Malware Analysis Report

2024-10-19 01:52

Sample ID 240901-eykhda1hmg
Target 7add49d3f94626db3bfd88652c55403b.zip
SHA256 ecc447dac820e56985af81703fbca424d9309a9ebcfb152e993bc9ccc275c920
Tags
tofsee discovery evasion execution persistence privilege_escalation trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ecc447dac820e56985af81703fbca424d9309a9ebcfb152e993bc9ccc275c920

Threat Level: Known bad

The file 7add49d3f94626db3bfd88652c55403b.zip was found to be: Known bad.

Malicious Activity Summary

tofsee discovery evasion execution persistence privilege_escalation trojan

Tofsee

Windows security bypass

Sets service image path in registry

Modifies Windows Firewall

Creates new service(s)

Deletes itself

Checks computer location settings

Executes dropped EXE

Suspicious use of SetThreadContext

Launches sc.exe

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

System Location Discovery: System Language Discovery

Unsigned PE

Program crash

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-01 04:20

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-01 04:20

Reported

2024-09-01 04:23

Platform

win7-20240708-en

Max time kernel

145s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe"

Signatures

Tofsee

trojan tofsee

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\chlnykou = "0" C:\Windows\SysWOW64\svchost.exe N/A

Creates new service(s)

persistence execution

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\chlnykou\ImagePath = "C:\\Windows\\SysWOW64\\chlnykou\\pnxvvluk.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\chlnykou\pnxvvluk.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2908 set thread context of 3028 N/A C:\Windows\SysWOW64\chlnykou\pnxvvluk.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\chlnykou\pnxvvluk.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2688 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\cmd.exe
PID 2688 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\cmd.exe
PID 2688 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\cmd.exe
PID 2688 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\cmd.exe
PID 2688 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\cmd.exe
PID 2688 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\cmd.exe
PID 2688 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\cmd.exe
PID 2688 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\cmd.exe
PID 2688 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\sc.exe
PID 2688 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\sc.exe
PID 2688 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\sc.exe
PID 2688 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\sc.exe
PID 2688 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\sc.exe
PID 2688 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\sc.exe
PID 2688 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\sc.exe
PID 2688 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\sc.exe
PID 2688 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\sc.exe
PID 2688 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\sc.exe
PID 2688 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\sc.exe
PID 2688 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\sc.exe
PID 2688 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\netsh.exe
PID 2688 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\netsh.exe
PID 2688 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\netsh.exe
PID 2688 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\netsh.exe
PID 2908 wrote to memory of 3028 N/A C:\Windows\SysWOW64\chlnykou\pnxvvluk.exe C:\Windows\SysWOW64\svchost.exe
PID 2908 wrote to memory of 3028 N/A C:\Windows\SysWOW64\chlnykou\pnxvvluk.exe C:\Windows\SysWOW64\svchost.exe
PID 2908 wrote to memory of 3028 N/A C:\Windows\SysWOW64\chlnykou\pnxvvluk.exe C:\Windows\SysWOW64\svchost.exe
PID 2908 wrote to memory of 3028 N/A C:\Windows\SysWOW64\chlnykou\pnxvvluk.exe C:\Windows\SysWOW64\svchost.exe
PID 2908 wrote to memory of 3028 N/A C:\Windows\SysWOW64\chlnykou\pnxvvluk.exe C:\Windows\SysWOW64\svchost.exe
PID 2908 wrote to memory of 3028 N/A C:\Windows\SysWOW64\chlnykou\pnxvvluk.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe

"C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\chlnykou\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\pnxvvluk.exe" C:\Windows\SysWOW64\chlnykou\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create chlnykou binPath= "C:\Windows\SysWOW64\chlnykou\pnxvvluk.exe /d\"C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description chlnykou "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start chlnykou

C:\Windows\SysWOW64\chlnykou\pnxvvluk.exe

C:\Windows\SysWOW64\chlnykou\pnxvvluk.exe /d"C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
NL 20.76.201.171:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.41.26:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta6.am0.yahoodns.net udp
US 67.195.228.106:25 mta6.am0.yahoodns.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
NL 108.177.96.26:25 smtp.google.com tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 94.100.180.31:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp

Files

memory/2688-1-0x00000000009A0000-0x0000000000AA0000-memory.dmp

memory/2688-2-0x0000000000020000-0x0000000000033000-memory.dmp

memory/2688-3-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\pnxvvluk.exe

MD5 b9ec354f32ab40123fecaa6748ccdb5f
SHA1 483dcd7a4c1aa3b844d90dc5c3db56871d6e8ea8
SHA256 646d27461f1ae7073dd8898e96f12064e968897471d57c5f88a1467015f8102a
SHA512 69c0900d9193b8a22c1d170f05379e207df8b4d5eacb382c7836fd2342c0f8dc09ea39689dbfe4615ee1fa192a740e11aadd554f626e77b88ad4676e3bf5cd84

memory/2688-10-0x0000000000400000-0x0000000000415000-memory.dmp

memory/2688-9-0x0000000000020000-0x0000000000033000-memory.dmp

memory/2688-8-0x0000000000400000-0x0000000000870000-memory.dmp

memory/3028-11-0x0000000000080000-0x0000000000095000-memory.dmp

memory/3028-17-0x0000000000080000-0x0000000000095000-memory.dmp

memory/3028-14-0x0000000000080000-0x0000000000095000-memory.dmp

memory/3028-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2908-15-0x0000000000400000-0x0000000000870000-memory.dmp

memory/3028-18-0x0000000000080000-0x0000000000095000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-01 04:20

Reported

2024-09-01 04:23

Platform

win10v2004-20240802-en

Max time kernel

145s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence execution

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aaftwqcu\ImagePath = "C:\\Windows\\SysWOW64\\aaftwqcu\\trgsmitj.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\aaftwqcu\trgsmitj.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4176 set thread context of 1432 N/A C:\Windows\SysWOW64\aaftwqcu\trgsmitj.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\aaftwqcu\trgsmitj.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3808 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\cmd.exe
PID 3808 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\cmd.exe
PID 3808 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\cmd.exe
PID 3808 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\cmd.exe
PID 3808 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\cmd.exe
PID 3808 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\cmd.exe
PID 3808 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\sc.exe
PID 3808 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\sc.exe
PID 3808 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\sc.exe
PID 3808 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\sc.exe
PID 3808 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\sc.exe
PID 3808 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\sc.exe
PID 3808 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\sc.exe
PID 3808 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\sc.exe
PID 3808 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\sc.exe
PID 3808 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\netsh.exe
PID 3808 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\netsh.exe
PID 3808 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe C:\Windows\SysWOW64\netsh.exe
PID 4176 wrote to memory of 1432 N/A C:\Windows\SysWOW64\aaftwqcu\trgsmitj.exe C:\Windows\SysWOW64\svchost.exe
PID 4176 wrote to memory of 1432 N/A C:\Windows\SysWOW64\aaftwqcu\trgsmitj.exe C:\Windows\SysWOW64\svchost.exe
PID 4176 wrote to memory of 1432 N/A C:\Windows\SysWOW64\aaftwqcu\trgsmitj.exe C:\Windows\SysWOW64\svchost.exe
PID 4176 wrote to memory of 1432 N/A C:\Windows\SysWOW64\aaftwqcu\trgsmitj.exe C:\Windows\SysWOW64\svchost.exe
PID 4176 wrote to memory of 1432 N/A C:\Windows\SysWOW64\aaftwqcu\trgsmitj.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe

"C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\aaftwqcu\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\trgsmitj.exe" C:\Windows\SysWOW64\aaftwqcu\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create aaftwqcu binPath= "C:\Windows\SysWOW64\aaftwqcu\trgsmitj.exe /d\"C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description aaftwqcu "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start aaftwqcu

C:\Windows\SysWOW64\aaftwqcu\trgsmitj.exe

C:\Windows\SysWOW64\aaftwqcu\trgsmitj.exe /d"C:\Users\Admin\AppData\Local\Temp\d15dc4c9f5cc18798572b527797678adedd953ae755a9efadbeaf76353cc199f.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3808 -ip 3808

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 1028

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4176 -ip 4176

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 512

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.40.26:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 133.250.112.20.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta7.am0.yahoodns.net udp
US 98.136.96.77:25 mta7.am0.yahoodns.net tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
NL 108.177.96.27:25 smtp.google.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 94.100.180.31:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 198.111.78.13.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp

Files

memory/3808-1-0x0000000000B40000-0x0000000000C40000-memory.dmp

memory/3808-2-0x00000000001C0000-0x00000000001D3000-memory.dmp

memory/3808-3-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\trgsmitj.exe

MD5 9277bd5a2eaac18df9b2621e6d61124a
SHA1 dea7850d74593c9d23b56b40ac23c25dcac25ecf
SHA256 c22352f1c4c8c6f467cd1acaf807cab43a1747ec3c3d954dce3f8d73c1cef7ae
SHA512 f25bc518f1b58b979f57bc1f05cc5e6eb48869cc456581435d2ce358040c8228de008b951465f8774a8d73e2bcbb7f7e51a7ad0f430e9c6743776b06faaccdaa

memory/3808-10-0x0000000000400000-0x0000000000415000-memory.dmp

memory/3808-8-0x0000000000400000-0x0000000000870000-memory.dmp

memory/3808-9-0x00000000001C0000-0x00000000001D3000-memory.dmp

memory/4176-11-0x0000000000400000-0x0000000000870000-memory.dmp

memory/4176-12-0x0000000000400000-0x0000000000870000-memory.dmp

memory/1432-13-0x00000000008F0000-0x0000000000905000-memory.dmp

memory/1432-15-0x00000000008F0000-0x0000000000905000-memory.dmp

memory/1432-16-0x00000000008F0000-0x0000000000905000-memory.dmp

memory/4176-18-0x0000000000400000-0x0000000000870000-memory.dmp