Malware Analysis Report

2024-07-28 10:39

Sample ID 240615-17d8lswhka
Target b062439eae5de871d8f6faf27059a53e_JaffaCakes118
SHA256 54567c7740fc01c72d9bac448a6636b657e77c3e43285608b168a19b14e76d6e
Tags
persistence upx google microsoft phishing product:outlook
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

54567c7740fc01c72d9bac448a6636b657e77c3e43285608b168a19b14e76d6e

Threat Level: Known bad

The file b062439eae5de871d8f6faf27059a53e_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

persistence upx google microsoft phishing product:outlook

Detected google phishing page

Detected microsoft outlook phishing page

Executes dropped EXE

UPX packed file

Adds Run key to start application

Drops file in Windows directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-15 22:17

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 22:17

Reported

2024-06-15 22:19

Platform

win7-20240508-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\services.exe C:\Users\Admin\AppData\Local\Temp\b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe N/A
File opened for modification C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe N/A
File created C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2916 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe C:\Windows\services.exe
PID 2916 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe C:\Windows\services.exe
PID 2916 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe C:\Windows\services.exe
PID 2916 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe C:\Windows\services.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

Network

Country Destination Domain Proto
N/A 10.0.0.54:1034 tcp
IN 4.240.75.85:1034 tcp
IN 4.240.75.205:1034 tcp
US 16.23.62.172:1034 tcp
IN 4.240.75.190:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 gzip.org udp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 gzip.org udp
N/A 192.168.3.11:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 gzip.org udp
US 15.244.198.77:1034 tcp
IN 4.240.75.91:1034 tcp
US 8.8.8.8:53 apple.com udp
US 8.8.8.8:53 unicode.org udp

Files

memory/2916-0-0x0000000000500000-0x000000000050D000-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/2380-11-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2916-10-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2916-9-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2380-17-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2380-21-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2916-22-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2916-23-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2380-27-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2380-28-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2380-32-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2380-36-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2380-37-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2380-41-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2380-45-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2380-46-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2380-50-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2380-54-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2380-55-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2380-59-0x0000000000400000-0x0000000000408000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 22:17

Reported

2024-06-15 22:19

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe"

Signatures

Detected google phishing page

phishing google

Detected microsoft outlook phishing page

phishing microsoft product:outlook

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe N/A
File created C:\Windows\services.exe C:\Users\Admin\AppData\Local\Temp\b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe N/A
File opened for modification C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2088 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe C:\Windows\services.exe
PID 2088 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe C:\Windows\services.exe
PID 2088 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe C:\Windows\services.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

Network

Country Destination Domain Proto
N/A 10.0.0.54:1034 tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.107.105:443 www.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 105.107.17.2.in-addr.arpa udp
IN 4.240.75.85:1034 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
IN 4.240.75.205:1034 tcp
US 8.8.8.8:53 m-ou.se udp
US 8.8.8.8:53 alt2.aspmx.l.google.com udp
US 8.8.8.8:53 acm.org udp
FI 142.250.150.27:25 alt2.aspmx.l.google.com tcp
US 8.8.8.8:53 mail.mailroute.net udp
US 199.89.3.120:25 mail.mailroute.net tcp
US 8.8.8.8:53 cs.stanford.edu udp
US 8.8.8.8:53 cs.stanford.edu udp
US 171.64.64.64:25 cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 171.64.64.64:25 cs.stanford.edu tcp
US 8.8.8.8:53 mx.burtleburtle.net udp
US 65.254.254.50:25 mx.burtleburtle.net tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 8.8.8.8:53 gzip.org udp
US 52.101.42.6:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 8.8.8.8:53 gzip.org udp
US 85.187.148.2:25 gzip.org tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 search.yahoo.com udp
IE 212.82.100.137:80 search.yahoo.com tcp
US 8.8.8.8:53 www.altavista.com udp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 137.100.82.212.in-addr.arpa udp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 8.8.8.8:53 eagerm.com udp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 8.8.8.8:53 mx1.mailchannels.net udp
US 54.184.149.106:25 mx1.mailchannels.net tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 8.8.8.8:53 search.lycos.com udp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 8.8.8.8:53 10.254.202.209.in-addr.arpa udp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 r11.o.lencr.org udp
US 16.23.62.172:1034 tcp
BE 2.17.107.153:80 r11.o.lencr.org tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 11.97.55.23.in-addr.arpa udp
US 8.8.8.8:53 153.107.17.2.in-addr.arpa udp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 aspmx3.googlemail.com udp
FI 142.250.150.27:25 aspmx3.googlemail.com tcp
US 8.8.8.8:53 acm.org udp
US 104.17.79.30:25 acm.org tcp
US 8.8.8.8:53 smtp1.cs.stanford.edu udp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 8.8.8.8:53 alumni.caltech.edu udp
US 75.2.70.75:25 alumni.caltech.edu tcp
US 65.254.227.224:25 burtleburtle.net tcp
US 85.187.148.2:25 gzip.org tcp
US 8.8.8.8:53 mx2.mailchannels.net udp
US 35.82.79.123:25 mx2.mailchannels.net tcp
IN 4.240.75.190:1034 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 aspmx5.googlemail.com udp
TW 142.250.157.27:25 aspmx5.googlemail.com tcp
US 8.8.8.8:53 smtp2.cs.stanford.edu udp
US 171.64.64.64:25 cs.stanford.edu tcp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 mx.alumni.caltech.edu udp
US 8.8.8.8:53 mail.alumni.caltech.edu udp
US 65.254.254.50:25 mx.burtleburtle.net tcp
US 8.8.8.8:53 smtp.alumni.caltech.edu udp
US 8.8.8.8:53 mx.gzip.org udp
US 8.8.8.8:53 mail.gzip.org udp
US 85.187.148.2:25 mail.gzip.org tcp
US 8.8.8.8:53 outlook.com udp
US 8.8.8.8:53 outlook-com.olc.protection.outlook.com udp
IE 52.101.68.28:25 outlook-com.olc.protection.outlook.com tcp
US 8.8.8.8:53 eagerm.com udp
US 67.205.31.229:25 eagerm.com tcp
N/A 192.168.3.11:1034 tcp
US 8.8.8.8:53 aspmx4.googlemail.com udp
SG 74.125.200.27:25 aspmx4.googlemail.com tcp
US 171.64.64.64:25 cs.stanford.edu tcp
US 171.64.64.64:25 cs.stanford.edu tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 8.8.8.8:53 hachyderm.io udp
US 8.8.8.8:53 alt1.aspmx.l.google.com udp
IE 212.82.100.137:80 www.altavista.com tcp
NL 142.251.9.27:25 alt1.aspmx.l.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 outlook.com udp
IE 212.82.100.137:80 www.altavista.com tcp
US 52.96.223.2:25 outlook.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
NL 142.251.9.27:25 alt1.aspmx.l.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 lists.stanford.edu udp
US 8.8.8.8:53 mxb-00000d07.gslb.pphosted.com udp
US 67.231.149.169:25 mxb-00000d07.gslb.pphosted.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 15.244.198.77:1034 tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 aspmx.l.google.com udp
US 8.8.8.8:53 mx.cs.stanford.edu udp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
NL 142.250.27.27:25 aspmx.l.google.com tcp
US 8.8.8.8:53 mail.cs.stanford.edu udp
US 171.64.64.160:25 mail.cs.stanford.edu tcp
US 8.8.8.8:53 mail.com udp
US 8.8.8.8:53 mx01.mail.com udp
US 74.208.5.22:25 mx01.mail.com tcp
NL 142.250.27.27:25 aspmx.l.google.com tcp
US 8.8.8.8:53 mx.outlook.com udp
US 8.8.8.8:53 mail.outlook.com udp
US 8.8.8.8:53 smtp.outlook.com udp
GB 52.98.236.114:25 smtp.outlook.com tcp
NL 142.250.27.27:25 aspmx.l.google.com tcp
US 8.8.8.8:53 mxa-00000d07.gslb.pphosted.com udp
US 67.231.149.169:25 mxa-00000d07.gslb.pphosted.com tcp
IN 4.240.75.91:1034 tcp

Files

memory/2088-0-0x0000000000500000-0x000000000050D000-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/2228-6-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2228-13-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2228-17-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2228-21-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2228-22-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2228-26-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 511e6d697ff7949c57e176bab270c425
SHA1 9dabba394817f003d0c623a512b04f65b7eeeebb
SHA256 efd1747c892aa50e4856ca0a5edba8589e6b2964f7cbc634b56765bd8e08b487
SHA512 3a8b6a93a17128d7c99b4e5998134db4e7473f6198c058973e855ab189166f5941119404590f13e98e22ce06f26fb6b9d9ce0e714042c07c70e84fdf22db25f5

C:\Users\Admin\AppData\Local\Temp\tmp1DF3.tmp

MD5 718f4dec80da3cccb0e1f0bb83d27aff
SHA1 d6d26402f1019e088c40c72e4ad9c134a717287a
SHA256 93e0fac0a682e6c3c2c17122a11041d7e534b8688165fed546b79f38e5ad06ae
SHA512 9ae5f701fea35773c3ffff7044c62c0fd2312ca69ae8ed82c8e29388e8afb34665521a42b85efed65945dcac51c145d44f3a7cf00f8d42dc41537a02ad668fc6

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NNUT9QBP\841SM1P8.htm

MD5 61ef1f7fbd9123164f3edfa4255d2da2
SHA1 bf9292b34038a2e9ff5f5c448b2580bd8d56f7e0
SHA256 c7c1f3809ad09b7280c625ca3b45fbf2be88f55524feebe043d9bc31e5c006f7
SHA512 dc1869566d8c51e76149a4dc5f1a5a8ef5adbe0c75638aa5f79e7c302436262b31abc7e80bd7de07b6394291d06d828c4ea9f7f01d7b8b60182811d761c4b263

memory/2228-125-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 f01802392dce0b5c8682c3bca9dafdb9
SHA1 7ff499c562b512e10a7e73414f6d93f22b9b665f
SHA256 bdc0873a865d4bedb30bd5b853005418c5c312f6d54bb26e67b5fef1b1c00187
SHA512 59cee8dd37e35858149d0219b047ce75bf65bda33dfc79d822125639d2f282fbe872ceb8b892037b9d10e0ad731b4773c68282986de5fec0692ef5d4ce3eb06d

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GU2A83AM\search[4].htm

MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUGBEKKF\UYX62YL5.htm

MD5 73c08a115b95198890f575d8371256d8
SHA1 e1a1efb99a0a3cd72d9ac9167ecde434833664bf
SHA256 aee7af560bfa98f583bc028e9eb1ba372598337feb78dd8547072a4d6ba37932
SHA512 53536bf5c892a564d334f3532ce4204763de71b68544980c4c615f416c936f3eca02c90193397f294e6de3c039eea5f8669d87884957e3996208fc4ca9b82250

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QL6D63T0\results[3].htm

MD5 ee4aed56584bf64c08683064e422b722
SHA1 45e5ba33f57c6848e84b66e7e856a6b60af6c4a8
SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
SHA512 058f023cb934a00c8f1c689001438c9bdd067d923ddcbe7a951f54d3ca82218803e0e81fbc9af5c56375ff7961deed0359af1ffa7335d41379ee97d01a76ded6

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NNUT9QBP\search[6].htm

MD5 721d41f93e32834a419e6408c5450996
SHA1 6a52951f167318d868554dccb3fe9066354e36fe
SHA256 6bd2e576fc86ae5aff76bce110ffc987b5edc27eb9931acd228aee116a0f1d37
SHA512 38817e47a194cbabc49b6456185a4bba7e1f8a8e1af2e13b0d52dab994cca8ca792fe6e1c73d57d91337709aed1cc3686adf8cbf639f6c640710a9057cd61c81

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUGBEKKF\search[4].htm

MD5 fb42021454f71553b77128adf63cbcc6
SHA1 5c521317e657bf72fc0d0223de4306fd1a7e3dc0
SHA256 f5ea0c5749073e5a76223c4d37efca787d175e67f2ef786d1c60ddf29b9c86e8
SHA512 9994f552a676e0725a59abddc0c6b8093ce4008c0fad722f62235eaae587b09539fb588f5803e7cdace63c2f0a7529a29f07c5e5d8e9e0ee9bfbbcda6659594b

memory/2228-256-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2228-259-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2228-263-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 78fb8de29e6ca0195c9274d06dd0e2fd
SHA1 acef71da084f778d3aca27c84aa2b46cbe12c254
SHA256 5b705574582a9e3e2c810658d528be29cf78e110c4ef921dcbd193828d16074a
SHA512 5902e93868c83b2948028e3131979b6ba4620ad3947e2b34edd54238c256ee37a7d7678a672590aacc72f229e1438010d3163bc6ba30b8f6dfeb2311efcc390c

memory/2228-278-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2228-281-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 f1f90d9e26ade50373c12f1232a1f854
SHA1 20fd1be3cfe7425b056dff92fc7befd85a13922e
SHA256 9d0cc0df99bf63de4d295bd46992cb1d607ab19afa0f712d1212edcfa1f2cbc7
SHA512 48be7b083b637bd6a11b590af93ffbee97bc7c89ad7bb71010550cc8556ac5596e8f870e93b856b634d3e993f23a609ed4326af8887556c7195496fbe10aa8b2

memory/2228-296-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GU2A83AM\search[7].htm

MD5 9bd69bdfc6e16b61a1efccff74e3d58b
SHA1 13513033ba6384ce8901b1202fea9bd4c1d14d66
SHA256 a15645715b334ad9513687bd30aac2838e3dbe6b00cfaf08d2508d6a8b310c13
SHA512 f3681d41efcbc2beb8d3aeae3734368e2cab36299c5a0e198cc181ad9714d4a4efb7342315fa29493b803582b405b913399fb1e4d38423bd7a729f150ee05cc4

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GU2A83AM\search[9].htm

MD5 56895f84a1ec0957c1793c1f4801feb1
SHA1 44fda5bd6f4538463839112a9ce85566ecfc8d9b
SHA256 cd715166e7556b727a41743c15537f1f00919beecbac1c662dd0e4b3eda9bfbe
SHA512 14973dd1dc8edc659aa1ba49d0cc84a63e1dfc2d3071a96dee264c34e780bddb7f90586256159aa11fbf44794de56a2c6033d6f1bb1fabff6cffac4d64017697

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NNUT9QBP\results[3].htm

MD5 211da0345fa466aa8dbde830c83c19f8
SHA1 779ece4d54a099274b2814a9780000ba49af1b81
SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
SHA512 37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QL6D63T0\search[10].htm

MD5 d6b86afd44324612b513e8201ac83f1a
SHA1 aebb9de705e540faaef1496f4cd68a9caa77ede8
SHA256 7ae2cb87b63eece1b553969b1eb14e86a6395ffc503868f7db8ac96bf8ad6b3c
SHA512 4b7cbd6ce4cec4a61709423a110f9a7c0c482f1ab08736dcf56523fcbe1c4f37d1b9f823a045ccd34307a383d0a2c39e3abb475587474d8c43f58fc2d3c3cc5d

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GU2A83AM\searchERQ8X52Q.htm

MD5 06fb4e42575b9eb014ac71ddacbafbb9
SHA1 0832e336a91abc299270460720b88bfb1e60b7cb
SHA256 d22f0d4d0aee5696fc3a6d83f091f68fc92e9bdcde8a7e9c0ff17255c8e8612a
SHA512 1730e09fa68e8c2b4b3a683c399eb574c89ffc8b580248ddf8f6d4ca249dcf73a4d07597d4fee1a78deff24ee5d0e66a819e374488f74820e9357a24c63e6f7d

memory/2228-398-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2228-401-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 a26b97377a04c2ae84224f477497da55
SHA1 19266f4fff80d331cb2f8c0117086e24765d4d2f
SHA256 ad4404a9f869b45a20966b83cd513d2c7a5ed8309c25c1a1e4fb94a705ede94c
SHA512 85176a42ca94716064b3a23ea15fb8ffe0f143e34e4b110e037d868740782259b5444e8bc834ff0e7196410b08fa2be2f023ac52ebf97a4c8de0ebe0e633e940