78d8aabffaef3e7831b6ca
SHA512 37c53a81870600f468023f2e68cd142fbf2581d069973073d72fc8661271996edab3e586e4b451febc8538fd52bd325ff9190465731f25a97ac770cebb191870

C:\Windows\SysWOW64\ipkb.dll

MD5 533c576e9622676592ba7cdecd982ffc
SHA1 c8d82cc98d21fee91fed171d4e1754ceb1d55690
SHA256 226c52ccad247ddbe7a5a406c3c07083357a994a0b7aadbe8364af8137524e70
SHA512 0fb671922fa5b9140374beafd3164d9a1a464e3c2b2d292c6455bfad967bbbf4d41ac83541387824bf769939539fc254054932b177b596950e5003d2553fc0d3

memory/4864-21-0x0000000002B20000-0x0000000002BC0000-memory.dmp

memory/4864-23-0x0000000002B20000-0x0000000002BC0000-memory.dmp

C:\Windows\SysWOW64\mhjdb.dll

MD5 2a18d61af1776e7394920ad72e875f4a
SHA1 3a450945571a09985ddcb30b93a3902d06bf7be7
SHA256 dd80d8e96c5e4cdf9cecc1447a5995ff0eea15f4584df4f8cd9a2281a908ce19
SHA512 85b551b32424a1055e8acec01a065ec8a8936df79e9a3fd243457c582b2fb9c58fdd25a99287c6f242e1fbf6f72c86853ab5d70eb99af8b683d0907814bcb55b

C:\Users\Admin\AppData\Local\Temp\trsxm.exe

MD5 0ecda55bba11531d985331ba1f305df7
SHA1 32f3ad9ec0f42e4dc7941c42d7692a27451c9efa
SHA256 a989f658857dded278159103ce137225ff5f3009fade413191da5662476c0885
SHA512 14059c971890e2a592839c883a286240ec9311cc3b7e893a1a06d6568e1aadea2cfbbd2c722c0cffb3fdc156167498220182526e936f9288b6587d2f5b4d2c6e

memory/4864-32-0x0000000003000000-0x0000000003003000-memory.dmp

memory/4864-31-0x00000000751E0000-0x000000007525D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ascfgv

MD5 48aa5869fa1604d82016738d443ae274
SHA1 b93ebef756f12f60b6d794ccd659dbfb53e82050
SHA256 882565171518339cb13fd5415998019f789b3ecfc6037370379f8231b636fb81
SHA512 18ef0e097b8bddc4d507e864d9787ac1a3a1fca53ebd4914edb7bb6258a20210ad4141fc1b33b11e3c6f4733096cbcc093a2898e20bdd3efb1d0ed33d07441b7

C:\Users\Admin\AppData\Local\Temp\jd49dts.dll

MD5 4c79bec47fc84b793f8d040192172be0
SHA1 eb6e96946331f87fb351bac8dd3c4b9dc14bb0d6
SHA256 2c2d53629d7c8dbacf6442bc82aab4a7f0abd288af662baf8576f9ca6aee7fe8
SHA512 8053d76c48f9a701b0bfc103b90731029f48bebcf8295a5593aa2427b53e7919186104bf6d63156037d35f4f62962fed9f05594181c49d75b65ef3d59fbdccbd

memory/5000-43-0x0000000010000000-0x0000000010093000-memory.dmp

memory/5000-52-0x0000000002E70000-0x0000000002EA8000-memory.dmp

memory/5000-53-0x0000000002E70000-0x0000000002EA8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\t60owyk.dll

MD5 2b1d708d7b7f91693816bcc2982c8026
SHA1 b05e7af14b64e596cf4e3f58bf2eaa36944e1ad5
SHA256 9c7b6e675a78f287d397312a4b1518ad63ca87600229f365de93ccc420faa2c2
SHA512 4880728d44f349b2eb479bf3fe71e5dbc5bab85125337ef470400051d07965654ae28aa19caee2d2d4193632677b577614446f546b1c413bbf61c22432ef5b6d

memory/5000-44-0x0000000010000000-0x0000000010093000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\94rb3ue.exe

MD5 aaa751bfb600e81c2ea1e8277548dab0
SHA1 b3fa454236c8db5c27dfcaa17cfd6c1d3b1e964a
SHA256 01630522218f49ae3e253f937e17fcf76661d0eb54633b372c93bbc268039668
SHA512 4591172ed479ba4d95d94a0dc78f121c18a765fb9dd270813e1b0ca1cad96d658f3f6245f9661109db28fc376f0c3a5d618fc4aa54e3e6064ce47d5bb586f131

C:\Users\Admin\AppData\Local\Temp\6fafy4l.dll

MD5 81f8e0675d9ff9083f90b70fa17b155e
SHA1 47e8d4f683fb3ccd851e315c5276ef83704abd64
SHA256 f421cbd7f1521246423e85d8f9ea61724a69fb72f1df382a6d348afb58dcb7e6
SHA512 8786783357bf88bd3915a6d3104a94099aaba852a9392bd426a2c673041059b0787baf0668654efe27653d73c5cabe8178dbba7711f9cbf0d369f7abec889068

memory/4864-119-0x00000000751E0000-0x000000007525D000-memory.dmp

C:\Users\Admin\AppData\Local\XbBrowser\User Data\Default\Preferences

MD5 043e7923f4eab953ee0bb05f8c7629ee
SHA1 109485b80493aa42bd703f816224479a4520efb4
SHA256 2a7a698ec8fcc8460bd123f530cf7b74bf8686427a06c4e3c684d6f5b8b8ccce
SHA512 eaf18868da7bd658dfa2af554d552599232e94cb09d506020e38877f98ca018c7545f35876910cc387dd2adc164e77865f1fd934c967c20db79bec68be84ebd8

memory/4864-129-0x00000000751E0000-0x000000007525D000-memory.dmp

memory/4864-135-0x0000000002B20000-0x0000000002BC0000-memory.dmp

memory/4864-140-0x00000000751E0000-0x000000007525D000-memory.dmp

memory/5000-141-0x0000000010000000-0x0000000010093000-memory.dmp

memory/5000-145-0x0000000002E70000-0x0000000002EA8000-memory.dmp

memory/4864-165-0x00000000751E0000-0x000000007525D000-memory.dmp

memory/4864-175-0x00000000751E0000-0x000000007525D000-memory.dmp

memory/4864-187-0x00000000751E0000-0x000000007525D000-memory.dmp

memory/4864-263-0x00000000751E0000-0x000000007525D000-memory.dmp