Malware Analysis Report

2024-09-23 04:22

Sample ID 240620-k2lshatcnm
Target 0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118
SHA256 c9392527cebc3bdd8b1242996ecef59d5812b46e4e1f18dd1402a4bb5d86afcc
Tags
metasploit backdoor persistence trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c9392527cebc3bdd8b1242996ecef59d5812b46e4e1f18dd1402a4bb5d86afcc

Threat Level: Known bad

The file 0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

metasploit backdoor persistence trojan upx

MetaSploit

Checks computer location settings

Executes dropped EXE

UPX packed file

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Runs net.exe

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-20 09:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 09:05

Reported

2024-06-20 09:08

Platform

win7-20240508-en

Max time kernel

141s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe"

Signatures

MetaSploit

trojan backdoor metasploit

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\csrss.exe N/A
N/A N/A C:\Windows\csrss.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Data Serivce = "csrss.exe" C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2228 set thread context of 2456 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe
PID 2924 set thread context of 2264 N/A C:\Windows\csrss.exe C:\Windows\csrss.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\csrss.exe C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe N/A
File opened for modification C:\Windows\csrss.exe C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe N/A

Enumerates physical storage devices

Runs net.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2228 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe
PID 2228 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe
PID 2228 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe
PID 2228 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe
PID 2228 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe
PID 2228 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe
PID 2228 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe
PID 2228 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe
PID 2456 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2456 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2456 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2456 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2456 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Windows\csrss.exe
PID 2456 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Windows\csrss.exe
PID 2456 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Windows\csrss.exe
PID 2456 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Windows\csrss.exe
PID 2732 wrote to memory of 2912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2732 wrote to memory of 2912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2732 wrote to memory of 2912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2732 wrote to memory of 2912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2912 wrote to memory of 2756 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2912 wrote to memory of 2756 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2912 wrote to memory of 2756 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2912 wrote to memory of 2756 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2924 wrote to memory of 2264 N/A C:\Windows\csrss.exe C:\Windows\csrss.exe
PID 2924 wrote to memory of 2264 N/A C:\Windows\csrss.exe C:\Windows\csrss.exe
PID 2924 wrote to memory of 2264 N/A C:\Windows\csrss.exe C:\Windows\csrss.exe
PID 2924 wrote to memory of 2264 N/A C:\Windows\csrss.exe C:\Windows\csrss.exe
PID 2924 wrote to memory of 2264 N/A C:\Windows\csrss.exe C:\Windows\csrss.exe
PID 2924 wrote to memory of 2264 N/A C:\Windows\csrss.exe C:\Windows\csrss.exe
PID 2924 wrote to memory of 2264 N/A C:\Windows\csrss.exe C:\Windows\csrss.exe
PID 2924 wrote to memory of 2264 N/A C:\Windows\csrss.exe C:\Windows\csrss.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\x.bat" "

C:\Windows\csrss.exe

"C:\Windows\csrss.exe"

C:\Windows\SysWOW64\net.exe

net stop "Security Center"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Security Center"

C:\Windows\csrss.exe

"C:\Windows\csrss.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 x.equaldnshost.com udp
US 205.134.246.98:9090 tcp
US 67.247.56.27:9090 tcp
US 173.163.245.113:9090 tcp
US 69.199.121.114:9090 tcp
TR 85.159.70.238:9090 tcp

Files

memory/2456-11-0x0000000000400000-0x000000000045B000-memory.dmp

memory/2456-13-0x0000000000400000-0x000000000045B000-memory.dmp

memory/2456-14-0x0000000000400000-0x000000000045B000-memory.dmp

memory/2456-12-0x0000000000400000-0x000000000045B000-memory.dmp

memory/2456-3-0x0000000000400000-0x000000000045B000-memory.dmp

memory/2456-2-0x0000000000400000-0x000000000045B000-memory.dmp

memory/2228-10-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2456-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2456-5-0x0000000000400000-0x000000000045B000-memory.dmp

memory/2456-0-0x0000000000400000-0x000000000045B000-memory.dmp

C:\x.bat

MD5 e6ed7be2b9572503f07663ca6e53759f
SHA1 7ad80bd38f2a27e06c111b551c76ad0a0585c194
SHA256 b1a6c027d18eb5766129a059f68201e6fb8c68d095f3932983009fe5ae2e4df9
SHA512 e0010782b4fe567290536743375112db3107f8390d4c5cbb97f1bf1a8c83825399e1fe2fe9793d351896bb704f3bdec583fa7241b853b136fa9440a927d94227

C:\Windows\csrss.exe

MD5 0492db9a8d2d844d5cfe3cac7c082dce
SHA1 22d82ce280f0001151838dc3d1b2f8610f8d6405
SHA256 c9392527cebc3bdd8b1242996ecef59d5812b46e4e1f18dd1402a4bb5d86afcc
SHA512 348be577d0362d97bd3c728261dc8d8e88d87cc7946de255c43c6fc0e7dd7bf1a07271b29d80b31220f239c88aaaf2548e2b4efb362fcef1bfb2f0146c32cebc

memory/2456-31-0x0000000000400000-0x000000000045B000-memory.dmp

memory/2924-44-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2264-50-0x0000000000400000-0x000000000045B000-memory.dmp

memory/2264-51-0x0000000000400000-0x000000000045B000-memory.dmp

memory/2264-52-0x0000000000400000-0x000000000045B000-memory.dmp

memory/2264-55-0x0000000000400000-0x000000000045B000-memory.dmp

memory/2264-58-0x0000000000400000-0x000000000045B000-memory.dmp

memory/2264-61-0x0000000000400000-0x000000000045B000-memory.dmp

memory/2264-64-0x0000000000400000-0x000000000045B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 09:05

Reported

2024-06-20 09:08

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe"

Signatures

MetaSploit

trojan backdoor metasploit

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Windows\csrss.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\csrss.exe N/A
N/A N/A C:\Windows\csrss.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Data Serivce = "csrss.exe" C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4708 set thread context of 4764 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe
PID 1384 set thread context of 3832 N/A C:\Windows\csrss.exe C:\Windows\csrss.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\csrss.exe C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe N/A
File opened for modification C:\Windows\csrss.exe C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe N/A

Enumerates physical storage devices

Runs net.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4708 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe
PID 4708 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe
PID 4708 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe
PID 4708 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe
PID 4708 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe
PID 4708 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe
PID 4708 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe
PID 4708 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe
PID 4764 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4764 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4764 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4764 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Windows\csrss.exe
PID 4764 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Windows\csrss.exe
PID 4764 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe C:\Windows\csrss.exe
PID 2256 wrote to memory of 2232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2256 wrote to memory of 2232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2256 wrote to memory of 2232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2232 wrote to memory of 3288 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2232 wrote to memory of 3288 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2232 wrote to memory of 3288 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1384 wrote to memory of 3832 N/A C:\Windows\csrss.exe C:\Windows\csrss.exe
PID 1384 wrote to memory of 3832 N/A C:\Windows\csrss.exe C:\Windows\csrss.exe
PID 1384 wrote to memory of 3832 N/A C:\Windows\csrss.exe C:\Windows\csrss.exe
PID 1384 wrote to memory of 3832 N/A C:\Windows\csrss.exe C:\Windows\csrss.exe
PID 1384 wrote to memory of 3832 N/A C:\Windows\csrss.exe C:\Windows\csrss.exe
PID 1384 wrote to memory of 3832 N/A C:\Windows\csrss.exe C:\Windows\csrss.exe
PID 1384 wrote to memory of 3832 N/A C:\Windows\csrss.exe C:\Windows\csrss.exe
PID 1384 wrote to memory of 3832 N/A C:\Windows\csrss.exe C:\Windows\csrss.exe
PID 3832 wrote to memory of 632 N/A C:\Windows\csrss.exe C:\Windows\SysWOW64\cmd.exe
PID 3832 wrote to memory of 632 N/A C:\Windows\csrss.exe C:\Windows\SysWOW64\cmd.exe
PID 3832 wrote to memory of 632 N/A C:\Windows\csrss.exe C:\Windows\SysWOW64\cmd.exe
PID 632 wrote to memory of 4216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 632 wrote to memory of 4216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 632 wrote to memory of 4216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 4216 wrote to memory of 2276 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4216 wrote to memory of 2276 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4216 wrote to memory of 2276 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0492db9a8d2d844d5cfe3cac7c082dce_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\x.bat" "

C:\Windows\csrss.exe

"C:\Windows\csrss.exe"

C:\Windows\SysWOW64\net.exe

net stop "Security Center"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Security Center"

C:\Windows\csrss.exe

"C:\Windows\csrss.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\x.bat" "

C:\Windows\SysWOW64\net.exe

net stop "Security Center"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Security Center"

Network

Country Destination Domain Proto
US 8.8.8.8:53 x.equaldnshost.com udp
US 205.134.246.98:9090 tcp
US 67.247.56.27:9090 tcp
US 173.163.245.113:9090 tcp
US 69.199.121.114:9090 tcp
TR 85.159.70.238:9090 tcp

Files

memory/4764-1-0x0000000000400000-0x000000000045B000-memory.dmp

memory/4764-0-0x0000000000400000-0x000000000045B000-memory.dmp

memory/4764-7-0x0000000000400000-0x000000000045B000-memory.dmp

memory/4708-9-0x0000000000400000-0x0000000000414000-memory.dmp

memory/4764-8-0x0000000000400000-0x000000000045B000-memory.dmp

memory/4764-6-0x0000000000400000-0x000000000045B000-memory.dmp

memory/4764-5-0x0000000000400000-0x000000000045B000-memory.dmp

memory/4764-2-0x0000000000400000-0x000000000045B000-memory.dmp

C:\Windows\csrss.exe

MD5 0492db9a8d2d844d5cfe3cac7c082dce
SHA1 22d82ce280f0001151838dc3d1b2f8610f8d6405
SHA256 c9392527cebc3bdd8b1242996ecef59d5812b46e4e1f18dd1402a4bb5d86afcc
SHA512 348be577d0362d97bd3c728261dc8d8e88d87cc7946de255c43c6fc0e7dd7bf1a07271b29d80b31220f239c88aaaf2548e2b4efb362fcef1bfb2f0146c32cebc

C:\x.bat

MD5 e6ed7be2b9572503f07663ca6e53759f
SHA1 7ad80bd38f2a27e06c111b551c76ad0a0585c194
SHA256 b1a6c027d18eb5766129a059f68201e6fb8c68d095f3932983009fe5ae2e4df9
SHA512 e0010782b4fe567290536743375112db3107f8390d4c5cbb97f1bf1a8c83825399e1fe2fe9793d351896bb704f3bdec583fa7241b853b136fa9440a927d94227

memory/4764-19-0x0000000000400000-0x000000000045B000-memory.dmp

memory/1384-30-0x0000000000400000-0x0000000000414000-memory.dmp

memory/3832-32-0x0000000000400000-0x000000000045B000-memory.dmp

memory/3832-31-0x0000000000400000-0x000000000045B000-memory.dmp

memory/3832-36-0x0000000000400000-0x000000000045B000-memory.dmp

memory/3832-38-0x0000000000400000-0x000000000045B000-memory.dmp

memory/3832-39-0x0000000000400000-0x000000000045B000-memory.dmp

memory/3832-42-0x0000000000400000-0x000000000045B000-memory.dmp

memory/3832-45-0x0000000000400000-0x000000000045B000-memory.dmp

memory/3832-48-0x0000000000400000-0x000000000045B000-memory.dmp

memory/3832-51-0x0000000000400000-0x000000000045B000-memory.dmp