Malware Analysis Report

2025-04-13 10:31

Sample ID 241229-qjty2ssmfl
Target JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f
SHA256 ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f
Tags
tofsee discovery evasion execution persistence privilege_escalation trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f

Threat Level: Known bad

The file JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f was found to be: Known bad.

Malicious Activity Summary

tofsee discovery evasion execution persistence privilege_escalation trojan

Windows security bypass

Tofsee family

Tofsee

Sets service image path in registry

Creates new service(s)

Modifies Windows Firewall

Checks computer location settings

Executes dropped EXE

Deletes itself

Suspicious use of SetThreadContext

Launches sc.exe

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-29 13:17

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-29 13:17

Reported

2024-12-29 13:20

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe"

Signatures

Tofsee

trojan tofsee

Tofsee family

tofsee

Creates new service(s)

persistence execution

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\gmxhoiac\ImagePath = "C:\\Windows\\SysWOW64\\gmxhoiac\\qcjdiobj.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\gmxhoiac\qcjdiobj.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4660 set thread context of 3784 N/A C:\Windows\SysWOW64\gmxhoiac\qcjdiobj.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\gmxhoiac\qcjdiobj.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4416 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\cmd.exe
PID 4416 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\cmd.exe
PID 4416 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\cmd.exe
PID 4416 wrote to memory of 4164 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\cmd.exe
PID 4416 wrote to memory of 4164 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\cmd.exe
PID 4416 wrote to memory of 4164 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\cmd.exe
PID 4416 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\sc.exe
PID 4416 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\sc.exe
PID 4416 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\sc.exe
PID 4416 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\sc.exe
PID 4416 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\sc.exe
PID 4416 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\sc.exe
PID 4416 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\sc.exe
PID 4416 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\sc.exe
PID 4416 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\sc.exe
PID 4416 wrote to memory of 4116 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\netsh.exe
PID 4416 wrote to memory of 4116 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\netsh.exe
PID 4416 wrote to memory of 4116 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\netsh.exe
PID 4660 wrote to memory of 3784 N/A C:\Windows\SysWOW64\gmxhoiac\qcjdiobj.exe C:\Windows\SysWOW64\svchost.exe
PID 4660 wrote to memory of 3784 N/A C:\Windows\SysWOW64\gmxhoiac\qcjdiobj.exe C:\Windows\SysWOW64\svchost.exe
PID 4660 wrote to memory of 3784 N/A C:\Windows\SysWOW64\gmxhoiac\qcjdiobj.exe C:\Windows\SysWOW64\svchost.exe
PID 4660 wrote to memory of 3784 N/A C:\Windows\SysWOW64\gmxhoiac\qcjdiobj.exe C:\Windows\SysWOW64\svchost.exe
PID 4660 wrote to memory of 3784 N/A C:\Windows\SysWOW64\gmxhoiac\qcjdiobj.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\gmxhoiac\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qcjdiobj.exe" C:\Windows\SysWOW64\gmxhoiac\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create gmxhoiac binPath= "C:\Windows\SysWOW64\gmxhoiac\qcjdiobj.exe /d\"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description gmxhoiac "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start gmxhoiac

C:\Windows\SysWOW64\gmxhoiac\qcjdiobj.exe

C:\Windows\SysWOW64\gmxhoiac\qcjdiobj.exe /d"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
US 20.236.44.162:80 microsoft.com tcp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.11.0:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 162.44.236.20.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta7.am0.yahoodns.net udp
US 67.195.228.110:25 mta7.am0.yahoodns.net tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
NL 142.250.102.27:25 smtp.google.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 94.100.180.31:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp

Files

memory/4416-1-0x0000000000890000-0x0000000000990000-memory.dmp

memory/4416-2-0x00000000001E0000-0x00000000001F3000-memory.dmp

memory/4416-3-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\qcjdiobj.exe

MD5 32c7d95db8b3808a534b695a721190f2
SHA1 e4a09a89b793497b889e8721ddbc99c477f26676
SHA256 4d5c6fab70f0fc943236283da76022c4e6a8e78ed8c1467db94bd898b6147f4f
SHA512 e6f715eadf8f2d1e5ad5a556ecc9801b25a74a976256fbe9310bb5077549a244ffe319a0e3e8ddb07a79787e8e40ce638fa3e13eeda0ac7dd59364b7f5318cab

memory/4416-10-0x0000000000400000-0x0000000000415000-memory.dmp

memory/4416-9-0x00000000001E0000-0x00000000001F3000-memory.dmp

memory/4416-8-0x0000000000400000-0x000000000086B000-memory.dmp

memory/4660-12-0x0000000000400000-0x000000000086B000-memory.dmp

memory/3784-14-0x0000000001050000-0x0000000001065000-memory.dmp

memory/4660-13-0x0000000000400000-0x000000000086B000-memory.dmp

memory/3784-16-0x0000000001050000-0x0000000001065000-memory.dmp

memory/4660-17-0x0000000000400000-0x000000000086B000-memory.dmp

memory/3784-18-0x0000000001050000-0x0000000001065000-memory.dmp

memory/4660-11-0x0000000000400000-0x000000000086B000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-29 13:17

Reported

2024-12-29 13:20

Platform

win7-20240903-en

Max time kernel

145s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe"

Signatures

Tofsee

trojan tofsee

Tofsee family

tofsee

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\qckdkgym = "0" C:\Windows\SysWOW64\svchost.exe N/A

Creates new service(s)

persistence execution

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\qckdkgym\ImagePath = "C:\\Windows\\SysWOW64\\qckdkgym\\dknlmmcq.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\qckdkgym\dknlmmcq.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2628 set thread context of 2868 N/A C:\Windows\SysWOW64\qckdkgym\dknlmmcq.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\qckdkgym\dknlmmcq.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2352 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\cmd.exe
PID 2352 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\cmd.exe
PID 2352 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\cmd.exe
PID 2352 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\cmd.exe
PID 2352 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\cmd.exe
PID 2352 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\cmd.exe
PID 2352 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\cmd.exe
PID 2352 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\cmd.exe
PID 2352 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\sc.exe
PID 2352 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\sc.exe
PID 2352 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\sc.exe
PID 2352 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\sc.exe
PID 2352 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\sc.exe
PID 2352 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\sc.exe
PID 2352 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\sc.exe
PID 2352 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\sc.exe
PID 2352 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\sc.exe
PID 2352 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\sc.exe
PID 2352 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\sc.exe
PID 2352 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\sc.exe
PID 2352 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\netsh.exe
PID 2352 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\netsh.exe
PID 2352 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\netsh.exe
PID 2352 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe C:\Windows\SysWOW64\netsh.exe
PID 2628 wrote to memory of 2868 N/A C:\Windows\SysWOW64\qckdkgym\dknlmmcq.exe C:\Windows\SysWOW64\svchost.exe
PID 2628 wrote to memory of 2868 N/A C:\Windows\SysWOW64\qckdkgym\dknlmmcq.exe C:\Windows\SysWOW64\svchost.exe
PID 2628 wrote to memory of 2868 N/A C:\Windows\SysWOW64\qckdkgym\dknlmmcq.exe C:\Windows\SysWOW64\svchost.exe
PID 2628 wrote to memory of 2868 N/A C:\Windows\SysWOW64\qckdkgym\dknlmmcq.exe C:\Windows\SysWOW64\svchost.exe
PID 2628 wrote to memory of 2868 N/A C:\Windows\SysWOW64\qckdkgym\dknlmmcq.exe C:\Windows\SysWOW64\svchost.exe
PID 2628 wrote to memory of 2868 N/A C:\Windows\SysWOW64\qckdkgym\dknlmmcq.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qckdkgym\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\dknlmmcq.exe" C:\Windows\SysWOW64\qckdkgym\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create qckdkgym binPath= "C:\Windows\SysWOW64\qckdkgym\dknlmmcq.exe /d\"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description qckdkgym "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start qckdkgym

C:\Windows\SysWOW64\qckdkgym\dknlmmcq.exe

C:\Windows\SysWOW64\qckdkgym\dknlmmcq.exe /d"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ce5524b77582e31c3c35e03476b31c78ca6a197ee31fb903058f4c90ccd4106f.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
AU 20.70.246.20:80 microsoft.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.8.49:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta6.am0.yahoodns.net udp
US 67.195.228.111:25 mta6.am0.yahoodns.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
NL 142.250.102.27:25 smtp.google.com tcp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 217.69.139.150:25 mxs.mail.ru tcp

Files

memory/2352-1-0x0000000000A00000-0x0000000000B00000-memory.dmp

memory/2352-2-0x0000000000020000-0x0000000000033000-memory.dmp

memory/2352-3-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dknlmmcq.exe

MD5 5209e3d646f07e44455c42691babe8f2
SHA1 1a1dcc0a05aa9f606e188010893c8598c423a54f
SHA256 1922d379b298553c907714767a53eb262f068a7a945c1e29fe75c03e8b6a1860
SHA512 4a5e5ef348de577e6cf261987702052869a8e82bb7abd4d0c20a40cc5dd0cdb282d1a0570c32789138beecc4ac275767ab80173881217fa500b989978f2189e0

memory/2352-8-0x0000000000400000-0x000000000086B000-memory.dmp

memory/2352-10-0x0000000000400000-0x0000000000415000-memory.dmp

memory/2352-9-0x0000000000020000-0x0000000000033000-memory.dmp

memory/2868-11-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2868-14-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2868-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2868-17-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2628-16-0x0000000000400000-0x000000000086B000-memory.dmp

memory/2868-18-0x0000000000080000-0x0000000000095000-memory.dmp