Malware Analysis Report

2024-10-19 01:51

Sample ID 240831-b9y85azbkk
Target 6673656f0eea34edbe311046d2525113.zip
SHA256 82a7c81b43a959017a8d6ed01d86bc32ef53f4b57d36bd8791afdbd5ef8420c7
Tags
tofsee discovery evasion execution persistence privilege_escalation trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

82a7c81b43a959017a8d6ed01d86bc32ef53f4b57d36bd8791afdbd5ef8420c7

Threat Level: Known bad

The file 6673656f0eea34edbe311046d2525113.zip was found to be: Known bad.

Malicious Activity Summary

tofsee discovery evasion execution persistence privilege_escalation trojan

Tofsee

Windows security bypass

Sets service image path in registry

Modifies Windows Firewall

Creates new service(s)

Executes dropped EXE

Deletes itself

Checks computer location settings

Suspicious use of SetThreadContext

Launches sc.exe

System Location Discovery: System Language Discovery

Event Triggered Execution: Netsh Helper DLL

Enumerates physical storage devices

Unsigned PE

Program crash

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-31 01:51

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-31 01:51

Reported

2024-08-31 01:53

Platform

win7-20240708-en

Max time kernel

144s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe"

Signatures

Tofsee

trojan tofsee

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\ohhvszjj = "0" C:\Windows\SysWOW64\svchost.exe N/A

Creates new service(s)

persistence execution

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ohhvszjj\ImagePath = "C:\\Windows\\SysWOW64\\ohhvszjj\\ktnskjea.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ohhvszjj\ktnskjea.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2876 set thread context of 2616 N/A C:\Windows\SysWOW64\ohhvszjj\ktnskjea.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ohhvszjj\ktnskjea.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 576 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\cmd.exe
PID 576 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\cmd.exe
PID 576 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\cmd.exe
PID 576 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\cmd.exe
PID 576 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\cmd.exe
PID 576 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\cmd.exe
PID 576 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\cmd.exe
PID 576 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\cmd.exe
PID 576 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\sc.exe
PID 576 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\sc.exe
PID 576 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\sc.exe
PID 576 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\sc.exe
PID 576 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\sc.exe
PID 576 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\sc.exe
PID 576 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\sc.exe
PID 576 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\sc.exe
PID 576 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\sc.exe
PID 576 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\sc.exe
PID 576 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\sc.exe
PID 576 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\sc.exe
PID 2876 wrote to memory of 2616 N/A C:\Windows\SysWOW64\ohhvszjj\ktnskjea.exe C:\Windows\SysWOW64\svchost.exe
PID 2876 wrote to memory of 2616 N/A C:\Windows\SysWOW64\ohhvszjj\ktnskjea.exe C:\Windows\SysWOW64\svchost.exe
PID 2876 wrote to memory of 2616 N/A C:\Windows\SysWOW64\ohhvszjj\ktnskjea.exe C:\Windows\SysWOW64\svchost.exe
PID 2876 wrote to memory of 2616 N/A C:\Windows\SysWOW64\ohhvszjj\ktnskjea.exe C:\Windows\SysWOW64\svchost.exe
PID 2876 wrote to memory of 2616 N/A C:\Windows\SysWOW64\ohhvszjj\ktnskjea.exe C:\Windows\SysWOW64\svchost.exe
PID 2876 wrote to memory of 2616 N/A C:\Windows\SysWOW64\ohhvszjj\ktnskjea.exe C:\Windows\SysWOW64\svchost.exe
PID 576 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\netsh.exe
PID 576 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\netsh.exe
PID 576 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\netsh.exe
PID 576 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe

"C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ohhvszjj\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ktnskjea.exe" C:\Windows\SysWOW64\ohhvszjj\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create ohhvszjj binPath= "C:\Windows\SysWOW64\ohhvszjj\ktnskjea.exe /d\"C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description ohhvszjj "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start ohhvszjj

C:\Windows\SysWOW64\ohhvszjj\ktnskjea.exe

C:\Windows\SysWOW64\ohhvszjj\ktnskjea.exe /d"C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
NL 20.76.201.171:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.11.0:25 microsoft-com.mail.protection.outlook.com tcp
AU 43.231.4.7:443 tcp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta7.am0.yahoodns.net udp
US 67.195.228.111:25 mta7.am0.yahoodns.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
NL 142.250.145.27:25 smtp.google.com tcp
AU 43.231.4.7:443 tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp
AU 43.231.4.7:443 tcp

Files

memory/576-2-0x0000000000400000-0x0000000002DAC000-memory.dmp

memory/576-3-0x0000000000400000-0x0000000002DAC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ktnskjea.exe

MD5 cc05685e6b68508597b4b7074b4392ce
SHA1 b566ce79e3869fa4b1e73f5c5003fb037db37c5b
SHA256 8b6a3354cf8c256943f7e0b3c25deda555b0e095353a94e0bff70f3ef65f62b6
SHA512 28ea98137879e40cb894a2e622f7dd32c1cbef238b309432ff6e0336b8331a897b9b32b4cfb70374a3d3d750e5520de63a699cdfdaddbf6e89b0f61fc24e41c5

memory/2616-10-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2616-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2616-7-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2876-11-0x0000000000400000-0x0000000002DAC000-memory.dmp

memory/576-14-0x0000000000400000-0x0000000002DAC000-memory.dmp

memory/2616-15-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2616-16-0x0000000000080000-0x0000000000095000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-31 01:51

Reported

2024-08-31 01:53

Platform

win10v2004-20240802-en

Max time kernel

145s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence execution

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\hnsvqhxw\ImagePath = "C:\\Windows\\SysWOW64\\hnsvqhxw\\luotlkfb.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\hnsvqhxw\luotlkfb.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3868 set thread context of 2524 N/A C:\Windows\SysWOW64\hnsvqhxw\luotlkfb.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\hnsvqhxw\luotlkfb.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4456 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\cmd.exe
PID 4456 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\cmd.exe
PID 4456 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\cmd.exe
PID 4456 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\cmd.exe
PID 4456 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\cmd.exe
PID 4456 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\cmd.exe
PID 4456 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\sc.exe
PID 4456 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\sc.exe
PID 4456 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\sc.exe
PID 4456 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\sc.exe
PID 4456 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\sc.exe
PID 4456 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\sc.exe
PID 4456 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\sc.exe
PID 4456 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\sc.exe
PID 4456 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\sc.exe
PID 3868 wrote to memory of 2524 N/A C:\Windows\SysWOW64\hnsvqhxw\luotlkfb.exe C:\Windows\SysWOW64\svchost.exe
PID 3868 wrote to memory of 2524 N/A C:\Windows\SysWOW64\hnsvqhxw\luotlkfb.exe C:\Windows\SysWOW64\svchost.exe
PID 3868 wrote to memory of 2524 N/A C:\Windows\SysWOW64\hnsvqhxw\luotlkfb.exe C:\Windows\SysWOW64\svchost.exe
PID 3868 wrote to memory of 2524 N/A C:\Windows\SysWOW64\hnsvqhxw\luotlkfb.exe C:\Windows\SysWOW64\svchost.exe
PID 3868 wrote to memory of 2524 N/A C:\Windows\SysWOW64\hnsvqhxw\luotlkfb.exe C:\Windows\SysWOW64\svchost.exe
PID 4456 wrote to memory of 4116 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\netsh.exe
PID 4456 wrote to memory of 4116 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\netsh.exe
PID 4456 wrote to memory of 4116 N/A C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe

"C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hnsvqhxw\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\luotlkfb.exe" C:\Windows\SysWOW64\hnsvqhxw\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create hnsvqhxw binPath= "C:\Windows\SysWOW64\hnsvqhxw\luotlkfb.exe /d\"C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description hnsvqhxw "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start hnsvqhxw

C:\Windows\SysWOW64\hnsvqhxw\luotlkfb.exe

C:\Windows\SysWOW64\hnsvqhxw\luotlkfb.exe /d"C:\Users\Admin\AppData\Local\Temp\00a7fe01857f4c5a118c936b5573b4c2755c8369534870394c3d61a5af058bcc.exe"

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4456 -ip 4456

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3868 -ip 3868

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 512

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 1220

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 microsoft.com udp
NL 20.76.201.171:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.40.26:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 171.201.76.20.in-addr.arpa udp
AU 43.231.4.7:443 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta7.am0.yahoodns.net udp
US 98.136.96.77:25 mta7.am0.yahoodns.net tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
NL 142.250.153.27:25 smtp.google.com tcp
AU 43.231.4.7:443 tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 94.100.180.31:25 mxs.mail.ru tcp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 52.111.227.11:443 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
AU 43.231.4.7:443 tcp

Files

memory/4456-2-0x00000000001C0000-0x00000000001D3000-memory.dmp

memory/4456-1-0x0000000002F30000-0x0000000003030000-memory.dmp

memory/4456-3-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\luotlkfb.exe

MD5 8ebf216cb61b02e10ddf44835296e358
SHA1 9f15cc003195024d9450b48bef4691bb2d1d7327
SHA256 ef80641332f4c70d90894ec6f7c410b9b52ee6b5dffef96c3a4d65967aa7d067
SHA512 82984fcc8b1d6a07023561562b900997587adaba61353404709aa928b893fee33bd66003a9fc99284fad9de8962f1c730cf29437ecd1980dcbcbfdc022fc000d

memory/2524-8-0x0000000000120000-0x0000000000135000-memory.dmp

memory/4456-13-0x0000000000400000-0x0000000000415000-memory.dmp

memory/3868-10-0x0000000000400000-0x0000000002DAC000-memory.dmp

memory/4456-12-0x00000000001C0000-0x00000000001D3000-memory.dmp

memory/4456-11-0x0000000000400000-0x0000000002DAC000-memory.dmp

memory/2524-14-0x0000000000120000-0x0000000000135000-memory.dmp

memory/2524-15-0x0000000000120000-0x0000000000135000-memory.dmp