Malware Analysis Report

2024-10-23 19:36

Sample ID 240506-qf57xafg79
Target 1ca7a86d670b20eff76f23edb47d95a4_JaffaCakes118
SHA256 dfa9b0480ef434ec912d51ae47f0d6abd8647fd072c24989e3f3b293bc3af2f2
Tags
modiloader evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

dfa9b0480ef434ec912d51ae47f0d6abd8647fd072c24989e3f3b293bc3af2f2

Threat Level: Known bad

The file 1ca7a86d670b20eff76f23edb47d95a4_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

modiloader evasion persistence trojan

ModiLoader, DBatLoader

Process spawned unexpected child process

ModiLoader Second Stage

Looks for VirtualBox drivers on disk

Checks for common network interception software

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks computer location settings

Checks BIOS information in registry

Deletes itself

Maps connected drives based on registry

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in System32 directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Modifies Internet Explorer settings

Suspicious behavior: MapViewOfSection

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-06 13:13

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-06 13:13

Reported

2024-05-06 13:15

Platform

win7-20240221-en

Max time kernel

150s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1ca7a86d670b20eff76f23edb47d95a4_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\mshta.exe

Checks for common network interception software

evasion

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Windows\SysWOW64\regsvr32.exe N/A

Looks for VirtualBox drivers on disk

evasion
Description Indicator Process Target
File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys C:\Windows\SysWOW64\regsvr32.exe N/A

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Windows\SysWOW64\regsvr32.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\26ada5\\38e275.bat\"" C:\Windows\SysWOW64\regsvr32.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Windows\SysWOW64\regsvr32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2528 set thread context of 1052 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1052 set thread context of 1820 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\system32\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International C:\Windows\SysWOW64\regsvr32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\85927d C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\85927d\shell C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\85927d\shell\open C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\85927d\shell\open\command C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\85927d\shell\open\command\ = "\"C:\\Windows\\system32\\mshta.exe\" \"javascript:u48lTQO=\"JgXLPt2\";b3g=new ActiveXObject(\"WScript.Shell\");o1Arp=\"VFOdzF\";u2hOb=b3g.RegRead(\"HKCU\\\\software\\\\ruqqchx\\\\uiksnqah\");cu6iDZmA=\"dcn\";eval(u2hOb);aDfD70=\"vzDT2\";\"" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.8aa1d52 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.8aa1d52\ = "85927d" C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2628 wrote to memory of 2528 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2628 wrote to memory of 2528 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2628 wrote to memory of 2528 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2628 wrote to memory of 2528 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2528 wrote to memory of 1052 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2528 wrote to memory of 1052 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2528 wrote to memory of 1052 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2528 wrote to memory of 1052 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2528 wrote to memory of 1052 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2528 wrote to memory of 1052 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2528 wrote to memory of 1052 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2528 wrote to memory of 1052 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1052 wrote to memory of 1820 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1052 wrote to memory of 1820 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1052 wrote to memory of 1820 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1052 wrote to memory of 1820 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1052 wrote to memory of 1820 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1052 wrote to memory of 1820 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1052 wrote to memory of 1820 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1052 wrote to memory of 1820 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1ca7a86d670b20eff76f23edb47d95a4_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1ca7a86d670b20eff76f23edb47d95a4_JaffaCakes118.exe"

C:\Windows\system32\mshta.exe

"C:\Windows\system32\mshta.exe" javascript:bb1RuS9p="uU";ic57=new%20ActiveXObject("WScript.Shell");SI1ZTMcn7="j";XYV0B5=ic57.RegRead("HKCU\\software\\Rm2JA54Nv\\Da31kFKvUj");dT4Ze="o";eval(XYV0B5);FnAt2QtN="a";

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:ribovmh

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

Network

Country Destination Domain Proto
US 12.45.17.52:443 tcp
JP 122.17.160.5:443 tcp
EC 190.216.208.6:443 tcp
KR 222.105.209.233:8080 tcp
RU 82.179.148.25:443 tcp
US 18.172.182.125:443 tcp
IE 185.178.64.175:80 tcp
US 173.51.217.65:80 tcp
US 18.172.182.125:443 18.172.182.125 tcp
CN 110.53.127.199:80 tcp
US 169.67.100.9:443 tcp
TW 125.228.241.205:80 tcp
US 173.228.46.113:80 tcp
KR 221.158.220.253:80 tcp
US 151.199.204.41:443 tcp
DE 91.35.192.187:80 tcp
RU 144.206.127.91:443 tcp
US 22.227.120.62:80 tcp
US 134.224.136.162:80 tcp
US 208.174.116.190:80 tcp
LV 81.198.208.166:80 tcp
ES 85.53.112.118:443 tcp
DE 84.44.186.86:80 tcp
CN 116.162.130.249:80 tcp
US 45.27.31.51:80 tcp
CA 156.34.97.156:443 tcp
JP 100.170.248.5:8080 tcp
US 99.190.9.65:443 tcp
US 168.54.163.135:80 tcp
CN 111.139.47.87:80 tcp
US 65.132.180.216:80 tcp
HK 154.203.51.178:80 tcp
HK 154.203.51.178:80 154.203.51.178 tcp
JP 60.46.120.87:443 tcp
JP 180.36.40.219:80 tcp
JP 150.53.246.252:80 tcp
US 44.42.129.183:80 tcp
ID 39.249.228.163:443 tcp
GR 178.23.73.3:80 tcp
US 17.42.176.151:80 tcp
US 158.238.108.132:443 tcp
NG 102.67.36.81:443 tcp
US 138.196.26.194:443 tcp
US 148.48.8.54:8080 tcp
CN 118.253.47.156:443 tcp
IR 151.245.57.160:80 tcp
GB 81.2.139.170:443 tcp
US 70.228.135.87:8080 tcp
US 144.34.12.12:80 tcp
CN 1.85.221.153:80 tcp
US 146.151.145.186:443 tcp
PK 111.119.172.219:80 tcp
IT 185.8.122.228:80 tcp
PK 111.119.172.219:80 111.119.172.219 tcp
US 55.122.89.50:443 tcp
US 21.126.103.124:80 tcp
US 15.46.227.158:80 tcp
US 173.57.20.16:80 tcp
JP 180.25.225.51:80 tcp
US 67.110.249.172:80 tcp
IT 88.60.54.114:80 tcp
US 131.106.238.155:80 tcp
US 99.196.216.198:443 tcp
CN 27.191.192.238:80 tcp
HK 118.142.77.211:443 tcp
US 135.154.108.241:443 tcp
US 129.152.132.82:443 tcp
US 33.181.143.123:443 tcp
US 55.4.30.180:443 tcp
FI 83.102.18.25:80 tcp
EG 197.194.166.214:443 tcp
ID 39.240.165.248:80 tcp
US 100.154.144.147:80 tcp
UA 46.211.81.164:80 tcp
DE 49.12.91.60:443 tcp
KR 112.187.155.238:80 tcp
US 19.254.162.45:80 tcp
US 65.186.32.73:80 tcp
DE 85.205.219.49:8080 tcp
HU 217.113.52.23:80 tcp
US 208.134.112.166:80 tcp
JP 150.52.228.12:80 tcp
MX 187.239.11.1:443 tcp
US 158.11.132.196:443 tcp
US 52.27.117.118:443 tcp
US 147.155.83.49:443 tcp
US 151.201.252.192:80 tcp
US 69.132.35.249:80 tcp
NL 2.20.169.50:80 tcp
VE 190.170.253.88:80 tcp
US 3.210.54.10:443 tcp
US 30.215.212.166:443 tcp
CZ 85.162.21.46:443 tcp
DE 2.214.86.1:80 tcp
BR 187.125.122.230:80 tcp
N/A 130.12.113.33:80 tcp
JP 203.180.15.42:443 tcp
US 18.74.245.222:80 tcp
N/A 10.71.32.255:8080 tcp
US 138.76.89.84:80 tcp
US 66.215.18.86:443 tcp
CN 1.89.146.27:80 tcp
US 209.60.170.90:80 tcp
JP 221.116.184.206:80 tcp
HK 203.198.231.66:443 tcp
CN 42.180.97.202:443 tcp
CN 110.193.92.39:80 tcp
US 150.198.240.11:443 tcp
US 138.78.111.38:443 tcp
GB 89.213.129.234:443 tcp
PE 190.235.232.183:80 tcp
HK 47.75.213.229:80 tcp
US 52.73.107.144:80 tcp
RU 213.159.194.4:443 tcp
PL 46.243.158.185:80 tcp
IE 57.194.60.115:80 tcp
KR 3.38.82.245:443 tcp
CN 110.99.228.252:443 tcp
KR 3.38.82.245:443 3.38.82.245 tcp
US 11.153.81.150:80 tcp
IT 151.12.240.113:80 tcp
NL 86.90.182.110:443 tcp
US 209.3.5.238:80 tcp
TH 61.90.158.92:80 tcp
SD 102.124.217.249:443 tcp
FR 212.47.252.81:443 tcp
US 75.41.140.84:80 tcp
FR 212.47.252.81:443 tcp
FR 212.47.252.81:443 tcp
FR 212.47.252.81:443 tcp
FR 212.47.252.81:443 tcp
FR 212.47.252.81:80 212.47.252.81 tcp
US 12.200.150.105:80 tcp
US 71.218.51.45:443 tcp
IT 217.223.49.128:80 tcp
US 209.222.185.169:443 tcp
US 108.105.163.107:443 tcp
UA 176.98.17.152:443 tcp
EG 197.163.149.180:443 tcp
US 48.35.216.212:443 tcp
JP 222.7.149.67:80 tcp
AU 120.20.87.253:443 tcp
KE 41.81.56.34:443 tcp
US 19.203.208.30:80 tcp
N/A 10.64.205.147:80 tcp
CN 123.247.206.70:443 tcp
US 70.160.208.12:443 tcp
US 67.4.169.170:8080 tcp
CN 183.49.233.159:443 tcp
MZ 197.249.177.15:443 tcp
US 174.9.174.120:80 tcp
US 209.193.98.94:443 tcp
MX 187.196.165.247:443 tcp
JP 126.242.151.38:443 tcp
GB 95.138.170.46:443 tcp
US 13.10.192.208:443 tcp
TW 125.230.159.175:80 tcp
JP 61.215.89.178:443 tcp
US 96.184.175.135:80 tcp
US 74.204.60.104:443 tcp
US 33.161.94.155:8080 tcp
JP 43.223.250.236:80 tcp
KR 42.46.190.184:8080 tcp
US 9.10.97.236:443 tcp
US 216.62.78.68:80 tcp
DE 91.23.25.226:8080 tcp
MX 187.244.247.90:80 tcp
NL 80.112.128.162:443 tcp
MQ 109.62.69.242:443 tcp
US 171.170.62.18:80 tcp
AU 58.166.59.144:443 tcp
US 155.67.129.253:443 tcp
CN 42.83.64.101:80 tcp
CN 116.156.199.3:443 tcp
CA 72.251.63.226:443 tcp
US 130.245.55.102:80 tcp
KR 210.210.213.135:80 tcp
US 24.149.127.208:8080 tcp
US 208.179.77.142:80 tcp
US 198.179.157.119:443 tcp
US 168.103.68.194:443 tcp
BR 200.151.174.115:80 tcp
US 204.48.41.245:80 tcp
CN 159.75.158.50:443 tcp
US 135.51.53.167:80 tcp
US 71.153.234.253:443 tcp
KR 211.185.15.103:443 tcp
HR 31.147.66.238:8080 tcp
US 152.82.35.233:8080 tcp
MA 102.99.134.90:80 tcp
JP 220.27.14.9:443 tcp
JP 114.190.8.136:443 tcp
GB 159.104.116.117:443 tcp
FR 84.103.139.35:443 tcp
US 28.183.152.42:443 tcp
CN 113.64.255.71:443 tcp
US 19.164.106.155:443 tcp
US 44.141.112.137:80 tcp
N/A 10.87.249.85:443 tcp
KR 59.3.150.84:8080 tcp
US 136.30.75.68:443 tcp
US 137.179.228.30:80 tcp
US 143.66.68.209:443 tcp
GB 195.166.49.88:443 tcp
CA 51.161.97.118:80 tcp
US 97.22.233.207:80 tcp
US 204.29.92.112:8080 tcp
US 152.124.19.89:443 tcp
US 30.88.13.23:8080 tcp
JP 115.125.35.150:443 tcp
IT 95.236.163.250:80 tcp
US 168.173.248.131:8080 tcp
US 26.39.87.228:443 tcp
US 169.233.113.231:8080 tcp
BR 200.17.128.176:80 tcp
HK 43.154.155.202:443 tcp
BR 186.203.240.49:80 tcp
RU 178.211.184.3:443 tcp
IT 87.30.193.133:80 tcp
CN 123.180.72.18:443 tcp
US 11.99.98.1:443 tcp
RU 128.72.36.68:80 tcp
US 15.43.26.252:443 tcp
US 30.85.3.64:80 tcp
TW 42.75.22.234:80 tcp
US 198.43.49.108:443 tcp
JP 60.56.71.148:443 tcp
US 143.140.122.123:8080 tcp
SG 161.117.110.24:443 tcp
GR 188.4.156.11:443 tcp
CN 223.145.83.2:80 tcp
SG 43.52.86.239:8080 tcp
US 208.160.86.110:8080 tcp
US 169.18.37.255:80 tcp
CN 116.174.232.7:80 tcp
NL 82.201.34.58:80 tcp
DE 87.174.88.114:443 tcp
CN 175.93.53.105:80 tcp
US 143.14.95.184:80 tcp
N/A 5.131.189.27:80 tcp

Files

memory/1440-0-0x0000000000455000-0x0000000000457000-memory.dmp

memory/1440-1-0x0000000000400000-0x000000000045D5E8-memory.dmp

memory/1440-2-0x0000000001DE0000-0x0000000001EBC000-memory.dmp

memory/1440-3-0x0000000000400000-0x000000000045D5E8-memory.dmp

memory/1440-4-0x0000000001DE0000-0x0000000001EBC000-memory.dmp

memory/1440-5-0x0000000001DE0000-0x0000000001EBC000-memory.dmp

memory/1440-7-0x0000000001DE0000-0x0000000001EBC000-memory.dmp

memory/1440-8-0x0000000001DE0000-0x0000000001EBC000-memory.dmp

memory/1440-9-0x0000000001DE0000-0x0000000001EBC000-memory.dmp

memory/1440-14-0x0000000000455000-0x0000000000457000-memory.dmp

memory/2528-15-0x0000000004F90000-0x0000000004F91000-memory.dmp

memory/2528-16-0x0000000005BD0000-0x0000000005CAC000-memory.dmp

memory/1052-17-0x0000000000250000-0x000000000039A000-memory.dmp

memory/2528-19-0x0000000005BD0000-0x0000000005CAC000-memory.dmp

memory/1052-20-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-24-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-27-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-38-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-37-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-54-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-53-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-52-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-51-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-50-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-49-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-48-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-43-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-42-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1820-74-0x0000000000180000-0x00000000002CA000-memory.dmp

memory/1820-73-0x0000000000180000-0x00000000002CA000-memory.dmp

memory/1820-72-0x0000000000180000-0x00000000002CA000-memory.dmp

memory/1820-71-0x0000000000180000-0x00000000002CA000-memory.dmp

memory/1820-70-0x0000000000180000-0x00000000002CA000-memory.dmp

memory/1820-69-0x0000000000180000-0x00000000002CA000-memory.dmp

memory/1820-68-0x0000000000180000-0x00000000002CA000-memory.dmp

memory/1820-67-0x0000000000180000-0x00000000002CA000-memory.dmp

memory/1820-66-0x0000000000180000-0x00000000002CA000-memory.dmp

memory/1820-65-0x0000000000180000-0x00000000002CA000-memory.dmp

memory/1820-64-0x0000000000180000-0x00000000002CA000-memory.dmp

memory/1820-63-0x0000000000180000-0x00000000002CA000-memory.dmp

memory/1820-62-0x0000000000180000-0x00000000002CA000-memory.dmp

memory/1820-61-0x0000000000180000-0x00000000002CA000-memory.dmp

memory/1820-60-0x0000000000180000-0x00000000002CA000-memory.dmp

memory/1820-59-0x0000000000180000-0x00000000002CA000-memory.dmp

memory/1820-58-0x0000000000180000-0x00000000002CA000-memory.dmp

memory/1820-57-0x0000000000180000-0x00000000002CA000-memory.dmp

memory/1052-41-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-40-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-39-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-36-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-35-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-34-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-33-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-32-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-31-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-30-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-28-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-25-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-23-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-22-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-29-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-26-0x0000000000250000-0x000000000039A000-memory.dmp

memory/1052-21-0x0000000000250000-0x000000000039A000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar9A9.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\Local\26ada5\38e275.bat

MD5 04ffd58884ec8e97a87df5da3b5b4a57
SHA1 fe18c05de80d70dc2c720cbbf9ab1fc7362ebb69
SHA256 fded370dd0956b9099efbb98735cb274376ee308900d1f87505660a547be9568
SHA512 7166f0c692171087d00e294d6cc288d9e943157ba6171242984cd9985592c69e78c297961a687e93800b5d509da0cf51f18e4e77ec153da0e6903c8edde28a65

C:\Users\Admin\AppData\Local\26ada5\82963c.8aa1d52

MD5 234840cbcfa7875b3bc59329695465d1
SHA1 c770ed18fa2789cb9b2e2fb6c3a175a7310429a4
SHA256 7dd7ceb5abce8131128ba68c2a9aaae4fa4c2f98aa65d0d2feaa161cac064215
SHA512 73c324e2bbb16311848fd30ad7ed19042639a44c8509c40ab723f74d6ec81bfd68436423421e2a960e82e8aa3645ffddce9ff878ad1e6c21df47b675ad7b3eb6

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-06 13:13

Reported

2024-05-06 13:15

Platform

win10v2004-20240419-en

Max time kernel

141s

Max time network

103s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1ca7a86d670b20eff76f23edb47d95a4_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\mshta.exe

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation C:\Windows\system32\mshta.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Software\Microsoft\Internet Explorer\International\CpMRU C:\Windows\system32\mshta.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" C:\Windows\system32\mshta.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10" C:\Windows\system32\mshta.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" C:\Windows\system32\mshta.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" C:\Windows\system32\mshta.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Cache = b104000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\mshta.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2068 wrote to memory of 4552 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2068 wrote to memory of 4552 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2068 wrote to memory of 4552 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1ca7a86d670b20eff76f23edb47d95a4_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1ca7a86d670b20eff76f23edb47d95a4_JaffaCakes118.exe"

C:\Windows\system32\mshta.exe

"C:\Windows\system32\mshta.exe" javascript:l3Rq8x="IsL";m0p=new%20ActiveXObject("WScript.Shell");sYu4HQ6w="K";RGo9L=m0p.RegRead("HKCU\\software\\KZInrqS97\\1hAqQpU6");bmX35l="MRfdz1i";eval(RGo9L);OI3kay="VA";

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:fbbwhz

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 35.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 51.15.97.104.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp

Files

memory/4364-0-0x0000000000455000-0x0000000000457000-memory.dmp

memory/4364-1-0x0000000000400000-0x000000000045D5E8-memory.dmp

memory/4364-2-0x00000000021E0000-0x00000000022BC000-memory.dmp

memory/4364-5-0x00000000021E0000-0x00000000022BC000-memory.dmp

memory/4364-6-0x00000000021E0000-0x00000000022BC000-memory.dmp

memory/4364-7-0x0000000000400000-0x000000000045D5E8-memory.dmp

memory/4364-3-0x00000000021E0000-0x00000000022BC000-memory.dmp

memory/4364-8-0x00000000021E0000-0x00000000022BC000-memory.dmp

memory/4364-4-0x00000000021E0000-0x00000000022BC000-memory.dmp

memory/4364-9-0x00000000021E0000-0x00000000022BC000-memory.dmp

memory/4552-11-0x00000000051C0000-0x00000000051F6000-memory.dmp

memory/4552-12-0x0000000005850000-0x0000000005E78000-memory.dmp

memory/4552-15-0x0000000005F60000-0x0000000005FC6000-memory.dmp

memory/4552-14-0x0000000005EF0000-0x0000000005F56000-memory.dmp

memory/4552-13-0x0000000005800000-0x0000000005822000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sdp0rlcm.hga.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4552-25-0x0000000006060000-0x00000000063B4000-memory.dmp

memory/4552-26-0x00000000065B0000-0x00000000065CE000-memory.dmp

memory/4552-27-0x00000000065F0000-0x000000000663C000-memory.dmp

memory/4552-28-0x0000000007CD0000-0x000000000834A000-memory.dmp

memory/4552-29-0x0000000007690000-0x00000000076AA000-memory.dmp

memory/4364-34-0x0000000000455000-0x0000000000457000-memory.dmp