modiloader | 2f4dbe106abeb7bd9cb954ab1997d25cef95da32d614e6bb2cb962543d07b89f

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 04:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe
Size

356KB
MD5

497f7d69be6c9ba572ad8096d762eed9
SHA1

38c86a5632b5e9ea39dbc21096b3401dc8944e75
SHA256

2f4dbe106abeb7bd9cb954ab1997d25cef95da32d614e6bb2cb962543d07b89f
SHA512

3434b179cd56847dc3f588ec7aec22622416848bdeb5c38f569cf0b616417aaeb7e3ac13698f1e64764816ac86383df26dac1fc5990590077bbf38dcde383083
SSDEEP

6144:Sae/c0RVIqxFu4s2a9XHCd9hxJamsAT4k+wCGbfQfojzMBR5i:W/cMVDxFu43cHYf1TPCAxjzMU

Score

10^/10

modiloader evasion persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

mshta.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2604 2504 mshta.exe
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2504	mshta.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions regsvr32.exe
Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
evasion

File and Directory Discovery
T1083

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	regsvr32.exe

description	ioc	process
File opened (read-only)	C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys	regsvr32.exe

ModiLoader Second Stage 64 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1612-1-0x00000000001B0000-0x00000000001F7000-memory.dmp	modiloader_stage2
behavioral1/memory/1612-0-0x00000000001B0000-0x00000000001F7000-memory.dmp	modiloader_stage2
behavioral1/memory/1612-3-0x0000000000400000-0x000000000043E000-memory.dmp	modiloader_stage2
behavioral1/memory/1612-13-0x00000000023A0000-0x0000000002474000-memory.dmp	modiloader_stage2
behavioral1/memory/1612-14-0x00000000023A0000-0x0000000002474000-memory.dmp	modiloader_stage2
behavioral1/memory/1612-15-0x00000000023A0000-0x0000000002474000-memory.dmp	modiloader_stage2
behavioral1/memory/1612-18-0x00000000023A0000-0x0000000002474000-memory.dmp	modiloader_stage2
behavioral1/memory/1612-17-0x00000000023A0000-0x0000000002474000-memory.dmp	modiloader_stage2
behavioral1/memory/1612-16-0x00000000023A0000-0x0000000002474000-memory.dmp	modiloader_stage2
behavioral1/memory/1612-20-0x00000000023A0000-0x0000000002474000-memory.dmp	modiloader_stage2
behavioral1/memory/1612-21-0x00000000023A0000-0x0000000002474000-memory.dmp	modiloader_stage2
behavioral1/memory/1288-23-0x0000000000220000-0x0000000000267000-memory.dmp	modiloader_stage2
behavioral1/memory/1288-22-0x0000000000220000-0x0000000000267000-memory.dmp	modiloader_stage2
behavioral1/memory/1612-26-0x0000000000400000-0x000000000043E000-memory.dmp	modiloader_stage2
behavioral1/memory/1612-27-0x00000000023A0000-0x0000000002474000-memory.dmp	modiloader_stage2
behavioral1/memory/2556-31-0x0000000005C80000-0x0000000005D54000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-33-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-32-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-40-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-39-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-44-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-43-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-45-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-46-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-51-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-49-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-48-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-52-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-65-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-68-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-67-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/2556-34-0x00000000027B0000-0x00000000047B0000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-66-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-64-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-63-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-58-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-57-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-56-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-55-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-54-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-53-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/932-69-0x0000000000240000-0x000000000037E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-47-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-42-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-41-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-38-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-37-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-36-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/1820-50-0x00000000001E0000-0x000000000031E000-memory.dmp	modiloader_stage2
behavioral1/memory/2556-35-0x0000000005C80000-0x0000000005D54000-memory.dmp	modiloader_stage2
behavioral1/memory/932-83-0x0000000000240000-0x000000000037E000-memory.dmp	modiloader_stage2
behavioral1/memory/932-90-0x0000000000240000-0x000000000037E000-memory.dmp	modiloader_stage2
behavioral1/memory/932-88-0x0000000000240000-0x000000000037E000-memory.dmp	modiloader_stage2
behavioral1/memory/932-84-0x0000000000240000-0x000000000037E000-memory.dmp	modiloader_stage2
behavioral1/memory/932-82-0x0000000000240000-0x000000000037E000-memory.dmp	modiloader_stage2
behavioral1/memory/932-81-0x0000000000240000-0x000000000037E000-memory.dmp	modiloader_stage2
behavioral1/memory/932-80-0x0000000000240000-0x000000000037E000-memory.dmp	modiloader_stage2
behavioral1/memory/932-78-0x0000000000240000-0x000000000037E000-memory.dmp	modiloader_stage2
behavioral1/memory/932-77-0x0000000000240000-0x000000000037E000-memory.dmp	modiloader_stage2
behavioral1/memory/932-75-0x0000000000240000-0x000000000037E000-memory.dmp	modiloader_stage2
behavioral1/memory/932-74-0x0000000000240000-0x000000000037E000-memory.dmp	modiloader_stage2
behavioral1/memory/932-72-0x0000000000240000-0x000000000037E000-memory.dmp	modiloader_stage2
behavioral1/memory/932-71-0x0000000000240000-0x000000000037E000-memory.dmp	modiloader_stage2
behavioral1/memory/932-85-0x0000000000240000-0x000000000037E000-memory.dmp	modiloader_stage2

Looks for VMWare Tools registry key 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exeregsvr32.exe497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMWare, Inc.\VMWare Tools	497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMWare, Inc.\VMWare Tools	497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	regsvr32.exe

Deletes itself 1 IoCs

Processes:

regsvr32.exe

pid process

1820 regsvr32.exe
Drops startup file 1 IoCs

Processes:

regsvr32.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\162913.lnk regsvr32.exe
Executes dropped EXE 1 IoCs

Processes:

497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe

pid process

1288 497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe
Loads dropped DLL 2 IoCs

Processes:

497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe

pid process

1612 497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe
1612 497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe

pid	process
1820	regsvr32.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\162913.lnk	regsvr32.exe

pid	process
1288	497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\d71742\\cc24ba.lnk\""	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:NFWf4aNqG8=\"MxnfjtHDF\";XM4=new%20ActiveXObject(\"WScript.Shell\");Q3LAPlRn6h=\"EUi666nxq\";L8DwO2=XM4.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\ruqqchx\\\\uiksnqah\");zEyy9Pfq=\"mp\";eval(L8DwO2);sSN0jg8S=\"rqbw\";"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:js5Nczpm=\"1kRRNvYB\";Ax43=new%20ActiveXObject(\"WScript.Shell\");AhaKA0Lbo=\"i3921HO\";hd53cl=Ax43.RegRead(\"HKCU\\\\software\\\\ruqqchx\\\\uiksnqah\");D6XPLlso7q=\"NSFIhzG\";eval(hd53cl);ZoBR4kZf5=\"G8URZiD2yD\";"	regsvr32.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	regsvr32.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

powershell.exeregsvr32.exe

description	pid	process	target process
PID 2556 set thread context of 1820	2556	powershell.exe	regsvr32.exe
PID 1820 set thread context of 932	1820	regsvr32.exe	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International	regsvr32.exe

Modifies registry class 7 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\49de3d	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\49de3d\shell	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\49de3d\shell\open	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\49de3d\shell\open\command	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\49de3d\shell\open\command\ = "mshta \"javascript:mZsmIJ6L=\"ANgdJ0ov\";a5n6=new ActiveXObject(\"WScript.Shell\");Yr5RzMWgd=\"E5Jlq7\";J52NgP=a5n6.RegRead(\"HKCU\\\\software\\\\ruqqchx\\\\uiksnqah\");lvfoG54uNb=\"vt\";eval(J52NgP);QKUp5JWrj=\"EGtHFZ2w0O\";\""	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.c56af49	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.c56af49\ = "49de3d"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exepowershell.exeregsvr32.exe

pid	process
1612	497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe
1612	497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe
1288	497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe
1288	497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe
2556	powershell.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe
1820	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

powershell.exeregsvr32.exe

pid process

2556 powershell.exe
1820 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2556 powershell.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe

pid process

1612 497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe
1288 497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe

pid	process
2556	powershell.exe
1820	regsvr32.exe

description	pid	process
Token: SeDebugPrivilege	2556	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exemshta.exepowershell.exeregsvr32.exe

description	pid	process	target process
PID 1612 wrote to memory of 1288	1612	497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe	497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe
PID 1612 wrote to memory of 1288	1612	497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe	497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe
PID 1612 wrote to memory of 1288	1612	497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe	497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe
PID 1612 wrote to memory of 1288	1612	497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe	497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe
PID 2604 wrote to memory of 2556	2604	mshta.exe	powershell.exe
PID 2604 wrote to memory of 2556	2604	mshta.exe	powershell.exe
PID 2604 wrote to memory of 2556	2604	mshta.exe	powershell.exe
PID 2604 wrote to memory of 2556	2604	mshta.exe	powershell.exe
PID 2556 wrote to memory of 1820	2556	powershell.exe	regsvr32.exe
PID 2556 wrote to memory of 1820	2556	powershell.exe	regsvr32.exe
PID 2556 wrote to memory of 1820	2556	powershell.exe	regsvr32.exe
PID 2556 wrote to memory of 1820	2556	powershell.exe	regsvr32.exe
PID 2556 wrote to memory of 1820	2556	powershell.exe	regsvr32.exe
PID 2556 wrote to memory of 1820	2556	powershell.exe	regsvr32.exe
PID 2556 wrote to memory of 1820	2556	powershell.exe	regsvr32.exe
PID 2556 wrote to memory of 1820	2556	powershell.exe	regsvr32.exe
PID 1820 wrote to memory of 932	1820	regsvr32.exe	regsvr32.exe
PID 1820 wrote to memory of 932	1820	regsvr32.exe	regsvr32.exe
PID 1820 wrote to memory of 932	1820	regsvr32.exe	regsvr32.exe
PID 1820 wrote to memory of 932	1820	regsvr32.exe	regsvr32.exe
PID 1820 wrote to memory of 932	1820	regsvr32.exe	regsvr32.exe
PID 1820 wrote to memory of 932	1820	regsvr32.exe	regsvr32.exe
PID 1820 wrote to memory of 932	1820	regsvr32.exe	regsvr32.exe
PID 1820 wrote to memory of 932	1820	regsvr32.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VMWare Tools registry key
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1612

C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1288

C:\Windows\system32\mshta.exe
"C:\Windows\system32\mshta.exe" javascript:jsEymSQ90H="N4WU";a3J9=new%20ActiveXObject("WScript.Shell");K7TXr9FpnC="fv57A8bDM";rA3ZT6=a3J9.RegRead("HKLM\\software\\Wow6432Node\\M0QDVtD\\oCHKIb");F7OQmWS5S="XOeEXo";eval(rA3ZT6);mETB2HOX="U7P";
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2604

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:lousjjmc
2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe
3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Drops startup file
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\SysWOW64\regsvr32.exe"
4⤵
PID:932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

File and Directory Discovery

T1083

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\d71742\043bcc.c56af49
Filesize
37KB

MD5
2bd343bb964cf725dac91ac2e34e3bee

SHA1
c6e9388f0ed466722631ac5fa9f15d2e3eca0db2

SHA256
e9447ccbc9ee9c4a41a9fb57b5f3e094eeea4d95f76a3440de39ed1ef6ca4162

SHA512
f5d3ea9c0f8ee66ae9d417b10b2d0d000babe3fbc0b11c6cd70ac0c5c0e94d0bb2b2b159cfd19e2aa08b354bc71a884d7a91ebff00a47a2e115bb49c5ff50279

Download Submit
C:\Users\Admin\AppData\Local\d71742\cc24ba.lnk
Filesize
877B

MD5
4d1ae77a6903e358849a23f910595faa

SHA1
d432c1efd61f723afc867ddb6515863bf8fb9684

SHA256
b2caa9fc4a614bd92ce56468e42feabcdb9c626fb4d6c40938ce28cd57ce8511

SHA512
3b5ef948b6902fe571fae5e25274efe8ede531af44c42a6999ee3e77e5eda18f124fc21c3ef57c882d08f0c58efc845821dd8c97d293dce8e2bc16e77c705647

Download Submit
C:\Users\Admin\AppData\Local\d71742\ee03f2.bat
Filesize
61B

MD5
251c82732dbd03982f565deed73bb4f2

SHA1
2f903f60f1946953494fb995438cc2419abe59df

SHA256
4b67bfb9575e3dffcba2ad2d0c3b194119b1671d0e079ca9a2ff85b177d438f2

SHA512
1c6d1dd21ef660f870e23663b8f895f2255bf43830e93690217124a6b4a8cc563f97a4db145dd247b93bda3d49b7ef9d2ddf4ce58c72eccfb4609a356afd1344

Download Submit
C:\Users\Admin\AppData\Roaming\3aef84\6d4792.c56af49
Filesize
39KB

MD5
e392662ed9d96ae13715f3f00dd95246

SHA1
ed6f6c96f419ab63dcc35c12582b60a7fbc4e23c

SHA256
f73aca02015cd2a97a46acbcc0b1ea3c8652ee14c432b2602b5c7022a1050fc1

SHA512
9879e31edef5102361cd695f0912cd684489d4c32f6c915f2cdb79150e1a79e115f96bc3cd4c292952fd0630bb268bf24ed812d183683a5b98b12b08b382dbbb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\162913.lnk
Filesize
987B

MD5
c389f0136803df92b057ca593bc2a3e8

SHA1
fafda95114daaf02b2386f63a2119366a9dd0cd9

SHA256
2980352428bc2fe33e6c35662a8285dfab805fa2bd8402d34404d2e5a73f24e1

SHA512
d16e8ec8a2a93dbba2627fada5eda26829a4a8b19df35270c5bd9ee6bad22d92509386305e4eb39f482198b562ce64c6120870480b29690b9b4e411259ac1817

Download Submit
\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\497f7d69be6c9ba572ad8096d762eed9_JaffaCakes118.exe
Filesize
356KB

MD5
497f7d69be6c9ba572ad8096d762eed9

SHA1
38c86a5632b5e9ea39dbc21096b3401dc8944e75

SHA256
2f4dbe106abeb7bd9cb954ab1997d25cef95da32d614e6bb2cb962543d07b89f

SHA512
3434b179cd56847dc3f588ec7aec22622416848bdeb5c38f569cf0b616417aaeb7e3ac13698f1e64764816ac86383df26dac1fc5990590077bbf38dcde383083

Download Submit
memory/932-82-0x0000000000240000-0x000000000037E000-memory.dmp

Filesize
1.2MB

Download
memory/932-71-0x0000000000240000-0x000000000037E000-memory.dmp

Filesize
1.2MB

Download
memory/932-80-0x0000000000240000-0x000000000037E000-memory.dmp

Filesize
1.2MB

Download
memory/932-78-0x0000000000240000-0x000000000037E000-memory.dmp

Filesize
1.2MB

Download
memory/932-69-0x0000000000240000-0x000000000037E000-memory.dmp

Filesize
1.2MB

Download
memory/932-77-0x0000000000240000-0x000000000037E000-memory.dmp

Filesize
1.2MB

Download
memory/932-75-0x0000000000240000-0x000000000037E000-memory.dmp

Filesize
1.2MB

Download
memory/932-74-0x0000000000240000-0x000000000037E000-memory.dmp

Filesize
1.2MB

Download
memory/932-76-0x0000000000240000-0x000000000037E000-memory.dmp

Filesize
1.2MB

Download
memory/932-73-0x0000000000240000-0x000000000037E000-memory.dmp

Filesize
1.2MB

Download
memory/932-72-0x0000000000240000-0x000000000037E000-memory.dmp

Filesize
1.2MB

Download
memory/932-81-0x0000000000240000-0x000000000037E000-memory.dmp

Filesize
1.2MB

Download
memory/932-79-0x0000000000240000-0x000000000037E000-memory.dmp

Filesize
1.2MB

Download
memory/932-84-0x0000000000240000-0x000000000037E000-memory.dmp

Filesize
1.2MB

Download
memory/932-85-0x0000000000240000-0x000000000037E000-memory.dmp

Filesize
1.2MB

Download
memory/932-88-0x0000000000240000-0x000000000037E000-memory.dmp

Filesize
1.2MB

Download
memory/932-90-0x0000000000240000-0x000000000037E000-memory.dmp

Filesize
1.2MB

Download
memory/932-83-0x0000000000240000-0x000000000037E000-memory.dmp

Filesize
1.2MB

Download
memory/932-70-0x0000000000240000-0x000000000037E000-memory.dmp

Filesize
1.2MB

Download
memory/1288-22-0x0000000000220000-0x0000000000267000-memory.dmp

Filesize
284KB

Download
memory/1288-23-0x0000000000220000-0x0000000000267000-memory.dmp

Filesize
284KB

Download
memory/1612-17-0x00000000023A0000-0x0000000002474000-memory.dmp

Filesize
848KB

Download
memory/1612-116-0x00000000023A0000-0x0000000002474000-memory.dmp

Filesize
848KB

Download
memory/1612-1-0x00000000001B0000-0x00000000001F7000-memory.dmp

Filesize
284KB

Download
memory/1612-27-0x00000000023A0000-0x0000000002474000-memory.dmp

Filesize
848KB

Download
memory/1612-26-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1612-21-0x00000000023A0000-0x0000000002474000-memory.dmp

Filesize
848KB

Download
memory/1612-20-0x00000000023A0000-0x0000000002474000-memory.dmp

Filesize
848KB

Download
memory/1612-16-0x00000000023A0000-0x0000000002474000-memory.dmp

Filesize
848KB

Download
memory/1612-18-0x00000000023A0000-0x0000000002474000-memory.dmp

Filesize
848KB

Download
memory/1612-15-0x00000000023A0000-0x0000000002474000-memory.dmp

Filesize
848KB

Download
memory/1612-14-0x00000000023A0000-0x0000000002474000-memory.dmp

Filesize
848KB

Download
memory/1612-13-0x00000000023A0000-0x0000000002474000-memory.dmp

Filesize
848KB

Download
memory/1612-3-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1612-5-0x00000000002C0000-0x00000000002C5000-memory.dmp

Filesize
20KB

Download
memory/1612-4-0x00000000003E0000-0x00000000003E7000-memory.dmp

Filesize
28KB

Download
memory/1612-0-0x00000000001B0000-0x00000000001F7000-memory.dmp

Filesize
284KB

Download
memory/1820-32-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-51-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-47-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-42-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-41-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-38-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-37-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-36-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-50-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-33-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-54-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-55-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-56-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-57-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-58-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-63-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-64-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-66-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-40-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-67-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-68-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-65-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-52-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-48-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-49-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-53-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-46-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-45-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-43-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-44-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/1820-39-0x00000000001E0000-0x000000000031E000-memory.dmp

Filesize
1.2MB

Download
memory/2556-34-0x00000000027B0000-0x00000000047B0000-memory.dmp

Filesize
32.0MB

Download
memory/2556-35-0x0000000005C80000-0x0000000005D54000-memory.dmp

Filesize
848KB

Download
memory/2556-31-0x0000000005C80000-0x0000000005D54000-memory.dmp

Filesize
848KB

Download