Analysis
-
max time kernel
234s -
max time network
347s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 11:35
Static task
static1
Behavioral task
behavioral1
Sample
ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exe
Resource
win7-20221111-en
General
-
Target
ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exe
-
Size
668KB
-
MD5
7434b6c4ee381a0c83e1a25305d5e29f
-
SHA1
9aaac47d1101c74cedb331a7e5a3c08d8a694f20
-
SHA256
ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c
-
SHA512
79ad32bfb7a7fa3071e492ce110f8ba2902d89a657e3571769f008e84fc67a55ee3576e3e98b3dc6e9b53353fae9e00e1f565e278b606d3d727821da720cb7a4
-
SSDEEP
12288:1MkI8TndMPYINs+WaKOfXhFa8wodovujk2nWNYCZzl2C4D7pQRi1o/2rNoNSXf:1LhTnovpWaKOPapBywY+wHD7SRiKu2Yf
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Processes:
mstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 6 IoCs
Processes:
resource yara_rule behavioral1/memory/876-59-0x0000000000400000-0x0000000001400000-memory.dmp modiloader_stage2 behavioral1/memory/876-64-0x0000000000400000-0x0000000001400000-memory.dmp modiloader_stage2 behavioral1/memory/876-66-0x0000000000400000-0x0000000001400000-memory.dmp modiloader_stage2 behavioral1/memory/1792-69-0x0000000000400000-0x0000000001400000-memory.dmp modiloader_stage2 behavioral1/memory/1792-71-0x0000000000400000-0x0000000001400000-memory.dmp modiloader_stage2 behavioral1/memory/1792-72-0x0000000000400000-0x0000000001400000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
mstwain32.exepid process 1792 mstwain32.exe -
Processes:
resource yara_rule behavioral1/memory/876-57-0x000000003A3F0000-0x000000003A428000-memory.dmp upx behavioral1/memory/876-58-0x000000003A3F0000-0x000000003A428000-memory.dmp upx behavioral1/memory/876-65-0x000000003A3F0000-0x000000003A428000-memory.dmp upx behavioral1/memory/1792-67-0x000000003A190000-0x000000003A1C8000-memory.dmp upx behavioral1/memory/1792-68-0x000000003A190000-0x000000003A1C8000-memory.dmp upx behavioral1/memory/1792-73-0x000000003A190000-0x000000003A1C8000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exemstwain32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mstwain32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mstwain32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
mstwain32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ mstwain32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
Processes:
mstwain32.exeec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe -
Drops file in Windows directory 4 IoCs
Processes:
ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exemstwain32.exedescription ioc process File created C:\Windows\mstwain32.exe ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exe File opened for modification C:\Windows\mstwain32.exe ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exe File created C:\Windows\ntdtcstp.dll mstwain32.exe File created C:\Windows\cmsetac.dll mstwain32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 16 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exemstwain32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform ID mstwain32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mstwain32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mstwain32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mstwain32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mstwain32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet mstwain32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform ID ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mstwain32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mstwain32.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
mstwain32.exeec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mstwain32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exemstwain32.exedescription pid process Token: SeDebugPrivilege 876 ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exe Token: SeDebugPrivilege 1792 mstwain32.exe Token: SeDebugPrivilege 1792 mstwain32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
mstwain32.exepid process 1792 mstwain32.exe 1792 mstwain32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exedescription pid process target process PID 876 wrote to memory of 1792 876 ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exe mstwain32.exe PID 876 wrote to memory of 1792 876 ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exe mstwain32.exe PID 876 wrote to memory of 1792 876 ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exe mstwain32.exe PID 876 wrote to memory of 1792 876 ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exe mstwain32.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
mstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exe"C:\Users\Admin\AppData\Local\Temp\ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\mstwain32.exeFilesize
668KB
MD57434b6c4ee381a0c83e1a25305d5e29f
SHA19aaac47d1101c74cedb331a7e5a3c08d8a694f20
SHA256ec3873b9136338a5b8d42353cf33ea70496e6f9768ff7779d087800b84d5492c
SHA51279ad32bfb7a7fa3071e492ce110f8ba2902d89a657e3571769f008e84fc67a55ee3576e3e98b3dc6e9b53353fae9e00e1f565e278b606d3d727821da720cb7a4
-
memory/876-65-0x000000003A3F0000-0x000000003A428000-memory.dmpFilesize
224KB
-
memory/876-66-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/876-64-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/876-58-0x000000003A3F0000-0x000000003A428000-memory.dmpFilesize
224KB
-
memory/876-59-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/876-60-0x000000003CF40000-0x000000003CF50000-memory.dmpFilesize
64KB
-
memory/876-54-0x0000000076771000-0x0000000076773000-memory.dmpFilesize
8KB
-
memory/876-55-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/876-57-0x000000003A3F0000-0x000000003A428000-memory.dmpFilesize
224KB
-
memory/876-56-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1792-74-0x000000003C540000-0x000000003C54E000-memory.dmpFilesize
56KB
-
memory/1792-67-0x000000003A190000-0x000000003A1C8000-memory.dmpFilesize
224KB
-
memory/1792-68-0x000000003A190000-0x000000003A1C8000-memory.dmpFilesize
224KB
-
memory/1792-69-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1792-70-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1792-71-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1792-72-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1792-73-0x000000003A190000-0x000000003A1C8000-memory.dmpFilesize
224KB
-
memory/1792-61-0x0000000000000000-mapping.dmp