Analysis
-
max time kernel
150s -
max time network
190s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
02-08-2022 01:22
Behavioral task
behavioral1
Sample
5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe
Resource
win10v2004-20220721-en
General
-
Target
5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe
-
Size
205KB
-
MD5
046a622e41c6d93a98a3478834bbe0b2
-
SHA1
1eb4e567adcb63e318057de1a07a6e5df22db0f7
-
SHA256
5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83
-
SHA512
c95eeeaeea6e91c0f2dece089b139329978d266a860b6fd182fd3af3cb950bc712611b0ee81c2e4237eab9d9cfac2716dca9a2b8e63f490dffcfd985db9f20b1
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Processes:
mstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 9 IoCs
Processes:
resource yara_rule behavioral1/memory/2044-61-0x0000000000400000-0x0000000000478000-memory.dmp modiloader_stage2 behavioral1/memory/2044-62-0x0000000000400000-0x0000000000478000-memory.dmp modiloader_stage2 C:\Windows\mstwain32.exe modiloader_stage2 behavioral1/memory/2044-65-0x0000000000400000-0x0000000000478000-memory.dmp modiloader_stage2 C:\Windows\mstwain32.exe modiloader_stage2 C:\Windows\mstwain32.exe modiloader_stage2 behavioral1/memory/524-75-0x0000000000400000-0x0000000000478000-memory.dmp modiloader_stage2 behavioral1/memory/524-77-0x0000000000400000-0x0000000000478000-memory.dmp modiloader_stage2 behavioral1/memory/524-78-0x0000000000400000-0x0000000000478000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
Processes:
mstwain32.exemstwain32.exepid process 764 mstwain32.exe 524 mstwain32.exe -
Processes:
resource yara_rule behavioral1/memory/2044-56-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/2044-60-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/2044-61-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/2044-62-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/2044-65-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/524-74-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/524-75-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/524-77-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/524-78-0x0000000000400000-0x0000000000478000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
mstwain32.exepid process 524 mstwain32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
mstwain32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ mstwain32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
Processes:
5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exemstwain32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exemstwain32.exedescription pid process target process PID 2032 set thread context of 2044 2032 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe PID 764 set thread context of 524 764 mstwain32.exe mstwain32.exe -
Drops file in Windows directory 4 IoCs
Processes:
5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exemstwain32.exedescription ioc process File created C:\Windows\mstwain32.exe 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe File opened for modification C:\Windows\mstwain32.exe 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe File created C:\Windows\ntdtcstp.dll mstwain32.exe File created C:\Windows\cmsetac.dll mstwain32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exevssvc.exemstwain32.exedescription pid process Token: SeDebugPrivilege 2044 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe Token: SeBackupPrivilege 1532 vssvc.exe Token: SeRestorePrivilege 1532 vssvc.exe Token: SeAuditPrivilege 1532 vssvc.exe Token: SeDebugPrivilege 524 mstwain32.exe Token: SeDebugPrivilege 524 mstwain32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
mstwain32.exepid process 524 mstwain32.exe 524 mstwain32.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exemstwain32.exedescription pid process target process PID 2032 wrote to memory of 2044 2032 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe PID 2032 wrote to memory of 2044 2032 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe PID 2032 wrote to memory of 2044 2032 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe PID 2032 wrote to memory of 2044 2032 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe PID 2032 wrote to memory of 2044 2032 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe PID 2032 wrote to memory of 2044 2032 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe PID 2044 wrote to memory of 764 2044 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe mstwain32.exe PID 2044 wrote to memory of 764 2044 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe mstwain32.exe PID 2044 wrote to memory of 764 2044 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe mstwain32.exe PID 2044 wrote to memory of 764 2044 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe mstwain32.exe PID 764 wrote to memory of 524 764 mstwain32.exe mstwain32.exe PID 764 wrote to memory of 524 764 mstwain32.exe mstwain32.exe PID 764 wrote to memory of 524 764 mstwain32.exe mstwain32.exe PID 764 wrote to memory of 524 764 mstwain32.exe mstwain32.exe PID 764 wrote to memory of 524 764 mstwain32.exe mstwain32.exe PID 764 wrote to memory of 524 764 mstwain32.exe mstwain32.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
mstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe"C:\Users\Admin\AppData\Local\Temp\5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exeC:\Users\Admin\AppData\Local\Temp\5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe2⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\mstwain32.exeC:\Windows\mstwain32.exe \melt C:\Users\Admin\AppData\Local\Temp\5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe4⤵
- UAC bypass
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\mstwain32.exeFilesize
205KB
MD5046a622e41c6d93a98a3478834bbe0b2
SHA11eb4e567adcb63e318057de1a07a6e5df22db0f7
SHA2565b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83
SHA512c95eeeaeea6e91c0f2dece089b139329978d266a860b6fd182fd3af3cb950bc712611b0ee81c2e4237eab9d9cfac2716dca9a2b8e63f490dffcfd985db9f20b1
-
C:\Windows\mstwain32.exeFilesize
205KB
MD5046a622e41c6d93a98a3478834bbe0b2
SHA11eb4e567adcb63e318057de1a07a6e5df22db0f7
SHA2565b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83
SHA512c95eeeaeea6e91c0f2dece089b139329978d266a860b6fd182fd3af3cb950bc712611b0ee81c2e4237eab9d9cfac2716dca9a2b8e63f490dffcfd985db9f20b1
-
C:\Windows\mstwain32.exeFilesize
205KB
MD5046a622e41c6d93a98a3478834bbe0b2
SHA11eb4e567adcb63e318057de1a07a6e5df22db0f7
SHA2565b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83
SHA512c95eeeaeea6e91c0f2dece089b139329978d266a860b6fd182fd3af3cb950bc712611b0ee81c2e4237eab9d9cfac2716dca9a2b8e63f490dffcfd985db9f20b1
-
memory/524-70-0x0000000000462040-mapping.dmp
-
memory/524-74-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/524-78-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/524-77-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/524-76-0x00000000007E0000-0x00000000007EE000-memory.dmpFilesize
56KB
-
memory/524-75-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/764-63-0x0000000000000000-mapping.dmp
-
memory/2044-57-0x0000000000462040-mapping.dmp
-
memory/2044-56-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2044-54-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2044-65-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2044-59-0x0000000075481000-0x0000000075483000-memory.dmpFilesize
8KB
-
memory/2044-60-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2044-62-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2044-61-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB