Malware Analysis Report

2025-06-15 20:06

Sample ID 240515-m4wrlaec3s
Target 45dd116e52fb1392286d3eb314f6acd1_JaffaCakes118
SHA256 3c0ad5ebd56e8f848469e5582af02388be4c98d3b34403c21d900112ed23a71b
Tags
upx spyware stealer bootkit persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

3c0ad5ebd56e8f848469e5582af02388be4c98d3b34403c21d900112ed23a71b

Threat Level: Shows suspicious behavior

The file 45dd116e52fb1392286d3eb314f6acd1_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

upx spyware stealer bootkit persistence

Reads user/profile data of web browsers

ACProtect 1.3x - 1.4x DLL software

UPX packed file

Writes to the Master Boot Record (MBR)

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Program crash

Enumerates physical storage devices

Unsigned PE

NSIS installer

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-15 11:01

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-15 11:01

Reported

2024-05-15 11:04

Platform

win10v2004-20240508-en

Max time kernel

125s

Max time network

132s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4788 wrote to memory of 3768 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4788 wrote to memory of 3768 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4788 wrote to memory of 3768 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3768 -ip 3768

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4156,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
BE 88.221.83.218:443 www.bing.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 218.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 28.143.109.104.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

memory/3768-0-0x0000000074BE0000-0x0000000074BE9000-memory.dmp

memory/3768-1-0x0000000074BE0000-0x0000000074BE9000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-05-15 11:01

Reported

2024-05-15 11:04

Platform

win7-20240221-en

Max time kernel

120s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 224

Network

N/A

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-05-15 11:01

Reported

2024-05-15 11:04

Platform

win7-20240220-en

Max time kernel

140s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 232

Network

N/A

Files

memory/2052-0-0x0000000010000000-0x0000000010063000-memory.dmp

memory/2052-1-0x0000000010000000-0x0000000010063000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-05-15 11:01

Reported

2024-05-15 11:04

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 17.143.109.104.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 205.201.50.20.in-addr.arpa udp

Files

memory/4804-0-0x0000000000400000-0x0000000000553000-memory.dmp

memory/4804-3-0x0000000000400000-0x0000000000553000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-05-15 11:01

Reported

2024-05-15 11:04

Platform

win7-20240221-en

Max time kernel

122s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Splasher.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2192 wrote to memory of 1732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2192 wrote to memory of 1732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2192 wrote to memory of 1732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2192 wrote to memory of 1732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2192 wrote to memory of 1732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2192 wrote to memory of 1732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2192 wrote to memory of 1732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Splasher.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Splasher.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-05-15 11:01

Reported

2024-05-15 11:04

Platform

win10v2004-20240426-en

Max time kernel

128s

Max time network

102s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 131.253.33.237:443 g.bing.com tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 237.33.253.131.in-addr.arpa udp
BE 2.17.107.99:443 www.bing.com tcp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
BE 2.17.107.99:443 www.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 99.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 17.143.109.104.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
IE 52.111.236.23:443 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-05-15 11:01

Reported

2024-05-15 11:04

Platform

win7-20240419-en

Max time kernel

121s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2440 wrote to memory of 1852 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2440 wrote to memory of 1852 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2440 wrote to memory of 1852 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2440 wrote to memory of 1852 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2440 wrote to memory of 1852 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2440 wrote to memory of 1852 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2440 wrote to memory of 1852 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1

Network

N/A

Files

memory/1852-0-0x0000000010000000-0x000000001009F000-memory.dmp

memory/1852-1-0x0000000010000000-0x000000001009F000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-15 11:01

Reported

2024-05-15 11:04

Platform

win10v2004-20240508-en

Max time kernel

140s

Max time network

116s

Command Line

"C:\Users\Admin\AppData\Local\Temp\45dd116e52fb1392286d3eb314f6acd1_JaffaCakes118.exe"

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Extensible Cache C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4880 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\45dd116e52fb1392286d3eb314f6acd1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 4880 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\45dd116e52fb1392286d3eb314f6acd1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 4880 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\45dd116e52fb1392286d3eb314f6acd1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 4452 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1636 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1636 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1636 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1000 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1000 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1000 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1576 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1576 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1576 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 408 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 408 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 408 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 680 wrote to memory of 3324 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 680 wrote to memory of 3324 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 680 wrote to memory of 3324 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3600 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3600 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 3600 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4800 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4800 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4800 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2724 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2724 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2724 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4048 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4048 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4048 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 4452 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1484 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

Processes

C:\Users\Admin\AppData\Local\Temp\45dd116e52fb1392286d3eb314f6acd1_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\45dd116e52fb1392286d3eb314f6acd1_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe" "u 'http://www.freeridegames.com/spdo/feeds/sdmConfig?camp=%s&serviceId=143&gameId=%d' p '143' c '523950' m 'freegamecpa002' t '0' l 'Default'"

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UHR

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" HR

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

R

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPR

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PR

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

R

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

ER

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

R

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UHW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" HW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

EW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UHW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" HW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

EW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UHW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" HW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

EW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 131.253.33.237:443 g.bing.com tcp
BE 88.221.83.250:443 www.bing.com tcp
US 8.8.8.8:53 www.freeridegames.com udp
US 104.19.183.100:80 www.freeridegames.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 237.33.253.131.in-addr.arpa udp
US 8.8.8.8:53 250.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 100.183.19.104.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 17.143.109.104.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nsr7252.tmp\System.dll

MD5 a436db0c473a087eb61ff5c53c34ba27
SHA1 65ea67e424e75f5065132b539c8b2eda88aa0506
SHA256 75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
SHA512 908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

C:\Users\Admin\AppData\Local\Temp\SDM143\Splasher.dll

MD5 41d94c8eb8cb17e04f8ec6e14132f9ca
SHA1 add92b031eb36b26335763780df88bca58636ed7
SHA256 2e522a4da2c291ebcde484b4a04a6ef0691a732b9db454f12399d3e577327c96
SHA512 0561594d671cc64717463d59e2f076453614584ccdd47b4a39cd347e9999ba63463233c75dd9972102a2634b1abfe6c97fa8f682d944bc5cf129724b7595faa7

C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe

MD5 23cad4075e1fd5d47c0434fef549efde
SHA1 d7cdc7cb933466474986ae37fc7ebefdad601aaf
SHA256 18f4519d20252bf579b887adec25554ac412bd79604547cca12f9f589549f952
SHA512 e4176411caac89db8dd073f2b47b7970168dacad4cdecc6edae310591e279149430b10ab1f956a7722ab22677ca893bfc4eb3fe17009b9b73a95e288c12c89b1

memory/4452-44-0x0000000000400000-0x0000000000553000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SDM143\resourceDll.dll

MD5 5cf0fba9e8775382233c8e63e52c838a
SHA1 b2a092f71eff0f6916652d7f3bfde9204eda5636
SHA256 7d940af8950b106227539cd4bdfb62f2d37a4abeaf568ebe2275fd31058c2ca5
SHA512 73489e3638b98ffd7bd516bfed519cfd48758aaaedc11cb202d11822cad609caf9af95e9e864bd8a992be826945e6d018ce081f3970511fd49d7757ca6affd25

memory/4452-47-0x0000000010000000-0x000000001009F000-memory.dmp

memory/4452-50-0x0000000010000000-0x000000001009F000-memory.dmp

memory/4452-52-0x0000000010000000-0x000000001009F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

MD5 3a9774028e1e3968b8c202fd199d0084
SHA1 6e19763c3f42c8d6596135a7566bef07a0cbeadd
SHA256 93a63465ea363661a141043c404f5b94ab9ac6cfeee3fd158bdf4e1fc50e3af5
SHA512 ea7e67887d7b8fd3e6049ee1ba7a786bb895158279e464c5c7a35e323aefac34e81e5515e493acf447953a08f13b94024c4a460ebc77f03ef0d305feb8b81d06

memory/3460-60-0x00000000006F0000-0x000000000072A000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\ietemp1.dat

MD5 4174cb800274e3c271f7e53ae1b9ae35
SHA1 6ac0ca77eef3b68c8db3349f1ceb0c8083450642
SHA256 d5e0a12b015868fdafdbdcef807fee6bf17e326db04c64079833e829bf34112e
SHA512 c73823299a4706ad1feec4497c1e01c598beebe5679a1bbae2cfa6305b282f719c5c14c1fbc3d982db111cda6cdcc7721f22880391155ae9112f6b5f1cdb7cdd

memory/2976-71-0x0000000000EB0000-0x0000000000EEA000-memory.dmp

memory/2592-78-0x0000000000FA0000-0x0000000000FDA000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\ietemp1.dat

MD5 5ce713e4a2ef901e3a1d5e34f47e7631
SHA1 9a293c0aafba9599f3764d79ace141b3f38ae5be
SHA256 10ab09d2b5152ff8d8897458eb831d0e44eebf521c8958a6049e137f887c83b1
SHA512 620a36b17fabbd0617078316832e3df4c3cd1b0a4ae58e0017c614423b4b0e0c144d26d6ffe6b17a9759b0a0c3ff1444b00d4fe543537d21b159a078840e55ea

C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

MD5 fb3a188212121e1ac2094abcfae9feb0
SHA1 f62de839a00d360369a6218599a64063a60d067d
SHA256 063fba1a524cd6aa1628198afc8548c1559af8f470acc4c473f3403ecf565d5b
SHA512 5405e055e8442c37451f14f4c9252feefbf7dbc07b836b1b7545a1353cbddf8940bc5147c038b933664de9418f27c5ec9b847b392541ddcb0e3d3d6bebe709ea

memory/2392-89-0x0000000000680000-0x00000000006BA000-memory.dmp

memory/4464-96-0x00000000002F0000-0x000000000032A000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\ietemp1.dat

MD5 bc74eaa586f2c9ca918aaff5106a345a
SHA1 c560c484fce5fc353a61b94cb993521fc704917c
SHA256 7aa1352ef69fd198283104bdc2be672dde0fc2635b1a3d4fface1a4ce92d8cc1
SHA512 e436c56009da0e41d80055ed4bfa939b9439d814e0240ffcd0cfca7193b5acc5852cc7a1bfa4ffe4f9fa1045870ac5d4b75ecd9efe6db90679e9150f95e239ee

C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

MD5 8ca0dbdbc8b73478da3ffc9d231b1157
SHA1 8eafaac899e8ad11ddbf3456016084eabc09b707
SHA256 9b95fdf586d8b33a092fe9c66bf65b15c252d89c076524e9c4ae3850308b92de
SHA512 2299a13648819f6b20b7c0008f3f53c144efe143a2fdca55c3a375b3af97208f6d41209357c99617a3a1ea7f8a9f875ad2738e1c458e906b4e912d722bccb53a

memory/1776-111-0x0000000000C40000-0x0000000000C7A000-memory.dmp

memory/2500-117-0x0000000000010000-0x000000000004A000-memory.dmp

memory/4052-124-0x0000000000780000-0x00000000007BA000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\Temp\ietemp1.dat

MD5 47acc7d90289fff59122a831c7501187
SHA1 39f8f9bd954a4ce4c865df7172674b163e0a0347
SHA256 3b9cf4dbc00dd23a45934c93df0a8ca170bcc34ae8c637a5b87ce30e5cf10d36
SHA512 eb4ffd366cb2d411d576ab7a10366db25994c5e6e80ef54eeeae1fcb9ea47830740653c9da5090ba134a25ac823a9cab43321964f36eb3c7884f31ed1f1bb67e

memory/4452-153-0x0000000000400000-0x0000000000553000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-05-15 11:01

Reported

2024-05-15 11:04

Platform

win10v2004-20240508-en

Max time kernel

93s

Max time network

94s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3584 wrote to memory of 2124 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3584 wrote to memory of 2124 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3584 wrote to memory of 2124 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2124 -ip 2124

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
BE 88.221.83.208:443 www.bing.com tcp
US 8.8.8.8:53 208.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-05-15 11:01

Reported

2024-05-15 11:04

Platform

win7-20240221-en

Max time kernel

120s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 228

Network

N/A

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-05-15 11:01

Reported

2024-05-15 11:04

Platform

win10v2004-20240508-en

Max time kernel

94s

Max time network

97s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1936 wrote to memory of 3508 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1936 wrote to memory of 3508 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1936 wrote to memory of 3508 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3508 -ip 3508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
BE 88.221.83.208:443 www.bing.com tcp
US 8.8.8.8:53 208.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 28.143.109.104.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-15 11:01

Reported

2024-05-15 11:04

Platform

win7-20240508-en

Max time kernel

142s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\45dd116e52fb1392286d3eb314f6acd1_JaffaCakes118.exe"

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2044 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\45dd116e52fb1392286d3eb314f6acd1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 2044 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\45dd116e52fb1392286d3eb314f6acd1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 2044 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\45dd116e52fb1392286d3eb314f6acd1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 2044 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\45dd116e52fb1392286d3eb314f6acd1_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
PID 2644 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2644 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2644 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2644 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1632 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1632 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1632 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1632 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2644 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2644 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2644 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2644 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 620 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 620 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 620 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 620 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2644 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2644 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2644 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2644 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1872 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1872 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1872 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 1872 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2644 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2644 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2644 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2644 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2400 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2400 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2400 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
PID 2400 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

Processes

C:\Users\Admin\AppData\Local\Temp\45dd116e52fb1392286d3eb314f6acd1_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\45dd116e52fb1392286d3eb314f6acd1_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe" "u 'http://www.freeridegames.com/spdo/feeds/sdmConfig?camp=%s&serviceId=143&gameId=%d' p '143' c '523950' m 'freegamecpa002' t '0' l 'Default'"

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPR

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PR

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

R

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

UPW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

W

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.freeridegames.com udp
US 104.19.182.100:80 www.freeridegames.com tcp
US 8.8.8.8:53 img.exent.com udp
US 104.16.149.233:80 img.exent.com tcp

Files

\Users\Admin\AppData\Local\Temp\nsd203E.tmp\System.dll

MD5 a436db0c473a087eb61ff5c53c34ba27
SHA1 65ea67e424e75f5065132b539c8b2eda88aa0506
SHA256 75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
SHA512 908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

\Users\Admin\AppData\Local\Temp\SDM143\Splasher.dll

MD5 41d94c8eb8cb17e04f8ec6e14132f9ca
SHA1 add92b031eb36b26335763780df88bca58636ed7
SHA256 2e522a4da2c291ebcde484b4a04a6ef0691a732b9db454f12399d3e577327c96
SHA512 0561594d671cc64717463d59e2f076453614584ccdd47b4a39cd347e9999ba63463233c75dd9972102a2634b1abfe6c97fa8f682d944bc5cf129724b7595faa7

\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe

MD5 23cad4075e1fd5d47c0434fef549efde
SHA1 d7cdc7cb933466474986ae37fc7ebefdad601aaf
SHA256 18f4519d20252bf579b887adec25554ac412bd79604547cca12f9f589549f952
SHA512 e4176411caac89db8dd073f2b47b7970168dacad4cdecc6edae310591e279149430b10ab1f956a7722ab22677ca893bfc4eb3fe17009b9b73a95e288c12c89b1

memory/2044-44-0x0000000003590000-0x00000000036E3000-memory.dmp

memory/2644-45-0x0000000000400000-0x0000000000553000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SDM143\resourceDll.dll

MD5 5cf0fba9e8775382233c8e63e52c838a
SHA1 b2a092f71eff0f6916652d7f3bfde9204eda5636
SHA256 7d940af8950b106227539cd4bdfb62f2d37a4abeaf568ebe2275fd31058c2ca5
SHA512 73489e3638b98ffd7bd516bfed519cfd48758aaaedc11cb202d11822cad609caf9af95e9e864bd8a992be826945e6d018ce081f3970511fd49d7757ca6affd25

memory/2644-48-0x0000000010000000-0x000000001009F000-memory.dmp

memory/2644-51-0x0000000010000000-0x000000001009F000-memory.dmp

memory/2644-53-0x0000000010000000-0x000000001009F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

MD5 3a9774028e1e3968b8c202fd199d0084
SHA1 6e19763c3f42c8d6596135a7566bef07a0cbeadd
SHA256 93a63465ea363661a141043c404f5b94ab9ac6cfeee3fd158bdf4e1fc50e3af5
SHA512 ea7e67887d7b8fd3e6049ee1ba7a786bb895158279e464c5c7a35e323aefac34e81e5515e493acf447953a08f13b94024c4a460ebc77f03ef0d305feb8b81d06

memory/2996-65-0x00000000002C0000-0x00000000002C2000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

MD5 4174cb800274e3c271f7e53ae1b9ae35
SHA1 6ac0ca77eef3b68c8db3349f1ceb0c8083450642
SHA256 d5e0a12b015868fdafdbdcef807fee6bf17e326db04c64079833e829bf34112e
SHA512 c73823299a4706ad1feec4497c1e01c598beebe5679a1bbae2cfa6305b282f719c5c14c1fbc3d982db111cda6cdcc7721f22880391155ae9112f6b5f1cdb7cdd

memory/2608-75-0x0000000000300000-0x0000000000302000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

MD5 14f327e5d6e5fd90c10bc9e5643d7079
SHA1 0998936414cd8b384c7ea7f530a58dcde19be79e
SHA256 d8b674d9972a5b6ec4fcefce4af03db105b329bfa8fcd41dd61d7345396baec1
SHA512 360432ba7da95b9c7cd93942c4f62c1322232c26ce21f30ae22a10957c974ed5dc65d36a908992915a0837d7ec10a6b9d5e6745548162488871768a2d0acd348

memory/2224-86-0x0000000000480000-0x0000000000482000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

MD5 77aa5b00751e21f30f2e539789a17d12
SHA1 d3030a3a04d08f0b310750ce2928c03751ee8328
SHA256 2d8c136788e85960a253f577f2050ec6aff41027b7dd125fbd99c86f52e44471
SHA512 8054e7a00b9b82f36bef1a0f350222c0a6449335e3f926a895cce25f052f2c57b291bb32539808165d988459dc32942fb5c3463da1c2294d792e5ba47296c846

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\FTVEKH40.txt

MD5 3cf94f85e52b31f8ae911e10694d3b48
SHA1 797044c6dd2fb313eff4b078ad3cadc2c63de64f
SHA256 0bee39a1c0d2512ca2412057d4f40023e8c960c1cebcc18f8bed091c71006f3c
SHA512 2c47b59f25d2d9bdaf50dea54df1d0b67d909fb1d287e663ff9c78f68df7fb0713f81a3d5eca048ed9780dc6c2590ef36211b03c000a46532ccc7baeef85bd46

memory/1540-97-0x0000000001F20000-0x0000000001F22000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

MD5 446d2dd97d848bb144e4e97f4f3746e7
SHA1 d6635fe76f3d4a449107b68d0bf9225a741a4acd
SHA256 fd6665749c3ec550c9ecd6a9f68537234cd0bc114a1d6a9cac5beeea7f8b17b1
SHA512 2168db27077995bea4849b0e56f2f356bc71a1708b168c0f392c5915d0bb52d75dbeb9ee5c061f587426ca8dc10ccf2af46171e83a1b1cf1ebdacac186aa9e8a

memory/2644-153-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2044-155-0x0000000003590000-0x00000000036E3000-memory.dmp

memory/2644-156-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2644-157-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2644-159-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2644-161-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2644-163-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2644-165-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2644-167-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2644-169-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2644-171-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2644-173-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2644-175-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2644-177-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2644-179-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2644-181-0x0000000000400000-0x0000000000553000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-05-15 11:01

Reported

2024-05-15 11:04

Platform

win10v2004-20240508-en

Max time kernel

93s

Max time network

98s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 800 wrote to memory of 2000 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 800 wrote to memory of 2000 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 800 wrote to memory of 2000 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\ExentCtlInstaller.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 28.143.109.104.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

memory/2000-0-0x0000000010000000-0x0000000010063000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-05-15 11:01

Reported

2024-05-15 11:04

Platform

win7-20231129-en

Max time kernel

118s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Free Ride Games.exe"

Network

N/A

Files

memory/2656-0-0x0000000000400000-0x0000000000553000-memory.dmp

memory/2656-2-0x0000000000400000-0x0000000000553000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-05-15 11:01

Reported

2024-05-15 11:04

Platform

win10v2004-20240508-en

Max time kernel

125s

Max time network

130s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Splasher.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2676 wrote to memory of 208 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2676 wrote to memory of 208 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2676 wrote to memory of 208 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Splasher.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\Splasher.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 208 -ip 208

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3792,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 131.253.33.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.33.253.131.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
BE 2.17.107.98:443 www.bing.com tcp
US 8.8.8.8:53 98.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 28.143.109.104.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 24.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-05-15 11:01

Reported

2024-05-15 11:04

Platform

win7-20240508-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\cmhelper.exe"

Network

N/A

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-05-15 11:01

Reported

2024-05-15 11:04

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1164 wrote to memory of 3044 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1164 wrote to memory of 3044 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1164 wrote to memory of 3044 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SDM143\resourceDll.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
BE 88.221.83.185:443 www.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 185.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/3044-0-0x0000000010000000-0x000000001009F000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-15 11:01

Reported

2024-05-15 11:04

Platform

win7-20240221-en

Max time kernel

140s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 220

Network

N/A

Files

memory/2880-2-0x0000000074F50000-0x0000000074F59000-memory.dmp

memory/2880-1-0x0000000074F40000-0x0000000074F49000-memory.dmp

memory/2880-0-0x0000000074F50000-0x0000000074F59000-memory.dmp

memory/2880-3-0x0000000074F40000-0x0000000074F49000-memory.dmp

memory/2880-5-0x0000000074F50000-0x0000000074F59000-memory.dmp

memory/2880-6-0x0000000074F50000-0x0000000074F59000-memory.dmp