Malware Analysis Report

2024-10-19 01:52

Sample ID 240828-1s6djsyane
Target c7b736a9fca49450b679452260c86084_JaffaCakes118
SHA256 ecb8395da2818b288bae02ac7827548df335aeefed102d6a9bda6d3738108c56
Tags
tofsee discovery evasion execution persistence privilege_escalation trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ecb8395da2818b288bae02ac7827548df335aeefed102d6a9bda6d3738108c56

Threat Level: Known bad

The file c7b736a9fca49450b679452260c86084_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

tofsee discovery evasion execution persistence privilege_escalation trojan

Tofsee

Windows security bypass

Modifies Windows Firewall

Creates new service(s)

Sets service image path in registry

Checks computer location settings

Executes dropped EXE

Deletes itself

Suspicious use of SetThreadContext

Launches sc.exe

Unsigned PE

System Location Discovery: System Language Discovery

Event Triggered Execution: Netsh Helper DLL

Enumerates physical storage devices

Program crash

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-28 21:55

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-28 21:55

Reported

2024-08-28 21:58

Platform

win7-20240708-en

Max time kernel

145s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe"

Signatures

Tofsee

trojan tofsee

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\tpeuasrm = "0" C:\Windows\SysWOW64\svchost.exe N/A

Creates new service(s)

persistence execution

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\tpeuasrm\ImagePath = "C:\\Windows\\SysWOW64\\tpeuasrm\\htauzfsa.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tpeuasrm\htauzfsa.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2608 set thread context of 2196 N/A C:\Windows\SysWOW64\tpeuasrm\htauzfsa.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tpeuasrm\htauzfsa.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2212 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2608 wrote to memory of 2196 N/A C:\Windows\SysWOW64\tpeuasrm\htauzfsa.exe C:\Windows\SysWOW64\svchost.exe
PID 2608 wrote to memory of 2196 N/A C:\Windows\SysWOW64\tpeuasrm\htauzfsa.exe C:\Windows\SysWOW64\svchost.exe
PID 2608 wrote to memory of 2196 N/A C:\Windows\SysWOW64\tpeuasrm\htauzfsa.exe C:\Windows\SysWOW64\svchost.exe
PID 2608 wrote to memory of 2196 N/A C:\Windows\SysWOW64\tpeuasrm\htauzfsa.exe C:\Windows\SysWOW64\svchost.exe
PID 2608 wrote to memory of 2196 N/A C:\Windows\SysWOW64\tpeuasrm\htauzfsa.exe C:\Windows\SysWOW64\svchost.exe
PID 2608 wrote to memory of 2196 N/A C:\Windows\SysWOW64\tpeuasrm\htauzfsa.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\tpeuasrm\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\htauzfsa.exe" C:\Windows\SysWOW64\tpeuasrm\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create tpeuasrm binPath= "C:\Windows\SysWOW64\tpeuasrm\htauzfsa.exe /d\"C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description tpeuasrm "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start tpeuasrm

C:\Windows\SysWOW64\tpeuasrm\htauzfsa.exe

C:\Windows\SysWOW64\tpeuasrm\htauzfsa.exe /d"C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
US 20.236.44.162:80 microsoft.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.11.7:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta7.am0.yahoodns.net udp
US 67.195.228.111:25 mta7.am0.yahoodns.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
IE 172.253.116.26:25 smtp.google.com tcp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 94.100.180.31:25 mxs.mail.ru tcp

Files

memory/2212-1-0x00000000002D0000-0x00000000003D0000-memory.dmp

memory/2212-2-0x0000000000020000-0x0000000000033000-memory.dmp

memory/2212-3-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\htauzfsa.exe

MD5 edee6e2a79527a530c616408e33a6d8b
SHA1 556b0ce5c8459606a9a212afbc32719c5f8c3f56
SHA256 19bc0be673a0c6daae97cf9c34a34d6538d66098b925a60fbfb85a78a763f399
SHA512 04e6120815be26dead4a9a4a8a17dec0b1cb783992a8bf5454aec48c3bc5d9660debde72ab02ee2c0b59a72e497e14754b007cefa7d862157aa7cf2478ae132d

memory/2212-10-0x0000000000400000-0x0000000000415000-memory.dmp

memory/2212-9-0x0000000000020000-0x0000000000033000-memory.dmp

memory/2212-8-0x0000000000400000-0x0000000000871000-memory.dmp

memory/2196-16-0x00000000000C0000-0x00000000000D5000-memory.dmp

memory/2196-14-0x00000000000C0000-0x00000000000D5000-memory.dmp

memory/2196-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2196-11-0x00000000000C0000-0x00000000000D5000-memory.dmp

memory/2608-17-0x0000000000400000-0x0000000000871000-memory.dmp

memory/2196-18-0x00000000000C0000-0x00000000000D5000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-28 21:55

Reported

2024-08-28 21:58

Platform

win10v2004-20240802-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence execution

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wosfdncn\ImagePath = "C:\\Windows\\SysWOW64\\wosfdncn\\bzoauqbr.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\wosfdncn\bzoauqbr.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3892 set thread context of 4704 N/A C:\Windows\SysWOW64\wosfdncn\bzoauqbr.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wosfdncn\bzoauqbr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1112 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1112 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1112 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1112 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1112 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1112 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1112 wrote to memory of 100 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1112 wrote to memory of 100 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1112 wrote to memory of 100 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1112 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1112 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1112 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1112 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1112 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1112 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1112 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1112 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1112 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 3892 wrote to memory of 4704 N/A C:\Windows\SysWOW64\wosfdncn\bzoauqbr.exe C:\Windows\SysWOW64\svchost.exe
PID 3892 wrote to memory of 4704 N/A C:\Windows\SysWOW64\wosfdncn\bzoauqbr.exe C:\Windows\SysWOW64\svchost.exe
PID 3892 wrote to memory of 4704 N/A C:\Windows\SysWOW64\wosfdncn\bzoauqbr.exe C:\Windows\SysWOW64\svchost.exe
PID 3892 wrote to memory of 4704 N/A C:\Windows\SysWOW64\wosfdncn\bzoauqbr.exe C:\Windows\SysWOW64\svchost.exe
PID 3892 wrote to memory of 4704 N/A C:\Windows\SysWOW64\wosfdncn\bzoauqbr.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\wosfdncn\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\bzoauqbr.exe" C:\Windows\SysWOW64\wosfdncn\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create wosfdncn binPath= "C:\Windows\SysWOW64\wosfdncn\bzoauqbr.exe /d\"C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description wosfdncn "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start wosfdncn

C:\Windows\SysWOW64\wosfdncn\bzoauqbr.exe

C:\Windows\SysWOW64\wosfdncn\bzoauqbr.exe /d"C:\Users\Admin\AppData\Local\Temp\c7b736a9fca49450b679452260c86084_JaffaCakes118.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1112 -ip 1112

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 796

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3892 -ip 3892

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 520

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
US 20.236.44.162:80 microsoft.com tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 8.8.8.8:53 162.44.236.20.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 52.101.11.0:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta7.am0.yahoodns.net udp
US 67.195.204.72:25 mta7.am0.yahoodns.net tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
IE 172.253.116.26:25 smtp.google.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp

Files

memory/1112-1-0x00000000009B0000-0x0000000000AB0000-memory.dmp

memory/1112-2-0x00000000001E0000-0x00000000001F3000-memory.dmp

memory/1112-3-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\bzoauqbr.exe

MD5 fb4ff4123abafa9fb970a28fa4cfb6bb
SHA1 ed75d5e249f498c441069800e5c3aa50ba2c2117
SHA256 5dd9e12ff633e412e045c9f6c894451397d440c09763a45535cf0d133619f401
SHA512 c1741ea45945288df9107bfe5c2c18df782b42a7740f326fd5d8c9415011c77f37ea93e34a88773d5f26c02a60f6e58d2a750b3d78c4eb44ce7f16553536d429

memory/1112-8-0x0000000000400000-0x0000000000871000-memory.dmp

memory/1112-10-0x0000000000400000-0x0000000000415000-memory.dmp

memory/1112-9-0x00000000001E0000-0x00000000001F3000-memory.dmp

memory/3892-11-0x0000000000400000-0x0000000000871000-memory.dmp

memory/4704-12-0x00000000008F0000-0x0000000000905000-memory.dmp

memory/4704-14-0x00000000008F0000-0x0000000000905000-memory.dmp

memory/3892-15-0x0000000000400000-0x0000000000871000-memory.dmp

memory/3892-16-0x0000000000400000-0x0000000000871000-memory.dmp

memory/4704-17-0x00000000008F0000-0x0000000000905000-memory.dmp