Malware Analysis Report

2025-03-15 00:49

Sample ID 240626-hpq6catfpl
Target 11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118
SHA256 99c5b853585f7379184b74c47e5045386e1c0ae3b5f8b865c8de63ca2ce82304
Tags
defense_evasion evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

99c5b853585f7379184b74c47e5045386e1c0ae3b5f8b865c8de63ca2ce82304

Threat Level: Known bad

The file 11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

defense_evasion evasion persistence

Modifies visibility of file extensions in Explorer

Modifies visiblity of hidden/system files in Explorer

Adds policy Run key to start application

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Impair Defenses: Safe Mode Boot

Adds Run key to start application

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Modifies registry class

Suspicious use of WriteProcessMemory

Modifies registry key

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-26 06:55

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-26 06:55

Reported

2024-06-26 06:57

Platform

win7-20240221-en

Max time kernel

120s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\windows\hosts.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\windows\hosts.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\HKULBIBU = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\HKULBIBU = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\HKULBIBU = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A

Impair Defenses: Safe Mode Boot

defense_evasion
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc C:\Windows\SysWOW64\REG.exe N/A
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend C:\Windows\SysWOW64\REG.exe N/A
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power C:\Windows\SysWOW64\REG.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\windows\hosts.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe N/A
File opened for modification C:\Windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
File opened for modification C:\Windows\hosts.exe C:\windows\hosts.exe N/A
File created C:\windows\W_X_C.vbs C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe N/A
File created \??\c:\windows\W_X_C.bat C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
N/A N/A C:\windows\hosts.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2012 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2012 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2012 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2012 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2012 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2012 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2012 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2012 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2604 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2604 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2604 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2604 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2604 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 2604 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 2604 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 2604 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 2520 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2192 wrote to memory of 2520 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2192 wrote to memory of 2520 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2192 wrote to memory of 2520 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2432 wrote to memory of 1504 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2432 wrote to memory of 1504 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2432 wrote to memory of 1504 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2432 wrote to memory of 1504 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2520 wrote to memory of 2528 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2520 wrote to memory of 2528 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2520 wrote to memory of 2528 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2520 wrote to memory of 2528 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2520 wrote to memory of 2760 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2520 wrote to memory of 2760 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2520 wrote to memory of 2760 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2520 wrote to memory of 2760 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 2808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2192 wrote to memory of 2808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2192 wrote to memory of 2808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2192 wrote to memory of 2808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2432 wrote to memory of 2828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2432 wrote to memory of 2828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2432 wrote to memory of 2828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2432 wrote to memory of 2828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2760 wrote to memory of 356 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2760 wrote to memory of 356 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2760 wrote to memory of 356 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2760 wrote to memory of 356 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2760 wrote to memory of 1604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2760 wrote to memory of 1604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2760 wrote to memory of 1604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2760 wrote to memory of 1604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2604 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2604 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2604 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2604 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2520 wrote to memory of 1976 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2520 wrote to memory of 1976 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2520 wrote to memory of 1976 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2520 wrote to memory of 1976 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2604 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2604 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2604 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2604 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe

Processes

C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe"

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\windows\W_X_C.bat

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\windows\W_X_C.bat

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c c:\windows\W_X_C.bat

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\avscan.exe

MD5 e73ff26b8e7da7a11a0e96c55c2ce3df
SHA1 d0855e1cfc4fd2e0768272a508daa1735eac5603
SHA256 18f154b9ffbaed90d3c593c9d6d3b137df75c24fa572fee3cfb0a5662a18ad19
SHA512 05228ba5721d7657c46a7942b6ba135597d2e648d7e47e49393d60f6f4ba2134725e69ee293722e3a97b3d3dee07f49323ab060fe56f02af0d0f5214480ff1f9

C:\Windows\hosts.exe

MD5 41185ea1535161d3d0ab9576b8d68c82
SHA1 a369328e87125edd77eb570c2ec5d4b6307ac40b
SHA256 60cbff972004a277ed1cea8621d38e11b1f19327e8482348c4e8e030dab49602
SHA512 811bb87861cbf6c3c2e915b09177a8d17e0e502a66c1c4347ef589e755599c8b8c852d913d08babfcf8e534e80bd4f7015ae43645852044e3e2f1d474cd0aa3e

\??\c:\windows\W_X_C.bat

MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

C:\Windows\W_X_C.vbs

MD5 48be31f3b385b25234d50fee7d3cdc33
SHA1 c66a6bd8c2b306dc128f837a91c4808cc64f5e9f
SHA256 7b0f52e98dc92ff9a366d43d0140542d480cb44f5beccf0a97be1e871a98fb3c
SHA512 07681e3171b98c67611c6ce7fe565eba5816647040d7f8449262a4f37d2b6ebcb5501a21144878776ec94aaae870d3d561ccceae22346003b7d8b23d57061b44

memory/356-76-0x00000000003B0000-0x00000000003C0000-memory.dmp

memory/356-75-0x00000000003B0000-0x00000000003C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 7ed7daf9f2337d67fd971f0a11273562
SHA1 96378eefc7bcb3c46eb24bbf8dbaa10c69280900
SHA256 cd9b3be8e7ecf02dd2e595a1576a570f6730ab53a2242da65df723c3f60a39a7
SHA512 19a5276e5ba23596d9fb7791276c0b2ff551c809670ba0862347920b1916ecb84fdc9d39600d4fc98589307a2ab7e9d3bb7a288df231eae39da0a11a7ae4a5ef

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 80d8236a9fa1fa937f3c5b939d2a964c
SHA1 97fde985ac8aaa832ec99885ae9e7b69baf80eb8
SHA256 d48362f9bf4c10800ee95e53c0b2dad4954e5f0b2ebd612e5c46fbc0244e567a
SHA512 88bb5d38b8f4d38618c21c436f20c662f8c1dd1c42f4633d44fd90df64991cd315af79ad60bd39bea16c2f0f18919054fcb7f2ed7a58b77da1d66b9a109defcc

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 1009693df752868652f18c0e1321c101
SHA1 a7b5cd2fd562127739b6e92560e7dd84adcf0336
SHA256 5dd440b1016b7fe8f015e37ab59dbf23f47acdda382e5f819678af5d1f544b7f
SHA512 f4e80f85e5aebfc35c5d2f52cb5016614afa71f8553c05a107f8f4fdaa2fd1cc5efedfe4780c2fc5e120f002b33dd53b7ee3e927835036cfd92671fe17def002

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 82daf1bc1d2f6a18a0962b1767c5f234
SHA1 3aed9f54620a55cbf7b6a7dfbe4e0ff21dc6f414
SHA256 3aaed12a8a8b691eb8965e7bc7f4bc6dcb7de32acbf0fa4de64b6cf73cc11eb5
SHA512 7fb4db72314d86516d2b99ce436120ff854907ba8c5269ef50347114f139511a751048599d7172aaa1aee95408c4190690bbae9c5ff1cdc1dd1043d4c0f0fb38

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 39b851ccb9ac93aad8d9b7e6fa8a5bac
SHA1 aed147fe3c8b7dfeae87049506351a445c86015f
SHA256 6611b6a9cfbb372e2a9fafacddc9e081bda8d2c97165dd412f5196173b61224f
SHA512 32363b926112b7504e1a6401baffd75db243fbbb3871a0a60a3f03385a7dc705eb7113bdcc9f0e07ea9422bcca4e5a9827608495f44c7eee5d06e7b674b64e71

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 19b3e25467cf07d6a182990c4ac546b8
SHA1 97e6c86ea088b3ba673c237919123ff925e744b9
SHA256 ad8a724728d83d4c7c5c63d7cca61f23c8c7e62bfd894fe6f7c6eb5fefbcf59e
SHA512 ab81068e07160c8a5e62e7973a1714738e798f326a8a11c77e6dd46fc27d17e3975c216f6355da7b4f8e1f981fa33ded837be3f3998bdbe780a4bde16cc354d6

C:\Users\Admin\AppData\Local\Temp\Admin.bmp

MD5 82d0d8c93999cae86d3891231edf9d8e
SHA1 2c26b2dadb0733565f3402dc497bc6b376cad620
SHA256 901d567fb6f832f36441b9492c5ce98e33918a1721c9704f3ee8b7105d71cfd7
SHA512 fabdcf2d31908fb91e3f64f67870eb3e606b768f566bf9310b2e0dc47f811ebd6c41d0bd1a272aae95c9286540c13b7e575b9bf4a165a94c4cd5cd3ab84c895e

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-26 06:55

Reported

2024-06-26 06:57

Platform

win10v2004-20240611-en

Max time kernel

133s

Max time network

103s

Command Line

"C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\windows\hosts.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\windows\hosts.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ENXQHETB = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ENXQHETB = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ENXQHETB = "W_X_C.bat" C:\Windows\SysWOW64\WScript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\WScript.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A

Impair Defenses: Safe Mode Boot

defense_evasion
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys C:\Windows\SysWOW64\REG.exe N/A
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager C:\Windows\SysWOW64\REG.exe N/A
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc C:\Windows\SysWOW64\REG.exe N/A
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys C:\Windows\SysWOW64\REG.exe N/A
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power C:\Windows\SysWOW64\REG.exe N/A
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc C:\Windows\SysWOW64\REG.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\windows\hosts.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\windows\W_X_C.vbs C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe N/A
File created \??\c:\windows\W_X_C.bat C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe N/A
File opened for modification C:\Windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe N/A
File opened for modification C:\Windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
File opened for modification C:\Windows\hosts.exe C:\windows\hosts.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe N/A
N/A N/A C:\windows\hosts.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5104 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 5104 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 5104 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 5104 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 5104 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 5104 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2272 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2272 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2272 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2272 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 2272 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 2272 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\cmd.exe
PID 5104 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 5104 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 5104 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1580 wrote to memory of 2972 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 1580 wrote to memory of 2972 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 1580 wrote to memory of 2972 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2856 wrote to memory of 2988 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2856 wrote to memory of 2988 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2856 wrote to memory of 2988 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 2988 wrote to memory of 5004 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2988 wrote to memory of 5004 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2988 wrote to memory of 5004 N/A C:\windows\hosts.exe C:\Users\Admin\AppData\Local\Temp\avscan.exe
PID 2988 wrote to memory of 3856 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2988 wrote to memory of 3856 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 2988 wrote to memory of 3856 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\cmd.exe
PID 1580 wrote to memory of 2620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1580 wrote to memory of 2620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1580 wrote to memory of 2620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2856 wrote to memory of 5068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2856 wrote to memory of 5068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2856 wrote to memory of 5068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 3856 wrote to memory of 2744 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 3856 wrote to memory of 2744 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 3856 wrote to memory of 2744 N/A C:\Windows\SysWOW64\cmd.exe C:\windows\hosts.exe
PID 3856 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 3856 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 3856 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2272 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2272 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2272 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2988 wrote to memory of 1392 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2988 wrote to memory of 1392 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2988 wrote to memory of 1392 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2272 wrote to memory of 3524 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2272 wrote to memory of 3524 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2272 wrote to memory of 3524 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2988 wrote to memory of 1796 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2988 wrote to memory of 1796 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2988 wrote to memory of 1796 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2272 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2272 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2272 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2988 wrote to memory of 1416 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2988 wrote to memory of 1416 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2988 wrote to memory of 1416 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2272 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2272 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2272 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\avscan.exe C:\Windows\SysWOW64\REG.exe
PID 2988 wrote to memory of 3344 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2988 wrote to memory of 3344 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe
PID 2988 wrote to memory of 3344 N/A C:\windows\hosts.exe C:\Windows\SysWOW64\REG.exe

Processes

C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\11189010ddee90cc9b7ce3e0e261ff18_JaffaCakes118.exe"

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Users\Admin\AppData\Local\Temp\avscan.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\windows\hosts.exe

C:\windows\hosts.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\avscan.exe

MD5 782e172a80b0ae591620eb533ddcad3b
SHA1 567afac5026a76c9d834cb58e65ca2151db9f73b
SHA256 201762db1ac498ea04a7eb8e45ea22113e9e8eaeff192fe7c7ea12d827240681
SHA512 a914a6e77ea5061ad8e6e5301beb74b012729fa0168fc0963364b0141e93ee3ce31cc0f26ff82de88eba856cd6e32e59c4b7cb5d53c55c1fa060f10938c04549

C:\Windows\hosts.exe

MD5 47fd21c7f4f0d31139255731a3207bce
SHA1 7283c531a6acb84a5cf1819a7907fe8cc37f90fc
SHA256 84b83b9ed47a5cedf18bd49e15518ecae93145af1bf6c6baa09d248564adbe93
SHA512 e0af82e863b78a96d8265bbe11ca34963ff2ac99d21e10ee896e54b0fb163b56e48a2228a47ee7e3057885cdef37d67a8347c2a52be6b96de13cbaeb99a4410b

\??\c:\windows\W_X_C.bat

MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

C:\Windows\W_X_C.vbs

MD5 1037a3f26ea204e975ce9b80057454c9
SHA1 b22c9b474d7e673cf96400addc51c4cc6f539d8b
SHA256 0188d783fbd81cfca2cb417420a1a9855003300a1a6cc4470bbf72684b338e2f
SHA512 f48e76ec3263320f9e7661c14a1315df32e670efe8c8a8a8f8b0a8c26943fd08f65cc2566aac1ac89598b4f0f9127180da5dbf25749accbd142654ecb9c820b3