Malware Analysis Report

2024-10-19 01:51

Sample ID 240827-qy5n4atbnc
Target c51aba749c879901b01541a953fc336e_JaffaCakes118
SHA256 389f1cad58921e8267bdd0ae4c3d7007d6f3ac2f2b83360f57f2d1719d4f1072
Tags
tofsee discovery evasion execution persistence privilege_escalation trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

389f1cad58921e8267bdd0ae4c3d7007d6f3ac2f2b83360f57f2d1719d4f1072

Threat Level: Known bad

The file c51aba749c879901b01541a953fc336e_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

tofsee discovery evasion execution persistence privilege_escalation trojan

Tofsee

Windows security bypass

Modifies Windows Firewall

Creates new service(s)

Sets service image path in registry

Checks computer location settings

Deletes itself

Executes dropped EXE

Suspicious use of SetThreadContext

Launches sc.exe

Program crash

Unsigned PE

System Location Discovery: System Language Discovery

Event Triggered Execution: Netsh Helper DLL

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-27 13:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-27 13:41

Reported

2024-08-27 13:43

Platform

win7-20240705-en

Max time kernel

147s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe"

Signatures

Tofsee

trojan tofsee

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\lkuvrkoj = "0" C:\Windows\SysWOW64\svchost.exe N/A

Creates new service(s)

persistence execution

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\lkuvrkoj\ImagePath = "C:\\Windows\\SysWOW64\\lkuvrkoj\\yojvpbfx.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\lkuvrkoj\yojvpbfx.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2176 set thread context of 2900 N/A C:\Windows\SysWOW64\lkuvrkoj\yojvpbfx.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\lkuvrkoj\yojvpbfx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3048 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3048 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3048 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3048 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3048 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3048 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3048 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3048 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3048 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3048 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3048 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3048 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3048 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 3048 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 3048 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 3048 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2176 wrote to memory of 2900 N/A C:\Windows\SysWOW64\lkuvrkoj\yojvpbfx.exe C:\Windows\SysWOW64\svchost.exe
PID 2176 wrote to memory of 2900 N/A C:\Windows\SysWOW64\lkuvrkoj\yojvpbfx.exe C:\Windows\SysWOW64\svchost.exe
PID 2176 wrote to memory of 2900 N/A C:\Windows\SysWOW64\lkuvrkoj\yojvpbfx.exe C:\Windows\SysWOW64\svchost.exe
PID 2176 wrote to memory of 2900 N/A C:\Windows\SysWOW64\lkuvrkoj\yojvpbfx.exe C:\Windows\SysWOW64\svchost.exe
PID 2176 wrote to memory of 2900 N/A C:\Windows\SysWOW64\lkuvrkoj\yojvpbfx.exe C:\Windows\SysWOW64\svchost.exe
PID 2176 wrote to memory of 2900 N/A C:\Windows\SysWOW64\lkuvrkoj\yojvpbfx.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\lkuvrkoj\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\yojvpbfx.exe" C:\Windows\SysWOW64\lkuvrkoj\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create lkuvrkoj binPath= "C:\Windows\SysWOW64\lkuvrkoj\yojvpbfx.exe /d\"C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description lkuvrkoj "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start lkuvrkoj

C:\Windows\SysWOW64\lkuvrkoj\yojvpbfx.exe

C:\Windows\SysWOW64\lkuvrkoj\yojvpbfx.exe /d"C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.41.54:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta5.am0.yahoodns.net udp
US 67.195.204.77:25 mta5.am0.yahoodns.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
IE 209.85.202.27:25 smtp.google.com tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 94.100.180.31:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp

Files

memory/3048-1-0x0000000002D20000-0x0000000002E20000-memory.dmp

memory/3048-2-0x0000000000020000-0x0000000000033000-memory.dmp

memory/3048-3-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\yojvpbfx.exe

MD5 212f4d3af221d016ad5b169cb5238a84
SHA1 4c1dcecaf700c0c16ed90b64514d5816d738bd7f
SHA256 47329286a3c068baa6f6746ea9ef75c5d44c09ae391e41dd1f41798f1413f1e2
SHA512 f980ed46dffa41f564c235eecaef112b6834d48eb74992b2dbfaef6735e8cf6156021cf757fe3c4aa6770279bb87bdaaa5cbcb40e8f13b0a5dffb3501115ec30

memory/3048-10-0x0000000000400000-0x0000000000415000-memory.dmp

memory/3048-8-0x0000000000400000-0x0000000002B90000-memory.dmp

memory/3048-9-0x0000000000020000-0x0000000000033000-memory.dmp

memory/2900-14-0x00000000000C0000-0x00000000000D5000-memory.dmp

memory/2900-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2900-17-0x00000000000C0000-0x00000000000D5000-memory.dmp

memory/2900-11-0x00000000000C0000-0x00000000000D5000-memory.dmp

memory/2176-15-0x0000000000400000-0x0000000002B90000-memory.dmp

memory/2900-18-0x00000000000C0000-0x00000000000D5000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-27 13:41

Reported

2024-08-27 13:43

Platform

win10v2004-20240802-en

Max time kernel

146s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence execution

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mkqqmkwz\ImagePath = "C:\\Windows\\SysWOW64\\mkqqmkwz\\aynztpaq.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\mkqqmkwz\aynztpaq.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4708 set thread context of 1672 N/A C:\Windows\SysWOW64\mkqqmkwz\aynztpaq.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mkqqmkwz\aynztpaq.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3408 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3408 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3408 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3408 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3408 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3408 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3408 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3408 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3408 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3408 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3408 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3408 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3408 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3408 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3408 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 3408 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 3408 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 3408 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 4708 wrote to memory of 1672 N/A C:\Windows\SysWOW64\mkqqmkwz\aynztpaq.exe C:\Windows\SysWOW64\svchost.exe
PID 4708 wrote to memory of 1672 N/A C:\Windows\SysWOW64\mkqqmkwz\aynztpaq.exe C:\Windows\SysWOW64\svchost.exe
PID 4708 wrote to memory of 1672 N/A C:\Windows\SysWOW64\mkqqmkwz\aynztpaq.exe C:\Windows\SysWOW64\svchost.exe
PID 4708 wrote to memory of 1672 N/A C:\Windows\SysWOW64\mkqqmkwz\aynztpaq.exe C:\Windows\SysWOW64\svchost.exe
PID 4708 wrote to memory of 1672 N/A C:\Windows\SysWOW64\mkqqmkwz\aynztpaq.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\mkqqmkwz\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\aynztpaq.exe" C:\Windows\SysWOW64\mkqqmkwz\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create mkqqmkwz binPath= "C:\Windows\SysWOW64\mkqqmkwz\aynztpaq.exe /d\"C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description mkqqmkwz "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start mkqqmkwz

C:\Windows\SysWOW64\mkqqmkwz\aynztpaq.exe

C:\Windows\SysWOW64\mkqqmkwz\aynztpaq.exe /d"C:\Users\Admin\AppData\Local\Temp\c51aba749c879901b01541a953fc336e_JaffaCakes118.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3408 -ip 3408

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 572

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4708 -ip 4708

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 512

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 21.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
US 20.231.239.246:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.42.0:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 246.239.231.20.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta7.am0.yahoodns.net udp
US 67.195.204.77:25 mta7.am0.yahoodns.net tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
IE 172.253.116.27:25 smtp.google.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 94.100.180.31:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp

Files

memory/3408-1-0x0000000002E50000-0x0000000002F50000-memory.dmp

memory/3408-2-0x00000000001C0000-0x00000000001D3000-memory.dmp

memory/3408-3-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\aynztpaq.exe

MD5 6ec6f7785845815c7294ecb91cfb9259
SHA1 9cf650e1de11d02756d9d148adda299ba72986a6
SHA256 58f53aa79e7f4f072d0ccefa20870b205e3ed2527209cff726e63c8e1f576b78
SHA512 9e1b022c246e04b9d38c3d1cc59f6d8c3c7b8a44e9f339504c7757be1e79a8c2799cf7824add36823dae6f83dda3c29931145ac37a65ceadc95999357302e941

memory/3408-10-0x0000000000400000-0x0000000000415000-memory.dmp

memory/3408-9-0x00000000001C0000-0x00000000001D3000-memory.dmp

memory/3408-8-0x0000000000400000-0x0000000002B90000-memory.dmp

memory/1672-11-0x0000000000E00000-0x0000000000E15000-memory.dmp

memory/1672-13-0x0000000000E00000-0x0000000000E15000-memory.dmp

memory/1672-14-0x0000000000E00000-0x0000000000E15000-memory.dmp

memory/4708-15-0x0000000000400000-0x0000000002B90000-memory.dmp