Malware Analysis Report

2025-03-15 05:54

Sample ID 240628-ktb84a1bna
Target 19858b70ebbfe39cf239fe3f69fce9a6_JaffaCakes118
SHA256 6323a76824ed5dc42e961bae1eb1f6e5f32872e2e1463da464abf9acf075c679
Tags
persistence upx vmprotect
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6323a76824ed5dc42e961bae1eb1f6e5f32872e2e1463da464abf9acf075c679

Threat Level: Known bad

The file 19858b70ebbfe39cf239fe3f69fce9a6_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

persistence upx vmprotect

Modifies WinLogon for persistence

Executes dropped EXE

Loads dropped DLL

UPX packed file

VMProtect packed file

Checks computer location settings

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-28 08:53

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-28 08:53

Reported

2024-06-28 08:55

Platform

win7-20240221-en

Max time kernel

150s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\19858b70ebbfe39cf239fe3f69fce9a6_JaffaCakes118.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe,rundll32.exe c:\\Progra~1\\mhzx\\tlmhzx1122.dll Start," C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\temp.dat C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe N/A
File created C:\program files\common files\microsoft shared\msinfo\δÃüÃû.jpg C:\Users\Admin\AppData\Local\Temp\19858b70ebbfe39cf239fe3f69fce9a6_JaffaCakes118.exe N/A
File created C:\Program Files\tlmhzx.dat C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe N/A
File created C:\Program Files\mhzx\tlmhzx1122.dll C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe N/A
File created C:\Program Files\tlmhzx2.dat C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe N/A
File opened for modification C:\program files\common files\microsoft shared\msinfo\δÃüÃû.jpg C:\Windows\SysWOW64\DllHost.exe N/A
File created C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).jpg C:\Users\Admin\AppData\Local\Temp\19858b70ebbfe39cf239fe3f69fce9a6_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\tlmhzx.dat C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe N/A
File opened for modification C:\Program Files\tlmhzx2.dat C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\DllHost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2156 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\19858b70ebbfe39cf239fe3f69fce9a6_JaffaCakes118.exe C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe
PID 2156 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\19858b70ebbfe39cf239fe3f69fce9a6_JaffaCakes118.exe C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe
PID 2156 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\19858b70ebbfe39cf239fe3f69fce9a6_JaffaCakes118.exe C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe
PID 2156 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\19858b70ebbfe39cf239fe3f69fce9a6_JaffaCakes118.exe C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe
PID 2156 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\19858b70ebbfe39cf239fe3f69fce9a6_JaffaCakes118.exe C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe
PID 2156 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\19858b70ebbfe39cf239fe3f69fce9a6_JaffaCakes118.exe C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe
PID 2156 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\19858b70ebbfe39cf239fe3f69fce9a6_JaffaCakes118.exe C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe
PID 1796 wrote to memory of 2788 N/A C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe C:\Windows\SysWOW64\rundll32.exe
PID 1796 wrote to memory of 2788 N/A C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe C:\Windows\SysWOW64\rundll32.exe
PID 1796 wrote to memory of 2788 N/A C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe C:\Windows\SysWOW64\rundll32.exe
PID 1796 wrote to memory of 2788 N/A C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe C:\Windows\SysWOW64\rundll32.exe
PID 1796 wrote to memory of 2788 N/A C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe C:\Windows\SysWOW64\rundll32.exe
PID 1796 wrote to memory of 2788 N/A C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe C:\Windows\SysWOW64\rundll32.exe
PID 1796 wrote to memory of 2788 N/A C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\19858b70ebbfe39cf239fe3f69fce9a6_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\19858b70ebbfe39cf239fe3f69fce9a6_JaffaCakes118.exe"

C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe

"C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe"

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\system32\rundll32.exe c:\Progra~1\mhzx\tlmhzx1122.dll Start

Network

N/A

Files

C:\Program Files\temp.dat

MD5 1cc9a6b5af84ba5f4bcd3e4802d03164
SHA1 42da72826509eb4fe270ef00f212e03f549f20e7
SHA256 00cce476a88900210f2bf4a873013d36b47bb615d84a634bee070a24579a5f9c
SHA512 ec6c7ed7452585825c0fe7910d0f770a265937af2e0874e7e44c3d48b2dbb5a7afbf32253e006f3c370040dae1e1e67a89e96f82ab93e9e788f7a72a70c5ad36

C:\program files\common files\microsoft shared\msinfo\δÃüÃû.jpg

MD5 b1636e48438e1e62dc8bc8f90c83bef7
SHA1 92310e762754cf87dd9e43f1c9426859f0cf45ea
SHA256 3a0eaf06672079244ed9226f014cd8e0068ae7a32a89e2f5e6c735a056f6d168
SHA512 e619c4000b1cf884701f8663d1bbddeba79ecd6b685cf9e08c75387f5429618c18d0fc0a04d1558fa0944ec4831cb5f015a21a8000f1327bdef7fa066b713e3e

memory/2788-36-0x0000000010000000-0x000000001000E000-memory.dmp

\PROGRA~1\mhzx\tlmhzx1122.dll

MD5 0a2fcb43f182638b9ef231fdf26294ed
SHA1 d069998691bb8115c2694f5b383da902f729f42d
SHA256 f7360bc058c2e636505a71ad2bacb63e4f169de72164b0bcc9cbf750360e76f5
SHA512 551a3993e68399fde78b21fd500513a242c1bc7c79211f22596aa8c79484a6b8658bb17c9459a42332a9626c9c9a99a1e73242245c3d58a638a5172d8ec58a61

memory/2156-31-0x0000000000400000-0x0000000000420000-memory.dmp

memory/1584-29-0x0000000000220000-0x0000000000222000-memory.dmp

memory/2156-28-0x0000000000480000-0x0000000000482000-memory.dmp

memory/1796-27-0x0000000000400000-0x0000000000414000-memory.dmp

memory/1796-19-0x0000000000020000-0x0000000000034000-memory.dmp

memory/1796-17-0x0000000000020000-0x0000000000034000-memory.dmp

memory/1796-18-0x0000000000020000-0x0000000000034000-memory.dmp

\Program Files\Common Files\Microsoft Shared\MSInfo\QvodSetup2(1).exe

MD5 dc4a8fba40af1da5c392b2af1402a461
SHA1 332478d5a20f25b7ccc8a85e5e6c859678c1073f
SHA256 1dcb304168b13af7a5a9a79691fe505ed88b1313f4703fa46fec1ca19817a2d5
SHA512 f08b9c5bac75639d375464693018067a49ddef95218ad11ba898dab082f619a4ff25919d728e8621800c8c20245699dd90ff86c36bb85133c8b62a99c0332b60

memory/1796-12-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2156-10-0x0000000000460000-0x0000000000474000-memory.dmp

memory/2156-4-0x0000000000460000-0x0000000000470000-memory.dmp

memory/2156-2-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2788-39-0x0000000010000000-0x000000001000E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-28 08:53

Reported

2024-06-28 08:55

Platform

win10v2004-20240226-en

Max time kernel

151s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\19858b70ebbfe39cf239fe3f69fce9a6_JaffaCakes118.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe,rundll32.exe c:\\Progra~1\\mhzx\\tlmhzx1122.dll Start," C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\19858b70ebbfe39cf239fe3f69fce9a6_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\temp.dat C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe N/A
File created C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).jpg C:\Users\Admin\AppData\Local\Temp\19858b70ebbfe39cf239fe3f69fce9a6_JaffaCakes118.exe N/A
File created C:\program files\common files\microsoft shared\msinfo\δÃüÃû.jpg C:\Users\Admin\AppData\Local\Temp\19858b70ebbfe39cf239fe3f69fce9a6_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\tlmhzx.dat C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe N/A
File created C:\Program Files\tlmhzx.dat C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe N/A
File opened for modification C:\Program Files\tlmhzx2.dat C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe N/A
File created C:\Program Files\tlmhzx2.dat C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe N/A
File created C:\Program Files\mhzx\tlmhzx1122.dll C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe N/A
N/A N/A C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\19858b70ebbfe39cf239fe3f69fce9a6_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\19858b70ebbfe39cf239fe3f69fce9a6_JaffaCakes118.exe"

C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe

"C:\program files\common files\microsoft shared\msinfo\QvodSetup2(1).exe"

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\system32\rundll32.exe c:\Progra~1\mhzx\tlmhzx1122.dll Start

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3704 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 215.143.182.52.in-addr.arpa udp

Files

memory/3148-0-0x0000000000400000-0x0000000000420000-memory.dmp

C:\Program Files\Common Files\microsoft shared\MSInfo\QvodSetup2(1).exe

MD5 dc4a8fba40af1da5c392b2af1402a461
SHA1 332478d5a20f25b7ccc8a85e5e6c859678c1073f
SHA256 1dcb304168b13af7a5a9a79691fe505ed88b1313f4703fa46fec1ca19817a2d5
SHA512 f08b9c5bac75639d375464693018067a49ddef95218ad11ba898dab082f619a4ff25919d728e8621800c8c20245699dd90ff86c36bb85133c8b62a99c0332b60

memory/3412-12-0x0000000000400000-0x0000000000414000-memory.dmp

memory/3148-13-0x0000000000400000-0x0000000000420000-memory.dmp

memory/3412-21-0x0000000000400000-0x0000000000414000-memory.dmp

\??\c:\Progra~1\mhzx\tlmhzx1122.dll

MD5 0a2fcb43f182638b9ef231fdf26294ed
SHA1 d069998691bb8115c2694f5b383da902f729f42d
SHA256 f7360bc058c2e636505a71ad2bacb63e4f169de72164b0bcc9cbf750360e76f5
SHA512 551a3993e68399fde78b21fd500513a242c1bc7c79211f22596aa8c79484a6b8658bb17c9459a42332a9626c9c9a99a1e73242245c3d58a638a5172d8ec58a61

memory/1724-24-0x0000000010000000-0x000000001000E000-memory.dmp

C:\Program Files\temp.dat

MD5 1cc9a6b5af84ba5f4bcd3e4802d03164
SHA1 42da72826509eb4fe270ef00f212e03f549f20e7
SHA256 00cce476a88900210f2bf4a873013d36b47bb615d84a634bee070a24579a5f9c
SHA512 ec6c7ed7452585825c0fe7910d0f770a265937af2e0874e7e44c3d48b2dbb5a7afbf32253e006f3c370040dae1e1e67a89e96f82ab93e9e788f7a72a70c5ad36

memory/1724-26-0x0000000010000000-0x000000001000E000-memory.dmp