Malware Analysis Report

2024-10-19 07:03

Sample ID 240507-dstnesaf65
Target 1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118
SHA256 3fc6e9efa5bb4b7feb57f13f51bd5cd016e502e8947cc2f27abeb7ab2df31ce8
Tags
modiloader evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3fc6e9efa5bb4b7feb57f13f51bd5cd016e502e8947cc2f27abeb7ab2df31ce8

Threat Level: Known bad

The file 1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

modiloader evasion persistence trojan

ModiLoader, DBatLoader

Process spawned unexpected child process

ModiLoader Second Stage

Checks for common network interception software

Looks for VirtualBox Guest Additions in registry

Looks for VirtualBox drivers on disk

Looks for VMWare Tools registry key

Deletes itself

Checks BIOS information in registry

Drops startup file

Adds Run key to start application

Maps connected drives based on registry

Drops file in System32 directory

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Modifies registry class

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-07 03:16

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-07 03:16

Reported

2024-05-07 03:19

Platform

win7-20240221-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\mshta.exe

Checks for common network interception software

evasion

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Windows\SysWOW64\regsvr32.exe N/A

Looks for VirtualBox drivers on disk

evasion
Description Indicator Process Target
File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys C:\Windows\SysWOW64\regsvr32.exe N/A

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Windows\SysWOW64\regsvr32.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\54b061.lnk C:\Windows\SysWOW64\regsvr32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:F8g7dgf=\"l2frMW06\";b2S0=new%20ActiveXObject(\"WScript.Shell\");dODq1wOm3=\"5BC\";LIQ0x=b2S0.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\jvvo\\\\xbawnqo\");rb0UU=\"dFNFlkRB\";eval(LIQ0x);Ua5VyHA=\"0g8\";" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:fXX3eIK=\"I5\";yY6=new%20ActiveXObject(\"WScript.Shell\");csD9i5G=\"LTg\";VpcC76=yY6.RegRead(\"HKCU\\\\software\\\\jvvo\\\\xbawnqo\");nBx7e=\"PlwOntx4\";eval(VpcC76);U7TstC7=\"T13cL7M\";" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\529d1c\\1bcd8a.lnk\"" C:\Windows\SysWOW64\regsvr32.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Windows\SysWOW64\regsvr32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\system32\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International C:\Windows\SysWOW64\regsvr32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ed42e7\shell\open C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ed42e7\shell\open\command C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ed42e7\shell\open\command\ = "\"C:\\Windows\\system32\\mshta.exe\" \"javascript:fAXhYKo89=\"m14k4yIE\";WK9=new ActiveXObject(\"WScript.Shell\");GpM3dv=\"v\";hlAU67=WK9.RegRead(\"HKCU\\\\software\\\\jvvo\\\\xbawnqo\");QBk5Yg0HH=\"V9\";eval(hlAU67);jh0wA8j=\"lft\";\"" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.cbe78f1 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.cbe78f1\ = "ed42e7" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ed42e7 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ed42e7\shell C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1912 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe
PID 1912 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe
PID 1912 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe
PID 1912 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe
PID 1912 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe
PID 1912 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe
PID 1912 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe
PID 1912 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe
PID 1912 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe
PID 2512 wrote to memory of 1940 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 1940 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 1940 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 1940 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1940 wrote to memory of 1784 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1940 wrote to memory of 1784 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1940 wrote to memory of 1784 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1940 wrote to memory of 1784 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1940 wrote to memory of 1784 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1940 wrote to memory of 1784 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1940 wrote to memory of 1784 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1940 wrote to memory of 1784 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1784 wrote to memory of 2100 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1784 wrote to memory of 2100 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1784 wrote to memory of 2100 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1784 wrote to memory of 2100 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1784 wrote to memory of 2100 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1784 wrote to memory of 2100 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1784 wrote to memory of 2100 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1784 wrote to memory of 2100 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe

C:\Windows\system32\mshta.exe

"C:\Windows\system32\mshta.exe" javascript:m3Tbh3="dMpnk5";F01H=new%20ActiveXObject("WScript.Shell");osq8xQ="GpdZ9S";RTV9I1=F01H.RegRead("HKLM\\software\\Wow6432Node\\EiMXRDav\\ZBIAdIM");VrqWeeg9="IRtj";eval(RTV9I1);gFDMNu9="dSSu";

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:xpcpm

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

Network

Country Destination Domain Proto
GB 82.3.255.238:80 tcp
IE 46.137.134.247:80 tcp
JP 126.33.156.222:8080 tcp
GB 25.45.10.125:80 tcp
US 142.88.34.28:80 tcp
CN 119.178.7.68:80 tcp
US 72.226.136.67:80 tcp
CN 36.102.138.35:443 tcp
US 23.245.30.97:8080 tcp
DE 91.33.220.183:80 tcp
NO 85.19.53.175:80 tcp
US 19.130.120.89:80 tcp
GB 25.47.115.238:80 tcp
US 32.144.83.177:80 tcp
US 98.83.125.180:8080 tcp
CN 59.198.131.103:80 tcp
US 69.75.174.67:80 tcp
FR 89.224.253.165:80 tcp
IN 17.76.71.89:80 tcp
TR 193.164.5.50:80 tcp
US 15.92.98.208:80 tcp
TR 193.164.5.50:80 193.164.5.50 tcp
TR 193.164.5.50:443 tcp
GB 86.183.128.185:80 tcp
US 44.38.184.178:80 tcp
KR 112.164.253.12:80 tcp
BR 179.116.250.204:80 tcp
IE 172.205.43.100:80 tcp
CN 36.212.18.202:80 tcp
GB 89.241.83.207:80 tcp
US 67.61.133.50:80 tcp
KR 218.158.161.173:80 tcp
US 97.172.127.127:8080 tcp
US 23.167.50.29:8080 tcp
JP 219.31.102.97:80 tcp
US 12.178.165.191:443 tcp
KR 14.95.76.92:80 tcp
SG 43.174.94.248:80 tcp
FR 88.182.42.203:8080 tcp
KR 112.218.229.102:80 tcp
CA 172.219.55.12:80 tcp
US 68.78.114.232:80 tcp
NL 194.122.34.169:8080 tcp
US 72.148.154.138:443 tcp
EG 41.238.109.247:80 tcp
SE 196.247.246.28:80 tcp
CN 59.64.98.128:80 tcp
IT 31.158.201.118:80 tcp
US 68.249.57.22:443 tcp
DK 62.243.160.193:80 tcp
US 2.16.126.245:80 tcp
BR 179.180.222.121:80 tcp
US 35.33.4.93:80 tcp
TR 31.176.71.255:80 tcp
BY 178.120.221.225:80 tcp
US 168.75.242.252:80 tcp
US 66.97.57.180:80 tcp
US 6.73.66.244:80 tcp
US 50.234.77.105:80 tcp
US 35.151.42.55:80 tcp
US 108.211.202.16:80 tcp
TW 36.225.34.58:80 tcp
BR 186.239.13.64:80 tcp
IN 13.235.130.157:80 tcp
US 169.15.93.73:443 tcp
CN 202.105.31.169:80 tcp
US 98.240.76.24:80 tcp
CN 119.187.70.159:80 tcp
BR 177.205.36.26:80 tcp
US 160.73.54.177:80 tcp
KR 1.176.7.85:80 tcp
CN 121.229.7.199:80 tcp
TH 163.171.64.41:80 tcp
US 165.225.35.165:80 tcp
CN 218.70.243.51:80 tcp
BE 194.50.177.18:80 tcp
US 140.229.103.74:443 tcp
US 184.139.52.126:80 tcp
US 157.166.180.193:80 tcp
US 104.236.80.136:80 tcp
FR 163.77.83.233:80 tcp
US 18.43.243.191:80 tcp
JP 220.43.97.142:80 tcp
US 159.182.115.97:80 tcp
TR 193.164.5.50:80 193.164.5.50 tcp
TR 193.164.5.50:443 tcp
AU 101.118.143.228:80 tcp
CN 210.87.72.119:80 tcp
CA 99.242.178.38:80 tcp
BR 179.216.130.118:80 tcp
GB 146.179.53.255:443 tcp
US 35.87.137.207:80 tcp
KR 183.105.71.209:80 tcp
US 108.79.77.208:80 tcp
ES 46.226.145.149:80 tcp
KR 61.251.115.102:8080 tcp
US 17.217.250.14:80 tcp
US 45.3.119.21:80 tcp
PL 89.67.55.243:80 tcp
JP 111.168.78.226:80 tcp
CN 183.224.76.78:80 tcp
JP 60.88.33.245:80 tcp
DE 51.89.98.51:8080 tcp
US 166.156.146.101:80 tcp
US 18.20.151.78:80 tcp
JP 160.248.163.223:80 tcp
US 132.46.51.219:80 tcp
JP 220.59.24.181:80 tcp
KR 14.91.241.185:80 tcp
HK 20.6.172.67:80 tcp
MY 49.125.135.69:80 tcp
MT 195.158.105.241:80 tcp
CN 112.101.11.120:80 tcp
US 76.146.114.132:80 tcp
TW 111.251.46.247:443 tcp
US 50.135.87.225:80 tcp
CN 175.66.111.32:443 tcp
US 44.61.115.7:80 tcp
JP 36.243.247.186:80 tcp
US 6.112.62.75:80 tcp
ID 118.98.244.160:80 tcp
CN 117.65.105.24:80 tcp
US 73.142.230.128:80 tcp
US 64.236.191.195:80 tcp
US 29.81.114.224:80 tcp
US 52.54.97.38:80 tcp
US 135.209.59.245:443 tcp
US 45.62.149.163:80 tcp
US 24.233.37.99:80 tcp
MY 115.164.251.39:80 tcp
EG 41.128.228.49:80 tcp
ZA 196.28.220.131:80 tcp
BE 81.240.145.159:80 tcp
US 144.111.2.135:80 tcp
JP 114.181.65.240:8080 tcp
US 44.1.92.128:80 tcp
PL 109.243.94.11:80 tcp
SE 151.156.171.235:80 tcp
BR 200.147.21.67:80 tcp
HK 154.218.74.106:80 tcp
SG 52.230.62.160:443 tcp
IL 80.244.167.86:80 tcp
US 17.198.176.59:80 tcp
BE 109.143.1.113:80 tcp

Files

memory/2216-2-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2216-12-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2216-13-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2216-10-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2216-6-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2216-8-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2216-0-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2216-4-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2216-17-0x0000000001DE0000-0x0000000001EB6000-memory.dmp

memory/2216-18-0x0000000001DE0000-0x0000000001EB6000-memory.dmp

memory/2216-15-0x0000000001DE0000-0x0000000001EB6000-memory.dmp

memory/2216-16-0x0000000001DE0000-0x0000000001EB6000-memory.dmp

memory/2216-14-0x0000000001DE0000-0x0000000001EB6000-memory.dmp

memory/2216-19-0x0000000001DE0000-0x0000000001EB6000-memory.dmp

memory/2216-20-0x0000000001DE0000-0x0000000001EB6000-memory.dmp

memory/1940-29-0x00000000060E0000-0x00000000061B6000-memory.dmp

memory/1784-31-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-33-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1940-34-0x00000000060E0000-0x00000000061B6000-memory.dmp

memory/1784-38-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-35-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-41-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-36-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-44-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-37-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-48-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-39-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-40-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-43-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-42-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-46-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-52-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-74-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-66-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-65-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-67-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-64-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-63-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-62-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-57-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-56-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-55-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-54-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-53-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-51-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-50-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-49-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-47-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1784-45-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/2100-77-0x0000000000250000-0x0000000000391000-memory.dmp

memory/2100-76-0x0000000000250000-0x0000000000391000-memory.dmp

memory/2100-80-0x0000000000250000-0x0000000000391000-memory.dmp

memory/2100-75-0x0000000000250000-0x0000000000391000-memory.dmp

memory/2100-79-0x0000000000250000-0x0000000000391000-memory.dmp

memory/2100-78-0x0000000000250000-0x0000000000391000-memory.dmp

C:\Users\Admin\AppData\Local\529d1c\4bd7f2.bat

MD5 7f145f9c460ee7bb55a3e7ad72a65f86
SHA1 39a73f2119c72ae27a166fff9ceb13859f6ac21b
SHA256 16e3704ce7a5f142fe817cd42cf9fd214341caf20a284c439457feb84515ddad
SHA512 1bfbf2931d904ae08d6552267b918e8f7e6cce6d142f0c950c74e2e601dc3cf36428fcddf67ad3cae1acb565edf4871c0c3c165be88c34d3c81b68b8d7c1a75f

C:\Users\Admin\AppData\Roaming\4f4be6\d3bc4d.cbe78f1

MD5 a5023c4aba53181cc11d540e61d2ca61
SHA1 a8c8e95495feba63618c7550b303d631643dbd85
SHA256 3ec37de2c88a330d30cac07e12d4cda2b454352537c293bae55f8a7a25bb0f35
SHA512 d6b46a6b8a6502c140cf457ed1a41fc13d97c4c9bfceb950fd201643d0e56718b39898170b72652a9d8f3530297f46e4586f0043bbed252f54f91a38ce4c10eb

C:\Users\Admin\AppData\Local\529d1c\1bcd8a.lnk

MD5 66f141815a70dd94938f54490a6cb21d
SHA1 4615bdba8e80e4f04438ed1ba363510f15a25d00
SHA256 ac06e7109ee99802be05d03e51b97b483ee627ce48bb69908424a9151fd33129
SHA512 63cab3b4f6539ea8715ae65f9b0b2c702b20008aeeadd572dc607099e1c12f08e842130065d3fa0dde7b5ef71e7a196b4020a409a17bfc188ff0b9e200d89e42

C:\Users\Admin\AppData\Local\529d1c\7fd902.cbe78f1

MD5 31a74cc3c704cbe8944c226fbedf1a2d
SHA1 bfe74df136ebe86e474b77d485994c7aa791d60b
SHA256 3a942d30a45ff6021fa92559381af77ec414347502a9d55b45732285ccc7b33b
SHA512 7f9b3105aa4f7d37b2b6dd8bfe1c98570dd4efc0399772406d8e4e2ce40903690dd3be0fda4b62e487f7c760e8f7e891631c96106fb502eddbfd9395eb999128

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\54b061.lnk

MD5 48c37ed818e3e1b986f0e65de0abb48d
SHA1 61b0b3bb1018c09543c0d3f37ec8458dc0434432
SHA256 945cbd049408f030e3d7439aa896370ee8a8e1c20ecbb682e40b2d30288e3902
SHA512 8ad5426187a832409cefc9964022ed792160f68b9dfb0611ce42980fb90b6663070cffb502df41db64a93486469107511095f83a26d1018ad4003d51efe26a41

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-07 03:16

Reported

2024-05-07 03:19

Platform

win10v2004-20240419-en

Max time kernel

133s

Max time network

103s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1f4493c6c315bbc9277f1ad5e1e1953d_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 142.53.16.96.in-addr.arpa udp
US 8.8.8.8:53 48.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

N/A