Malware Analysis Report

2025-04-13 10:31

Sample ID 241229-q7jg8asrbw
Target JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23
SHA256 b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23
Tags
tofsee discovery evasion execution persistence privilege_escalation trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23

Threat Level: Known bad

The file JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23 was found to be: Known bad.

Malicious Activity Summary

tofsee discovery evasion execution persistence privilege_escalation trojan

Windows security bypass

Tofsee family

Tofsee

Creates new service(s)

Modifies Windows Firewall

Sets service image path in registry

Executes dropped EXE

Deletes itself

Checks computer location settings

Suspicious use of SetThreadContext

Launches sc.exe

Program crash

Event Triggered Execution: Netsh Helper DLL

System Location Discovery: System Language Discovery

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-29 13:54

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-29 13:54

Reported

2024-12-29 13:56

Platform

win7-20240729-en

Max time kernel

146s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe"

Signatures

Tofsee

trojan tofsee

Tofsee family

tofsee

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\qyeozrqn = "0" C:\Windows\SysWOW64\svchost.exe N/A

Creates new service(s)

persistence execution

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\qyeozrqn\ImagePath = "C:\\Windows\\SysWOW64\\qyeozrqn\\qxvglgui.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\qyeozrqn\qxvglgui.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2764 set thread context of 2268 N/A C:\Windows\SysWOW64\qyeozrqn\qxvglgui.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\qyeozrqn\qxvglgui.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2188 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\cmd.exe
PID 2188 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\cmd.exe
PID 2188 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\cmd.exe
PID 2188 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\cmd.exe
PID 2188 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\cmd.exe
PID 2188 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\cmd.exe
PID 2188 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\cmd.exe
PID 2188 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\cmd.exe
PID 2188 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\sc.exe
PID 2188 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\sc.exe
PID 2188 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\sc.exe
PID 2188 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\sc.exe
PID 2188 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\sc.exe
PID 2188 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\sc.exe
PID 2188 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\sc.exe
PID 2188 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\sc.exe
PID 2188 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\sc.exe
PID 2188 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\sc.exe
PID 2188 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\sc.exe
PID 2188 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\sc.exe
PID 2188 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\netsh.exe
PID 2188 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\netsh.exe
PID 2188 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\netsh.exe
PID 2188 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\netsh.exe
PID 2764 wrote to memory of 2268 N/A C:\Windows\SysWOW64\qyeozrqn\qxvglgui.exe C:\Windows\SysWOW64\svchost.exe
PID 2764 wrote to memory of 2268 N/A C:\Windows\SysWOW64\qyeozrqn\qxvglgui.exe C:\Windows\SysWOW64\svchost.exe
PID 2764 wrote to memory of 2268 N/A C:\Windows\SysWOW64\qyeozrqn\qxvglgui.exe C:\Windows\SysWOW64\svchost.exe
PID 2764 wrote to memory of 2268 N/A C:\Windows\SysWOW64\qyeozrqn\qxvglgui.exe C:\Windows\SysWOW64\svchost.exe
PID 2764 wrote to memory of 2268 N/A C:\Windows\SysWOW64\qyeozrqn\qxvglgui.exe C:\Windows\SysWOW64\svchost.exe
PID 2764 wrote to memory of 2268 N/A C:\Windows\SysWOW64\qyeozrqn\qxvglgui.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qyeozrqn\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qxvglgui.exe" C:\Windows\SysWOW64\qyeozrqn\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create qyeozrqn binPath= "C:\Windows\SysWOW64\qyeozrqn\qxvglgui.exe /d\"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description qyeozrqn "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start qyeozrqn

C:\Windows\SysWOW64\qyeozrqn\qxvglgui.exe

C:\Windows\SysWOW64\qyeozrqn\qxvglgui.exe /d"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.40.26:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta7.am0.yahoodns.net udp
US 98.136.96.75:25 mta7.am0.yahoodns.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
NL 142.250.102.26:25 smtp.google.com tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 94.100.180.31:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp

Files

memory/2188-1-0x00000000005F0000-0x00000000006F0000-memory.dmp

memory/2188-2-0x0000000000220000-0x0000000000233000-memory.dmp

memory/2188-3-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\qxvglgui.exe

MD5 193cd9260b5d624fc50f53cb2c534032
SHA1 4c2f806ea4f05d1f634e38b11852b7d317a15369
SHA256 7b6d40fbb2bd23fcb280bca73496a4f0c916a6e95f7b58c777d87a253de60dc5
SHA512 1857aaa12c5892b32aa43479d244a48e2b96866664d0d9dc399da60c37c225e3475cf180ef115eee3d860b6058ff0bbf713267a9c5d8e1c5631f90fa4e4abe9e

memory/2188-10-0x0000000000400000-0x0000000000415000-memory.dmp

memory/2188-9-0x0000000000220000-0x0000000000233000-memory.dmp

memory/2188-8-0x0000000000400000-0x00000000004AD000-memory.dmp

memory/2268-16-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2268-14-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2268-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2268-11-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2764-17-0x0000000000400000-0x00000000004AD000-memory.dmp

memory/2268-18-0x0000000000080000-0x0000000000095000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-29 13:54

Reported

2024-12-29 13:56

Platform

win10v2004-20241007-en

Max time kernel

147s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe"

Signatures

Tofsee

trojan tofsee

Tofsee family

tofsee

Creates new service(s)

persistence execution

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nkgxwbsg\ImagePath = "C:\\Windows\\SysWOW64\\nkgxwbsg\\dxtzkums.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\nkgxwbsg\dxtzkums.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3344 set thread context of 3920 N/A C:\Windows\SysWOW64\nkgxwbsg\dxtzkums.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\nkgxwbsg\dxtzkums.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1988 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\cmd.exe
PID 1988 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\cmd.exe
PID 1988 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\cmd.exe
PID 1988 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\cmd.exe
PID 1988 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\cmd.exe
PID 1988 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\cmd.exe
PID 1988 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\sc.exe
PID 1988 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\sc.exe
PID 1988 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\sc.exe
PID 1988 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\sc.exe
PID 1988 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\sc.exe
PID 1988 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\sc.exe
PID 1988 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\sc.exe
PID 1988 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\sc.exe
PID 1988 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\sc.exe
PID 1988 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\netsh.exe
PID 1988 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\netsh.exe
PID 1988 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe C:\Windows\SysWOW64\netsh.exe
PID 3344 wrote to memory of 3920 N/A C:\Windows\SysWOW64\nkgxwbsg\dxtzkums.exe C:\Windows\SysWOW64\svchost.exe
PID 3344 wrote to memory of 3920 N/A C:\Windows\SysWOW64\nkgxwbsg\dxtzkums.exe C:\Windows\SysWOW64\svchost.exe
PID 3344 wrote to memory of 3920 N/A C:\Windows\SysWOW64\nkgxwbsg\dxtzkums.exe C:\Windows\SysWOW64\svchost.exe
PID 3344 wrote to memory of 3920 N/A C:\Windows\SysWOW64\nkgxwbsg\dxtzkums.exe C:\Windows\SysWOW64\svchost.exe
PID 3344 wrote to memory of 3920 N/A C:\Windows\SysWOW64\nkgxwbsg\dxtzkums.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\nkgxwbsg\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\dxtzkums.exe" C:\Windows\SysWOW64\nkgxwbsg\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create nkgxwbsg binPath= "C:\Windows\SysWOW64\nkgxwbsg\dxtzkums.exe /d\"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description nkgxwbsg "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start nkgxwbsg

C:\Windows\SysWOW64\nkgxwbsg\dxtzkums.exe

C:\Windows\SysWOW64\nkgxwbsg\dxtzkums.exe /d"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b23f703c7ca079fa43cc7fb65f58ec401533fada301eeeec2403ef68f339bf23.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1988 -ip 1988

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 1228

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3344 -ip 3344

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 536

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 22.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.42.0:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 133.250.112.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta7.am0.yahoodns.net udp
US 98.136.96.91:25 mta7.am0.yahoodns.net tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
NL 142.250.102.27:25 smtp.google.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 134.130.81.91.in-addr.arpa udp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp

Files

memory/1988-1-0x0000000000720000-0x0000000000820000-memory.dmp

memory/1988-2-0x00000000021F0000-0x0000000002203000-memory.dmp

memory/1988-3-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dxtzkums.exe

MD5 37b827451143afba83759b1f0ae29fc8
SHA1 9f8402fdc4e6d892613174810dc0257aabeb835d
SHA256 973c587e23d70b26e44d765467402275557fe76db5510b6cfec9da55bf98e844
SHA512 0c270eb302ac5b78a4761b4221a1789ecad8ce59c09e81fe92bc25d9fd97e84e92ee36dd0611570b1765a5510aa05109747c2e73bd4171dc7312fd80844e7684

memory/1988-10-0x0000000000400000-0x0000000000415000-memory.dmp

memory/1988-9-0x00000000021F0000-0x0000000002203000-memory.dmp

memory/1988-8-0x0000000000400000-0x00000000004AD000-memory.dmp

memory/3344-11-0x0000000000400000-0x00000000004AD000-memory.dmp

memory/3344-12-0x0000000000400000-0x00000000004AD000-memory.dmp

memory/3344-13-0x0000000000400000-0x00000000004AD000-memory.dmp

memory/3920-14-0x0000000000D00000-0x0000000000D15000-memory.dmp

memory/3920-16-0x0000000000D00000-0x0000000000D15000-memory.dmp

memory/3920-17-0x0000000000D00000-0x0000000000D15000-memory.dmp

memory/3344-18-0x0000000000400000-0x00000000004AD000-memory.dmp