modiloader | 89a26293c1eb0f538c722381c9061390c7ffec985c2a1416265740a08dc45ffd

General

Target

62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe
Size

455KB
MD5

62d8c344581658b5473a6408f412fbfc
SHA1

e9842759865ca9413f9980559847b146aae46443
SHA256

89a26293c1eb0f538c722381c9061390c7ffec985c2a1416265740a08dc45ffd
SHA512

ac26e3f0936af799ea2a894744ce815b151ed870c663607752b4ef39b7b7c0e236e89d69249f804c76681e432558aa623ff1c729921dd1e817d2ac80e3afecb1
SSDEEP

12288:WBJIgdhv77hsELGmmrJATawH9Ho1vEQJN88:i2Ihf6EqmmrJAH9IpL88

Score

10^/10

modiloader evasion persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

mshta.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2664 2628 mshta.exe
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions regsvr32.exe
Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
evasion

File and Directory Discovery
T1083

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2628	mshta.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	regsvr32.exe

description	ioc	process
File opened (read-only)	C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys	regsvr32.exe

ModiLoader Second Stage 53 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2820-4-0x0000000000400000-0x0000000000439000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-12-0x0000000000400000-0x0000000000439000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-13-0x0000000000400000-0x0000000000439000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-10-0x0000000000400000-0x0000000000439000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-8-0x0000000000400000-0x0000000000439000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-6-0x0000000000400000-0x0000000000439000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-14-0x0000000001D70000-0x0000000001E44000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-18-0x0000000001D70000-0x0000000001E44000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-17-0x0000000001D70000-0x0000000001E44000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-16-0x0000000001D70000-0x0000000001E44000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-15-0x0000000001D70000-0x0000000001E44000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-19-0x0000000001D70000-0x0000000001E44000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-20-0x0000000001D70000-0x0000000001E44000-memory.dmp	modiloader_stage2
behavioral1/memory/2716-29-0x0000000006180000-0x0000000006254000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-31-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-33-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2716-34-0x0000000006180000-0x0000000006254000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-38-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-42-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-47-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-35-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-36-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-37-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-39-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-40-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-41-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-46-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-56-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-55-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-72-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-54-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-67-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-66-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-65-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-64-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-62-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-57-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-53-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-52-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-51-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-50-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-74-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-49-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-48-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-45-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-44-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-43-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2016-75-0x0000000000200000-0x000000000033E000-memory.dmp	modiloader_stage2
behavioral1/memory/2016-80-0x0000000000200000-0x000000000033E000-memory.dmp	modiloader_stage2
behavioral1/memory/2016-79-0x0000000000200000-0x000000000033E000-memory.dmp	modiloader_stage2
behavioral1/memory/2016-78-0x0000000000200000-0x000000000033E000-memory.dmp	modiloader_stage2
behavioral1/memory/2016-77-0x0000000000200000-0x000000000033E000-memory.dmp	modiloader_stage2
behavioral1/memory/2016-76-0x0000000000200000-0x000000000033E000-memory.dmp	modiloader_stage2

Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	regsvr32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	regsvr32.exe

Deletes itself 1 IoCs

Processes:

regsvr32.exe

pid process

1968 regsvr32.exe
Drops startup file 1 IoCs

Processes:

regsvr32.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3011.lnk regsvr32.exe

pid	process
1968	regsvr32.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3011.lnk	regsvr32.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:DT5UQCHM=\"zLXXR\";pM0=new%20ActiveXObject(\"WScript.Shell\");C2GT7hEME=\"sIyP1\";EnDn3=pM0.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\epsehio\\\\uqkiailgu\");pCUeP3Ee=\"opLtwz8ia\";eval(EnDn3);F9ExUNmfV=\"WrKV3Q\";"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:uzftP9qX=\"hV47\";dS05=new%20ActiveXObject(\"WScript.Shell\");c1LSLJP=\"au38\";iuvM2=dS05.RegRead(\"HKCU\\\\software\\\\epsehio\\\\uqkiailgu\");L32jejTy=\"1MDY4tmj\";eval(iuvM2);C3oMxUJ7i=\"e\";"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\43e4\\fa89.lnk\""	regsvr32.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	regsvr32.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exepowershell.exeregsvr32.exe

description	pid	process	target process
PID 2124 set thread context of 2820	2124	62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe	62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe
PID 2716 set thread context of 1968	2716	powershell.exe	regsvr32.exe
PID 1968 set thread context of 2016	1968	regsvr32.exe	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International	regsvr32.exe

Modifies registry class 7 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\49a7\shell\open\command	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\49a7\shell\open\command\ = "mshta \"javascript:mE7j2XgnKB=\"eDx160gy\";cn00=new ActiveXObject(\"WScript.Shell\");Rw6EqRR=\"bmvwMJ3qaP\";ifb4D=cn00.RegRead(\"HKCU\\\\software\\\\epsehio\\\\uqkiailgu\");xc2uvdml=\"0q\";eval(ifb4D);oZ1O9hoZ=\"uBxfhHY3\";\""	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.6f350	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.6f350\ = "49a7"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\49a7	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\49a7\shell	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\49a7\shell\open	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeregsvr32.exe

pid	process
2716	powershell.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe
1968	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

powershell.exeregsvr32.exe

pid process

2716 powershell.exe
1968 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2716 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2716	powershell.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exemshta.exepowershell.exeregsvr32.exe

description	pid	process	target process
PID 2124 wrote to memory of 2820	2124	62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe	62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe
PID 2124 wrote to memory of 2820	2124	62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe	62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe
PID 2124 wrote to memory of 2820	2124	62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe	62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe
PID 2124 wrote to memory of 2820	2124	62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe	62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe
PID 2124 wrote to memory of 2820	2124	62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe	62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe
PID 2124 wrote to memory of 2820	2124	62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe	62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe
PID 2124 wrote to memory of 2820	2124	62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe	62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe
PID 2124 wrote to memory of 2820	2124	62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe	62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe
PID 2124 wrote to memory of 2820	2124	62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe	62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe
PID 2664 wrote to memory of 2716	2664	mshta.exe	powershell.exe
PID 2664 wrote to memory of 2716	2664	mshta.exe	powershell.exe
PID 2664 wrote to memory of 2716	2664	mshta.exe	powershell.exe
PID 2664 wrote to memory of 2716	2664	mshta.exe	powershell.exe
PID 2716 wrote to memory of 1968	2716	powershell.exe	regsvr32.exe
PID 2716 wrote to memory of 1968	2716	powershell.exe	regsvr32.exe
PID 2716 wrote to memory of 1968	2716	powershell.exe	regsvr32.exe
PID 2716 wrote to memory of 1968	2716	powershell.exe	regsvr32.exe
PID 2716 wrote to memory of 1968	2716	powershell.exe	regsvr32.exe
PID 2716 wrote to memory of 1968	2716	powershell.exe	regsvr32.exe
PID 2716 wrote to memory of 1968	2716	powershell.exe	regsvr32.exe
PID 2716 wrote to memory of 1968	2716	powershell.exe	regsvr32.exe
PID 1968 wrote to memory of 2016	1968	regsvr32.exe	regsvr32.exe
PID 1968 wrote to memory of 2016	1968	regsvr32.exe	regsvr32.exe
PID 1968 wrote to memory of 2016	1968	regsvr32.exe	regsvr32.exe
PID 1968 wrote to memory of 2016	1968	regsvr32.exe	regsvr32.exe
PID 1968 wrote to memory of 2016	1968	regsvr32.exe	regsvr32.exe
PID 1968 wrote to memory of 2016	1968	regsvr32.exe	regsvr32.exe
PID 1968 wrote to memory of 2016	1968	regsvr32.exe	regsvr32.exe
PID 1968 wrote to memory of 2016	1968	regsvr32.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2124

C:\Users\Admin\AppData\Local\Temp\62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\62d8c344581658b5473a6408f412fbfc_JaffaCakes118.exe
2⤵
PID:2820

C:\Windows\system32\mshta.exe
"C:\Windows\system32\mshta.exe" javascript:uZJrrY21wd="XlnaYBgKLd";tq7=new%20ActiveXObject("WScript.Shell");OxoZU4Bnj="ggf";VQ8Nw=tq7.RegRead("HKLM\\software\\Wow6432Node\\P6bDX7\\GHaKJxo");HK30BeNNy="Ostl";eval(VQ8Nw);cDI4pnFY8O="eg4lhQS9vm";
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2664

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:cpydx
2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe
3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Drops startup file
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\SysWOW64\regsvr32.exe"
4⤵
PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Virtualization/Sandbox Evasion

3

T1497

Credential Access

Discovery

File and Directory Discovery

1

T1083

Peripheral Device Discovery

Query Registry

Software Discovery

System Information Discovery

3

T1082

Virtualization/Sandbox Evasion

3

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\43e4\8d79.6f350
Filesize
45KB

MD5
f4b1f0fa1439e16e54af5048e6a5be50

SHA1
2bfe85fa9460cded773f1f0870194d6021c43b52

SHA256
ae7916250049c6d9afac2d780e823a62f3c2ce03e43aab853343c6ab47029fd3

SHA512
f9afdbf4c2870b18646ed1978e6e2586f63166619a3ecc57396358496833120785c69ce1af2f1cfcf963c70a38187b916ddf922f82fb385c494a5afded1d6ad3

Download Submit
C:\Users\Admin\AppData\Local\43e4\b67d.bat
Filesize
55B

MD5
27ce144177a8617384899301a2b4330f

SHA1
1dead7588f1982006065dc8a25deb05385fbe649

SHA256
fa24ed9d8ea201f657bfea7f56fc698a39216eecccdc29fc0a12dc3592badce4

SHA512
0724ac2a3c9321241afdaad3fed8923b5748a47fde6319daf4fd320420a0a20e5487c5c1e36bdea009c5e686371fd172832ba92e4e9086f307afb7d8c741608b

Download Submit
C:\Users\Admin\AppData\Local\43e4\fa89.lnk
Filesize
857B

MD5
2b535668b544743e4bc668e9ed874c57

SHA1
7c13ba4057ce136b513f4d9d1aa795a6888f329c

SHA256
25bf42eeccf1eed57162e9c545ad86478bf97afbc361c8ba1ae3fe9ba7d877c3

SHA512
25c48edd37b3fb247f22ef6d917b1363bd43a4322fc235a3cf4e1a4d3d870a22df968a4dd92d740e96f6ba98385ae523400c3fda9862ba261ddd52d4b579c52c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3011.lnk
Filesize
975B

MD5
2e89280c9363ca619866349da34d3828

SHA1
c5e5e3ec730679ffd58516d74a9b08c7de0ebfa5

SHA256
d9bb8e174f79b76fbcf8017dde6b2d286dd38bc1b556b27c281e3c7f170499a9

SHA512
08b99422c54626b47043f2608e9887b647eca2521798c85cf58d376bed061b318e70344a28572b7647f43dd40937341a9c625004b5060ca7564537d4c0e42351

Download Submit
C:\Users\Admin\AppData\Roaming\ef44\0b63.6f350
Filesize
40KB

MD5
3940c2b75fc92c258a4c5dc8b8e7d906

SHA1
566d48e2a2a12648f310778deffa35580e7eb5cb

SHA256
3cd2d93d945ba612a14a910bd5fc2f159dc01568eae6e791662388db685b4f8b

SHA512
01342503022c577b6deabd6c7f488f7a2ffeab176bd2e1b287b5af67947550ea3a4a59e96c50e4a9de5944a01f2e94e1e359f1f445975ff85b64fd3f68781bf3

Download Submit
memory/1968-48-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-50-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-54-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-43-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-44-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-45-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-49-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-74-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-67-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-51-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-52-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-31-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-33-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-53-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-38-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-42-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-47-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-35-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-36-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-37-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-39-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-40-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-72-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-46-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-56-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-55-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-41-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-57-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-62-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-66-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-65-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-64-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2016-80-0x0000000000200000-0x000000000033E000-memory.dmp

Filesize
1.2MB

Download
memory/2016-76-0x0000000000200000-0x000000000033E000-memory.dmp

Filesize
1.2MB

Download
memory/2016-77-0x0000000000200000-0x000000000033E000-memory.dmp

Filesize
1.2MB

Download
memory/2016-78-0x0000000000200000-0x000000000033E000-memory.dmp

Filesize
1.2MB

Download
memory/2016-79-0x0000000000200000-0x000000000033E000-memory.dmp

Filesize
1.2MB

Download
memory/2016-75-0x0000000000200000-0x000000000033E000-memory.dmp

Filesize
1.2MB

Download
memory/2716-34-0x0000000006180000-0x0000000006254000-memory.dmp

Filesize
848KB

Download
memory/2716-29-0x0000000006180000-0x0000000006254000-memory.dmp

Filesize
848KB

Download
memory/2820-19-0x0000000001D70000-0x0000000001E44000-memory.dmp

Filesize
848KB

Download
memory/2820-6-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2820-2-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2820-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2820-16-0x0000000001D70000-0x0000000001E44000-memory.dmp

Filesize
848KB

Download
memory/2820-14-0x0000000001D70000-0x0000000001E44000-memory.dmp

Filesize
848KB

Download
memory/2820-15-0x0000000001D70000-0x0000000001E44000-memory.dmp

Filesize
848KB

Download
memory/2820-4-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2820-20-0x0000000001D70000-0x0000000001E44000-memory.dmp

Filesize
848KB

Download
memory/2820-13-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2820-8-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2820-10-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2820-18-0x0000000001D70000-0x0000000001E44000-memory.dmp

Filesize
848KB

Download
memory/2820-12-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2820-17-0x0000000001D70000-0x0000000001E44000-memory.dmp

Filesize
848KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads