Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	C:\Windows\SysWOW64\regsvr32.exe	N/A

Looks for VirtualBox drivers on disk

evasion

Description	Indicator	Process	Target
File opened (read-only)	C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys	C:\Windows\SysWOW64\regsvr32.exe	N/A

ModiLoader Second Stage

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Looks for VMWare Tools registry key

evasion

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	C:\Windows\SysWOW64\regsvr32.exe	N/A

Checks BIOS information in registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	C:\Windows\SysWOW64\regsvr32.exe	N/A

Deletes itself

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A

Drops startup file

Description	Indicator	Process	Target
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\162913.lnk	C:\Windows\SysWOW64\regsvr32.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:FBK0Sm5Z=\"Z6hR5TXk\";h2A6=new%20ActiveXObject(\"WScript.Shell\");L4wieK=\"T\";K6GI3o=h2A6.RegRead(\"HKCU\\\\software\\\\ruqqchx\\\\uiksnqah\");mMa0Nw=\"E4drt7t\";eval(K6GI3o);NbjeCYW73=\"BFuvOd8K\";"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\d71742\\cc24ba.lnk\""	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:dDM9d3=\"Pf8zS\";Zf6=new%20ActiveXObject(\"WScript.Shell\");Yc4eCkW=\"w1Z8q0C\";kmp2K=Zf6.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\ruqqchx\\\\uiksnqah\");gmzWY2g1=\"VvIJkeUe\";eval(kmp2K);i4oe1H=\"W6JmXhQ\";"	C:\Windows\SysWOW64\regsvr32.exe	N/A

Maps connected drives based on registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	C:\Windows\SysWOW64\regsvr32.exe	N/A

Drops file in System32 directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 2224 set thread context of 1684	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe
PID 948 set thread context of 432	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 432 set thread context of 2524	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International	C:\Windows\SysWOW64\regsvr32.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.c56af49\ = "49de3d"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\49de3d	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\49de3d\shell	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\49de3d\shell\open	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\49de3d\shell\open\command	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\49de3d\shell\open\command\ = "\"C:\\Windows\\system32\\mshta.exe\" \"javascript:AoM89ADS=\"AjX3t\";H6e5=new ActiveXObject(\"WScript.Shell\");qlN0G=\"0RA\";b4qew=H6e5.RegRead(\"HKCU\\\\software\\\\ruqqchx\\\\uiksnqah\");i86ODqDq=\"Fdd\";eval(b4qew);zjlNiM4w=\"9\";\""	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.c56af49	C:\Windows\SysWOW64\regsvr32.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2224 wrote to memory of 1684	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe
PID 2224 wrote to memory of 1684	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe
PID 2224 wrote to memory of 1684	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe
PID 2224 wrote to memory of 1684	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe
PID 2224 wrote to memory of 1684	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe
PID 2224 wrote to memory of 1684	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe
PID 2224 wrote to memory of 1684	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe
PID 2224 wrote to memory of 1684	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe
PID 2224 wrote to memory of 1684	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe
PID 2224 wrote to memory of 1684	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe
PID 2224 wrote to memory of 1684	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe
PID 1568 wrote to memory of 948	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1568 wrote to memory of 948	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1568 wrote to memory of 948	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1568 wrote to memory of 948	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 948 wrote to memory of 432	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 948 wrote to memory of 432	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 948 wrote to memory of 432	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 948 wrote to memory of 432	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 948 wrote to memory of 432	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 948 wrote to memory of 432	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 948 wrote to memory of 432	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 948 wrote to memory of 432	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 432 wrote to memory of 2524	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 432 wrote to memory of 2524	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 432 wrote to memory of 2524	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 432 wrote to memory of 2524	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 432 wrote to memory of 2524	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 432 wrote to memory of 2524	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 432 wrote to memory of 2524	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 432 wrote to memory of 2524	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe"

C:\Windows\system32\mshta.exe

"C:\Windows\system32\mshta.exe" javascript:gCtNJW7v1="f";m3S=new%20ActiveXObject("WScript.Shell");X0bZiyf="o0";XI1sJ=m3S.RegRead("HKLM\\software\\Wow6432Node\\N4Y7zbrdHc\\nUjASBk");E4h0ydnAN="gHwg";eval(XI1sJ);X7kEP="OQc1T2CE";

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:muvpu

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

Network

Country	Destination	Domain	Proto
US	170.28.222.220:80		tcp
FR	88.179.10.213:80		tcp
FR	77.146.184.108:80		tcp
JP	221.190.179.141:80		tcp
GB	25.217.20.97:443		tcp
CN	120.193.80.42:80		tcp
US	158.137.71.142:80		tcp
AU	129.94.57.196:80		tcp
GB	212.250.149.82:80		tcp
CH	80.242.193.70:80		tcp
AR	190.113.189.83:80		tcp
JP	150.40.18.64:80		tcp
US	70.197.20.33:80		tcp
CO	191.77.246.187:80		tcp
CN	117.35.213.53:80		tcp
US	139.87.31.82:80		tcp
BR	186.239.156.202:80		tcp
BR	189.95.147.190:80		tcp
JP	123.226.219.240:80		tcp
JP	14.14.146.96:80		tcp
US	136.103.224.140:80		tcp
US	206.2.198.198:80		tcp
US	76.28.47.165:80		tcp
CA	153.85.220.45:80		tcp
CN	116.22.153.83:80		tcp
US	216.117.66.242:80		tcp
US	206.2.198.198:80	206.2.198.198	tcp
BR	191.54.40.164:80		tcp
DE	188.99.110.232:80		tcp
IT	2.229.181.92:8080		tcp
SE	109.238.138.116:80		tcp
CN	61.150.63.164:80		tcp
IT	82.49.221.91:80		tcp
IT	81.123.121.16:80		tcp
US	67.185.234.139:443		tcp
US	199.133.139.28:80		tcp
AU	110.142.148.232:80		tcp
EG	105.89.34.48:80		tcp
GB	2.96.62.115:80		tcp
US	155.122.141.163:80		tcp
US	28.201.187.7:80		tcp
US	98.108.151.105:80		tcp
US	54.30.10.99:80		tcp
US	208.35.15.20:80		tcp
CN	112.97.195.68:80		tcp
US	139.245.87.36:80		tcp
AU	203.6.95.68:80		tcp
EG	41.46.124.153:80		tcp
US	28.42.37.124:80		tcp
US	76.25.94.191:80		tcp
GB	82.14.251.106:80		tcp
JP	133.90.211.248:80		tcp
EG	45.246.106.165:80		tcp
BR	179.248.119.125:80		tcp
US	13.141.72.139:80		tcp
CA	153.71.183.73:80		tcp
CN	110.76.37.94:80		tcp
US	140.59.219.88:80		tcp
BR	177.14.25.47:80		tcp
ID	36.83.238.154:80		tcp
US	17.39.155.26:80		tcp
ES	84.127.147.151:8080		tcp
DE	53.168.193.189:8080		tcp
CO	186.118.133.138:80		tcp
JP	211.10.246.166:80		tcp
US	75.121.114.184:80		tcp
AU	101.187.201.126:8080		tcp
US	55.124.92.127:80		tcp
US	13.22.188.131:80		tcp
BR	177.15.117.137:8080		tcp
US	209.149.88.202:80		tcp
CH	138.221.23.87:80		tcp
SG	43.26.12.135:80		tcp
IT	79.52.113.255:80		tcp
US	22.144.192.199:80		tcp
US	174.121.4.75:80		tcp
CN	154.8.226.101:8080		tcp
AT	137.208.190.195:80		tcp
US	99.112.249.226:80		tcp
UA	77.121.103.190:80		tcp
RU	94.245.131.194:80		tcp
US	40.53.132.90:80		tcp
US	184.243.133.126:80		tcp
CN	116.225.46.27:80		tcp
US	64.29.219.48:80		tcp
US	155.169.252.124:80		tcp
US	54.227.116.228:80		tcp
GB	4.250.202.237:80		tcp
CN	120.234.235.30:80		tcp
CN	223.166.147.31:80		tcp
US	97.84.48.50:80		tcp
US	54.161.234.158:80		tcp
US	209.230.195.139:80		tcp
KR	211.191.136.75:80		tcp
JP	126.208.196.150:80		tcp
JP	211.12.1.155:80		tcp
ZA	197.71.54.11:80		tcp
CN	183.24.165.244:80		tcp
IT	45.133.210.114:80		tcp
IR	188.214.174.155:80		tcp
KR	119.65.161.50:80		tcp
JP	220.7.207.171:443		tcp
US	32.168.30.81:80		tcp
US	97.252.79.141:80		tcp
CN	14.218.252.89:80		tcp
MT	217.168.172.176:80		tcp
US	140.176.136.50:80		tcp
JP	130.62.162.2:80		tcp
JP	49.253.5.203:80		tcp
BR	187.56.51.34:80		tcp
RU	109.201.98.70:80		tcp
RU	5.59.149.11:80		tcp
US	170.48.18.120:80		tcp
US	207.180.161.147:80		tcp
PA	190.35.196.25:80		tcp
DE	212.60.252.231:8080		tcp
DK	94.145.157.69:443		tcp
US	165.29.215.198:80		tcp
US	169.152.137.73:80		tcp
GB	25.110.62.222:80		tcp
US	40.227.18.202:80		tcp
N/A	10.79.248.254:80		tcp
US	143.229.111.158:443		tcp
HK	59.148.94.80:80		tcp
CN	122.72.193.222:80		tcp
US	17.191.6.165:80		tcp
GB	178.208.190.119:80		tcp
IN	49.201.71.31:80		tcp
BR	200.168.80.105:80		tcp
BR	191.4.186.217:80		tcp
US	158.26.235.214:80		tcp
N/A	107.25.86.73:443		tcp

Files

memory/1684-2-0x0000000000400000-0x000000000043A000-memory.dmp

memory/1684-4-0x0000000000400000-0x000000000043A000-memory.dmp

memory/1684-5-0x0000000000400000-0x000000000043A000-memory.dmp

memory/1684-6-0x0000000001DB0000-0x0000000001E86000-memory.dmp

memory/1684-10-0x0000000001DB0000-0x0000000001E86000-memory.dmp

memory/1684-11-0x0000000001DB0000-0x0000000001E86000-memory.dmp

memory/1684-7-0x0000000001DB0000-0x0000000001E86000-memory.dmp

memory/1684-9-0x0000000001DB0000-0x0000000001E86000-memory.dmp

memory/1684-8-0x0000000001DB0000-0x0000000001E86000-memory.dmp

memory/1684-12-0x0000000001DB0000-0x0000000001E86000-memory.dmp

memory/948-22-0x0000000005C90000-0x0000000005D66000-memory.dmp

memory/432-24-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-23-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/948-26-0x0000000005C90000-0x0000000005D66000-memory.dmp

memory/432-27-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-30-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-29-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-28-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-48-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-47-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-46-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-45-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-60-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/948-25-0x0000000002780000-0x0000000004780000-memory.dmp

memory/432-58-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-57-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-56-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-55-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-54-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-49-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-44-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-43-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-42-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-41-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-40-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-39-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-38-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-37-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-36-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-35-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-34-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-33-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-32-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-31-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-66-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-67-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-71-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-73-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-72-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-70-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-69-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/432-68-0x00000000000D0000-0x0000000000211000-memory.dmp

memory/2524-75-0x0000000000200000-0x0000000000341000-memory.dmp

memory/2524-81-0x0000000000200000-0x0000000000341000-memory.dmp

memory/2524-79-0x0000000000200000-0x0000000000341000-memory.dmp

memory/2524-78-0x0000000000200000-0x0000000000341000-memory.dmp

memory/2524-77-0x0000000000200000-0x0000000000341000-memory.dmp

memory/2524-76-0x0000000000200000-0x0000000000341000-memory.dmp

memory/2524-80-0x0000000000200000-0x0000000000341000-memory.dmp

memory/2524-74-0x0000000000200000-0x0000000000341000-memory.dmp

C:\Users\Admin\AppData\Local\d71742\ee03f2.bat

MD5	251c82732dbd03982f565deed73bb4f2
SHA1	2f903f60f1946953494fb995438cc2419abe59df
SHA256	4b67bfb9575e3dffcba2ad2d0c3b194119b1671d0e079ca9a2ff85b177d438f2
SHA512	1c6d1dd21ef660f870e23663b8f895f2255bf43830e93690217124a6b4a8cc563f97a4db145dd247b93bda3d49b7ef9d2ddf4ce58c72eccfb4609a356afd1344

C:\Users\Admin\AppData\Roaming\3aef84\6d4792.c56af49

MD5	1883744c99fed551b973fd3bcbf5500b
SHA1	f9ff1d6d40500b4d0a81a72d23b90be5ef3bf37f
SHA256	7c0363d2dd36e6b4fb556060701279082a657ad7020dc94d7a5f68a387b50676
SHA512	efd4bfd76aa10270496e793707f6a3e50ff8b7b8f46e107ca1b766ddc5368f951726eb36a13aac6bf04eb649b6aa76c9f8174341b02ee0a08b445010def002a0

C:\Users\Admin\AppData\Local\d71742\cc24ba.lnk

MD5	c19022fd2c85d818d1d6ca41564b11ce
SHA1	8394d4fda6e8ef48754ae82e7cf2f8dae1b2d93b
SHA256	88ac9a2c54cc61e97e0c9257ed22e0cadb9cfbabefd212245c3c16241b3f7ca3
SHA512	4a468d5bbdf5d0d3c93f75e96dae02405518cd50a6f6da39053b35b0b9c3101d78d836312e3609af153c2873d8b5f0149fc36027145d21b5790b46e3b17892ec

C:\Users\Admin\AppData\Local\d71742\043bcc.c56af49

MD5	3f64058638df7926c7a68ddcbdd30718
SHA1	dd05dee5cacf744a606f5323ae4a41abe3174a38
SHA256	acaf29d232a27632ab7f857ed4eca467dc99cd20b611a3fb7a459e73c299a33f
SHA512	7aab0a368d4797283f56d8cab05aaac1ac8b489a350b20ab8a8af410c058854386e7d6952f1ce5a0943d0f1905c67c9b4e32b37ca066240b7ccc2389964422a6

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\162913.lnk

MD5	809a664212f365393c5371b263861168
SHA1	bbec2cf3c1f11f506ea7f290614414807c5da0f6
SHA256	0f7d25c8a19518ba31dc25458ef8d3d257080d64f6a4455f0ed8b8fea6fe673e
SHA512	34dcead3ce055211c778ea65bf1eaa942ceeabbf1b1a50da26e7dd7306d26b2cd4051c23203babe4fcfcf61a663c25bd105040994f37fff14f0bdb8db575f788

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-28 16:02

Reported

2024-05-28 16:05

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Process spawned unexpected child process

Description	Indicator	Process	Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	N/A	C:\Windows\system32\mshta.exe

ModiLoader Second Stage

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	C:\Windows\system32\mshta.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 1692 set thread context of 700	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1692 wrote to memory of 700	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe
PID 1692 wrote to memory of 700	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe
PID 1692 wrote to memory of 700	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe
PID 1692 wrote to memory of 700	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe
PID 1692 wrote to memory of 700	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe
PID 1692 wrote to memory of 700	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe
PID 1692 wrote to memory of 700	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe
PID 1692 wrote to memory of 700	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe
PID 1692 wrote to memory of 700	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe
PID 1692 wrote to memory of 700	N/A	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe
PID 4504 wrote to memory of 1724	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4504 wrote to memory of 1724	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4504 wrote to memory of 1724	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118.exe"

C:\Windows\system32\mshta.exe

"C:\Windows\system32\mshta.exe" javascript:LJpM7ju="RQTxa";c2s4=new%20ActiveXObject("WScript.Shell");Lpel73bkp="LS";lsbu0=c2s4.RegRead("HKLM\\software\\Wow6432Node\\Xpa7mb\\mHcXqYrdD");yka2O0="06iFtm";eval(lsbu0);SPjfe6yx="Him6K";

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:rqecreuc

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	18.24.18.2.in-addr.arpa	udp
US	8.8.8.8:53	196.249.167.52.in-addr.arpa	udp
US	8.8.8.8:53	68.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
NL	23.62.61.113:443	www.bing.com	tcp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	113.61.62.23.in-addr.arpa	udp
NL	23.62.61.113:443	www.bing.com	tcp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	58.55.71.13.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	31.243.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	200.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	13.179.89.13.in-addr.arpa	udp

Files

memory/700-2-0x0000000000400000-0x000000000043A000-memory.dmp

memory/700-4-0x0000000000400000-0x000000000043A000-memory.dmp

memory/700-5-0x0000000000400000-0x000000000043A000-memory.dmp

memory/700-6-0x0000000000990000-0x0000000000A66000-memory.dmp

memory/700-7-0x0000000000990000-0x0000000000A66000-memory.dmp

memory/700-10-0x0000000000990000-0x0000000000A66000-memory.dmp

memory/700-9-0x0000000000990000-0x0000000000A66000-memory.dmp

memory/700-8-0x0000000000990000-0x0000000000A66000-memory.dmp

memory/700-11-0x0000000000990000-0x0000000000A66000-memory.dmp

memory/700-12-0x0000000000990000-0x0000000000A66000-memory.dmp

memory/1724-14-0x0000000005120000-0x0000000005156000-memory.dmp

memory/1724-15-0x0000000005790000-0x0000000005DB8000-memory.dmp

memory/1724-16-0x0000000005730000-0x0000000005752000-memory.dmp

memory/1724-17-0x0000000005F30000-0x0000000005F96000-memory.dmp

memory/1724-18-0x0000000005FA0000-0x0000000006006000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q2oz1mja.vib.ps1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1724-28-0x0000000006010000-0x0000000006364000-memory.dmp

memory/1724-29-0x00000000064C0000-0x00000000064DE000-memory.dmp

memory/1724-30-0x00000000064F0000-0x000000000653C000-memory.dmp

memory/1724-31-0x0000000007D20000-0x000000000839A000-memory.dmp

memory/1724-32-0x00000000069B0000-0x00000000069CA000-memory.dmp

Sample ID	240528-tha2bscc67
Target	7d8cb3afba3fcc5a19dcdc7b68c7d088_JaffaCakes118
SHA256	28ad354b5f3bc99707a840b3d72eb5e1c5dbd1474591bb48f3497071cc024f9c
Tags	modiloader evasion persistence trojan

Malware Analysis Report

2024-08-06 14:32

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files