modiloader | a096875438ac04b10f2e8ef738866338fc1d55c9cfbbd6b1140b8d7b168f849b

General

Target

0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe
Size

265KB
MD5

0487c09681f3f11cb594a2a580ff03e4
SHA1

6b7b528d59ee0e581a4697ee80fb344261f56f6c
SHA256

a096875438ac04b10f2e8ef738866338fc1d55c9cfbbd6b1140b8d7b168f849b
SHA512

d671c654b7c0b18e1c54df6168cb6ded6f7c592dde44775e13ffebda75c5a9cda7dcbd94e3ff8debd6b6b1f12ee2b407f942ba28ae96cc8b5a3e4c3685ab0dda
SSDEEP

6144:veX94nYY+uUMFemOFu3Ksm2Yn+EE9j+ivEyPYxJQeh:OSnYPweZnl+EER+iv6Ieh

Score

10^/10

modiloader evasion persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

mshta.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2516 2680 mshta.exe
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions regsvr32.exe
Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
evasion

File and Directory Discovery
T1083

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2516	2680	mshta.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	regsvr32.exe

description	ioc	process
File opened (read-only)	C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys	regsvr32.exe

ModiLoader Second Stage 62 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1840-2-0x0000000000400000-0x000000000043A000-memory.dmp	modiloader_stage2
behavioral1/memory/1840-4-0x0000000000400000-0x000000000043A000-memory.dmp	modiloader_stage2
behavioral1/memory/1840-5-0x0000000000400000-0x000000000043A000-memory.dmp	modiloader_stage2
behavioral1/memory/1840-6-0x0000000001C70000-0x0000000001D46000-memory.dmp	modiloader_stage2
behavioral1/memory/1840-8-0x0000000001C70000-0x0000000001D46000-memory.dmp	modiloader_stage2
behavioral1/memory/1840-7-0x0000000001C70000-0x0000000001D46000-memory.dmp	modiloader_stage2
behavioral1/memory/1840-9-0x0000000001C70000-0x0000000001D46000-memory.dmp	modiloader_stage2
behavioral1/memory/1840-11-0x0000000001C70000-0x0000000001D46000-memory.dmp	modiloader_stage2
behavioral1/memory/1840-10-0x0000000001C70000-0x0000000001D46000-memory.dmp	modiloader_stage2
behavioral1/memory/1840-12-0x0000000001C70000-0x0000000001D46000-memory.dmp	modiloader_stage2
behavioral1/memory/1840-13-0x0000000001C70000-0x0000000001D46000-memory.dmp	modiloader_stage2
behavioral1/memory/1840-18-0x0000000001C70000-0x0000000001D46000-memory.dmp	modiloader_stage2
behavioral1/memory/2684-23-0x0000000006250000-0x0000000006326000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-25-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-26-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2684-28-0x0000000006250000-0x0000000006326000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-29-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-30-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-31-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-32-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-34-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-33-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-47-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-35-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-43-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-37-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-38-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-49-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-36-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-57-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-40-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-45-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-61-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-68-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-59-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-58-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-56-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-51-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-50-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-46-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-44-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-42-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-41-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-39-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-60-0x00000000000F0000-0x0000000000231000-memory.dmp	modiloader_stage2
behavioral1/memory/1448-77-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1448-83-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1448-81-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1448-80-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1448-78-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1448-75-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1448-73-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1448-72-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1448-84-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1448-82-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1448-79-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1448-76-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1448-74-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1448-71-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1448-70-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1448-69-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1840-108-0x0000000001C70000-0x0000000001D46000-memory.dmp	modiloader_stage2

Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	regsvr32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	regsvr32.exe

Deletes itself 1 IoCs

Processes:

regsvr32.exe

pid process

2632 regsvr32.exe
Drops startup file 1 IoCs

Processes:

regsvr32.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\601f00.lnk regsvr32.exe

pid	process
2632	regsvr32.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\601f00.lnk	regsvr32.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:Ot4WLETg=\"7B9IC\";ot9=new%20ActiveXObject(\"WScript.Shell\");DaA6mXB=\"7BGO\";x7gfi=ot9.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\tbxrem\\\\kgltsyfy\");cu4X2d=\"J7zWTO5\";eval(x7gfi);SEL6KI0=\"aG\";"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:kAmi82a=\"G\";Nc5=new%20ActiveXObject(\"WScript.Shell\");sV3SklS=\"2\";NDkX9=Nc5.RegRead(\"HKCU\\\\software\\\\tbxrem\\\\kgltsyfy\");Tp6egq=\"Sxkb\";eval(NDkX9);r3ETZ2Igk=\"FcQ\";"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\2f4789\\6bc9fe.lnk\""	regsvr32.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	regsvr32.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exepowershell.exeregsvr32.exe

description	pid	process	target process
PID 2860 set thread context of 1840	2860	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe
PID 2684 set thread context of 2632	2684	powershell.exe	regsvr32.exe
PID 2632 set thread context of 1448	2632	regsvr32.exe	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International	regsvr32.exe

Modifies registry class 7 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\f8f880\shell\open	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\f8f880\shell\open\command	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\f8f880\shell\open\command\ = "\"C:\\Windows\\system32\\mshta.exe\" \"javascript:dqLi3LF=\"oI\";kv1=new ActiveXObject(\"WScript.Shell\");zU9frTcc=\"JiQOxE\";Aof06L=kv1.RegRead(\"HKCU\\\\software\\\\tbxrem\\\\kgltsyfy\");dt1Si=\"yCZu2PpW\";eval(Aof06L);wed8jiT4K=\"BNiYaBs\";\""	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.6cddf16	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.6cddf16\ = "f8f880"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\f8f880	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\f8f880\shell	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeregsvr32.exe

pid	process
2684	powershell.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe
2632	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

powershell.exeregsvr32.exe

pid process

2684 powershell.exe
2632 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2684 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe

pid process

2860 0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2684	powershell.exe

pid	process
2860	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exemshta.exepowershell.exeregsvr32.exe

description	pid	process	target process
PID 2860 wrote to memory of 1840	2860	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe
PID 2860 wrote to memory of 1840	2860	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe
PID 2860 wrote to memory of 1840	2860	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe
PID 2860 wrote to memory of 1840	2860	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe
PID 2860 wrote to memory of 1840	2860	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe
PID 2860 wrote to memory of 1840	2860	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe
PID 2860 wrote to memory of 1840	2860	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe
PID 2860 wrote to memory of 1840	2860	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe
PID 2860 wrote to memory of 1840	2860	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe
PID 2860 wrote to memory of 1840	2860	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe
PID 2860 wrote to memory of 1840	2860	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe	0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe
PID 2516 wrote to memory of 2684	2516	mshta.exe	powershell.exe
PID 2516 wrote to memory of 2684	2516	mshta.exe	powershell.exe
PID 2516 wrote to memory of 2684	2516	mshta.exe	powershell.exe
PID 2516 wrote to memory of 2684	2516	mshta.exe	powershell.exe
PID 2684 wrote to memory of 2632	2684	powershell.exe	regsvr32.exe
PID 2684 wrote to memory of 2632	2684	powershell.exe	regsvr32.exe
PID 2684 wrote to memory of 2632	2684	powershell.exe	regsvr32.exe
PID 2684 wrote to memory of 2632	2684	powershell.exe	regsvr32.exe
PID 2684 wrote to memory of 2632	2684	powershell.exe	regsvr32.exe
PID 2684 wrote to memory of 2632	2684	powershell.exe	regsvr32.exe
PID 2684 wrote to memory of 2632	2684	powershell.exe	regsvr32.exe
PID 2684 wrote to memory of 2632	2684	powershell.exe	regsvr32.exe
PID 2632 wrote to memory of 1448	2632	regsvr32.exe	regsvr32.exe
PID 2632 wrote to memory of 1448	2632	regsvr32.exe	regsvr32.exe
PID 2632 wrote to memory of 1448	2632	regsvr32.exe	regsvr32.exe
PID 2632 wrote to memory of 1448	2632	regsvr32.exe	regsvr32.exe
PID 2632 wrote to memory of 1448	2632	regsvr32.exe	regsvr32.exe
PID 2632 wrote to memory of 1448	2632	regsvr32.exe	regsvr32.exe
PID 2632 wrote to memory of 1448	2632	regsvr32.exe	regsvr32.exe
PID 2632 wrote to memory of 1448	2632	regsvr32.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860

C:\Users\Admin\AppData\Local\Temp\0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0487c09681f3f11cb594a2a580ff03e4_JaffaCakes118.exe"
2⤵
PID:1840

C:\Windows\system32\mshta.exe
"C:\Windows\system32\mshta.exe" javascript:M8KN0v="PVTl";m54p=new%20ActiveXObject("WScript.Shell");Bhy16YU="Vv";dQD2o=m54p.RegRead("HKLM\\software\\Wow6432Node\\MaGcDzuu\\NenktdST");QnQ4FSR0U="S";eval(dQD2o);FX8mcHze="QLD0";
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2516

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:acaniwr
2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe
3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Drops startup file
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2632

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\SysWOW64\regsvr32.exe"
4⤵
PID:1448

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

3

T1497

Modify Registry

2

T1112

Credential Access

Discovery

Software Discovery

1

T1518

Query Registry

4

T1012

Virtualization/Sandbox Evasion

3

T1497

File and Directory Discovery

1

T1083

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\2f4789\6bc9fe.lnk
Filesize
877B

MD5
d47a02d3952e6d860dc3146e7ba72214

SHA1
13577f77d4e38dd5714c101a52b65d94ae32a047

SHA256
637a533eef0d45cdd35fbe381fced96db43ba39d1c831f700d9f586a49aec55b

SHA512
61e31cdb575cac55cd5f3004fee5d31ae1c036950751add46e6bae78bffbad2cebce9872bfe71f4559584bc111d4897d072373fa90b5506b9c849319d5540baa

Download Submit
C:\Users\Admin\AppData\Local\2f4789\cf743a.6cddf16
Filesize
33KB

MD5
c73da5916a59d550d8c01f3f3ec6b814

SHA1
76ccd04f1f216cef6ce1fdd0741f442e3fa477ef

SHA256
71f2288f66d4ca0b65e0e782b37df8a1a1dfd5c2501b51f864416a8bb5ae5fdb

SHA512
f3328341638f15c107269fe716ef73763a98c7d02ae6e7fc0e2b4766a610ddee76ae749b53f2627244460fbc842d81d5aeffba8d20146f6aef6eb8a82c2c8948

Download Submit
C:\Users\Admin\AppData\Local\2f4789\ea3dbb.bat
Filesize
61B

MD5
d4ec627a1d9ca558fd3d5fae26a947e9

SHA1
1c63212329281c2d22a9cba716e4ee6a03cf19e2

SHA256
167af01d0aa246d0c9572d34fcd254ede62be98708af922a6b521d5740a9ddde

SHA512
45708682cd7e4c12b68fd467d69a96fce4cf168fbf2ea5514fcc1b0970295aa8821b67663a6b96f2f126474994aa4858c8802df2083e6dc8ae009a3da66b1502

Download Submit
C:\Users\Admin\AppData\Roaming\06809f\0da6de.6cddf16
Filesize
41KB

MD5
405d64e73035ef7ba59fbd384d5af7a8

SHA1
d406a02072c8d53da2776e0df723f3516a87ea12

SHA256
034a882ca46caa68f58006f2d07bdbb126ebb3c5bdcacd93f246c1dbb8e53762

SHA512
a06ace284df693406a0934eccf5f70668312fcef453d66fd3197cd3f658f6bc5fe88074a469054a09a6aa5ed16c3ba9e95e5961ab0ab0ca6341b997141ccd246

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\601f00.lnk
Filesize
987B

MD5
2ec336eb356b894ab1afbd7f83c54b04

SHA1
ca634857ce32d33d021ac68da13f636f71b2a0e9

SHA256
c0720b4cb1089f2aa508ce519eabdd1873e8a916995af6df4ee3d30b40135a6e

SHA512
0437a92d2384baab761566f0b8b76a342ff6e93290bf8ebd935143db2f15161581decfae4042b345214954da045c799121c83e93a303cb59a976b159821beafe

Download Submit
memory/1448-79-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1448-72-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1448-83-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1448-81-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1448-80-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1448-78-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1448-75-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1448-73-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1448-84-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1448-82-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1448-77-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1448-76-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1448-74-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1448-71-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1448-69-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1448-70-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1840-9-0x0000000001C70000-0x0000000001D46000-memory.dmp

Filesize
856KB

Download
memory/1840-2-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1840-4-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1840-5-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1840-6-0x0000000001C70000-0x0000000001D46000-memory.dmp

Filesize
856KB

Download
memory/1840-8-0x0000000001C70000-0x0000000001D46000-memory.dmp

Filesize
856KB

Download
memory/1840-108-0x0000000001C70000-0x0000000001D46000-memory.dmp

Filesize
856KB

Download
memory/1840-7-0x0000000001C70000-0x0000000001D46000-memory.dmp

Filesize
856KB

Download
memory/1840-18-0x0000000001C70000-0x0000000001D46000-memory.dmp

Filesize
856KB

Download
memory/1840-13-0x0000000001C70000-0x0000000001D46000-memory.dmp

Filesize
856KB

Download
memory/1840-12-0x0000000001C70000-0x0000000001D46000-memory.dmp

Filesize
856KB

Download
memory/1840-10-0x0000000001C70000-0x0000000001D46000-memory.dmp

Filesize
856KB

Download
memory/1840-11-0x0000000001C70000-0x0000000001D46000-memory.dmp

Filesize
856KB

Download
memory/2632-30-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-36-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-56-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-51-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-50-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-46-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-44-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-42-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-41-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-39-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-60-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-59-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-68-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-61-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-45-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-40-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-57-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-58-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-49-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-38-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-37-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-43-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-35-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-47-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-33-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-34-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-32-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-31-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-29-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-25-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2632-26-0x00000000000F0000-0x0000000000231000-memory.dmp

Filesize
1.3MB

Download
memory/2684-28-0x0000000006250000-0x0000000006326000-memory.dmp

Filesize
856KB

Download
memory/2684-23-0x0000000006250000-0x0000000006326000-memory.dmp

Filesize
856KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads