modiloader | 57aaffcdd21b962bcf1c34c032f69c1ec1c680c23d1816688dc7dbe1175b5702

General

Target

b816369b655826e66fde3618f30a545c_JaffaCakes118.exe
Size

277KB
MD5

b816369b655826e66fde3618f30a545c
SHA1

47cb7037339f019b345c85accdbf3c28f9aaaeee
SHA256

57aaffcdd21b962bcf1c34c032f69c1ec1c680c23d1816688dc7dbe1175b5702
SHA512

a277a2d8c95c4205d021c4459666831054a39ddd08f4614bbb13ee9ebb52f45f6f7a632344894777e692aeff55b06e1d1cdbe7280928413c09de73dcf43737c2
SSDEEP

3072:ocWRylkb9JD4R0lYZAI3rr1GvRkIG+Y+fDm07pID6XuNL5SfSwyOipMsEZr:oc4yu9JCEYZpYJJGV+bu6uNLxFRc

Score

10^/10

modiloader evasion persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

mshta.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2628 2652 mshta.exe
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions regsvr32.exe
Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
evasion

File and Directory Discovery
T1083

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2652	mshta.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	regsvr32.exe

description	ioc	process
File opened (read-only)	C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys	regsvr32.exe

ModiLoader Second Stage 60 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2320-2-0x0000000000400000-0x0000000000439000-memory.dmp	modiloader_stage2
behavioral1/memory/2320-5-0x0000000000400000-0x0000000000439000-memory.dmp	modiloader_stage2
behavioral1/memory/2320-4-0x0000000000400000-0x0000000000439000-memory.dmp	modiloader_stage2
behavioral1/memory/2320-6-0x0000000001D80000-0x0000000001E54000-memory.dmp	modiloader_stage2
behavioral1/memory/2320-10-0x0000000001D80000-0x0000000001E54000-memory.dmp	modiloader_stage2
behavioral1/memory/2320-9-0x0000000001D80000-0x0000000001E54000-memory.dmp	modiloader_stage2
behavioral1/memory/2320-8-0x0000000001D80000-0x0000000001E54000-memory.dmp	modiloader_stage2
behavioral1/memory/2320-7-0x0000000001D80000-0x0000000001E54000-memory.dmp	modiloader_stage2
behavioral1/memory/2320-11-0x0000000001D80000-0x0000000001E54000-memory.dmp	modiloader_stage2
behavioral1/memory/2320-12-0x0000000001D80000-0x0000000001E54000-memory.dmp	modiloader_stage2
behavioral1/memory/2804-21-0x0000000006230000-0x0000000006304000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-23-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-24-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-30-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-36-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-27-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-28-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2804-26-0x0000000006230000-0x0000000006304000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-29-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-32-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-39-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-48-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-47-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-46-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-45-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-44-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-43-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-49-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-59-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-58-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-57-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-56-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-55-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-54-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-42-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-41-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-40-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-38-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-37-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-35-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-34-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-33-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-31-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2712-66-0x0000000000110000-0x000000000024E000-memory.dmp	modiloader_stage2
behavioral1/memory/2008-81-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2008-78-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2008-76-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2008-82-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2008-80-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2008-79-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2008-77-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2008-75-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2008-73-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2008-72-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2008-74-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2008-71-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2008-70-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2008-69-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2008-68-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2008-67-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2

Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	regsvr32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	regsvr32.exe

Deletes itself 1 IoCs

Processes:

regsvr32.exe

pid process

2712 regsvr32.exe
Drops startup file 1 IoCs

Processes:

regsvr32.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\601f00.lnk regsvr32.exe

pid	process
2712	regsvr32.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\601f00.lnk	regsvr32.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:U0M1odGGM=\"95DKuFU\";s5x=new%20ActiveXObject(\"WScript.Shell\");QbpZ2hVH=\"cGuFBGg\";Hx3Or=s5x.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\tbxrem\\\\kgltsyfy\");RJ7VJZP=\"ty\";eval(Hx3Or);nbtt0j3q=\"j\";"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:C2vClatJQ=\"rKgQqbpVqG\";N8i5=new%20ActiveXObject(\"WScript.Shell\");UT0mTfh=\"zkopbtc\";fU6EJ=N8i5.RegRead(\"HKCU\\\\software\\\\tbxrem\\\\kgltsyfy\");swV8VICm=\"3W1iY4t\";eval(fU6EJ);gnwP8A3SAu=\"2RZ618\";"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\2f4789\\6bc9fe.lnk\""	regsvr32.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	regsvr32.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

b816369b655826e66fde3618f30a545c_JaffaCakes118.exepowershell.exeregsvr32.exe

description	pid	process	target process
PID 1720 set thread context of 2320	1720	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe
PID 2804 set thread context of 2712	2804	powershell.exe	regsvr32.exe
PID 2712 set thread context of 2008	2712	regsvr32.exe	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International	regsvr32.exe

Modifies registry class 7 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\f8f880	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\f8f880\shell	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\f8f880\shell\open	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\f8f880\shell\open\command	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\f8f880\shell\open\command\ = "mshta \"javascript:zXXy1oq=\"jksdfwf5a\";Lm4=new ActiveXObject(\"WScript.Shell\");OVnaDvG4Z=\"rVd4\";zBhy1=Lm4.RegRead(\"HKCU\\\\software\\\\tbxrem\\\\kgltsyfy\");sma0XSyb4=\"7slrl4\";eval(zBhy1);sfOo2hP=\"8zLAp\";\""	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.6cddf16	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.6cddf16\ = "f8f880"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeregsvr32.exe

pid	process
2804	powershell.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

powershell.exeregsvr32.exe

pid process

2804 powershell.exe
2712 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2804 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

b816369b655826e66fde3618f30a545c_JaffaCakes118.exe

pid process

1720 b816369b655826e66fde3618f30a545c_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2804	powershell.exe

pid	process
1720	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

b816369b655826e66fde3618f30a545c_JaffaCakes118.exemshta.exepowershell.exeregsvr32.exe

description	pid	process	target process
PID 1720 wrote to memory of 2320	1720	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe
PID 1720 wrote to memory of 2320	1720	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe
PID 1720 wrote to memory of 2320	1720	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe
PID 1720 wrote to memory of 2320	1720	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe
PID 1720 wrote to memory of 2320	1720	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe
PID 1720 wrote to memory of 2320	1720	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe
PID 1720 wrote to memory of 2320	1720	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe
PID 1720 wrote to memory of 2320	1720	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe
PID 1720 wrote to memory of 2320	1720	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe
PID 1720 wrote to memory of 2320	1720	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe
PID 1720 wrote to memory of 2320	1720	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe	b816369b655826e66fde3618f30a545c_JaffaCakes118.exe
PID 2628 wrote to memory of 2804	2628	mshta.exe	powershell.exe
PID 2628 wrote to memory of 2804	2628	mshta.exe	powershell.exe
PID 2628 wrote to memory of 2804	2628	mshta.exe	powershell.exe
PID 2628 wrote to memory of 2804	2628	mshta.exe	powershell.exe
PID 2804 wrote to memory of 2712	2804	powershell.exe	regsvr32.exe
PID 2804 wrote to memory of 2712	2804	powershell.exe	regsvr32.exe
PID 2804 wrote to memory of 2712	2804	powershell.exe	regsvr32.exe
PID 2804 wrote to memory of 2712	2804	powershell.exe	regsvr32.exe
PID 2804 wrote to memory of 2712	2804	powershell.exe	regsvr32.exe
PID 2804 wrote to memory of 2712	2804	powershell.exe	regsvr32.exe
PID 2804 wrote to memory of 2712	2804	powershell.exe	regsvr32.exe
PID 2804 wrote to memory of 2712	2804	powershell.exe	regsvr32.exe
PID 2712 wrote to memory of 2008	2712	regsvr32.exe	regsvr32.exe
PID 2712 wrote to memory of 2008	2712	regsvr32.exe	regsvr32.exe
PID 2712 wrote to memory of 2008	2712	regsvr32.exe	regsvr32.exe
PID 2712 wrote to memory of 2008	2712	regsvr32.exe	regsvr32.exe
PID 2712 wrote to memory of 2008	2712	regsvr32.exe	regsvr32.exe
PID 2712 wrote to memory of 2008	2712	regsvr32.exe	regsvr32.exe
PID 2712 wrote to memory of 2008	2712	regsvr32.exe	regsvr32.exe
PID 2712 wrote to memory of 2008	2712	regsvr32.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\b816369b655826e66fde3618f30a545c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b816369b655826e66fde3618f30a545c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720

C:\Users\Admin\AppData\Local\Temp\b816369b655826e66fde3618f30a545c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b816369b655826e66fde3618f30a545c_JaffaCakes118.exe"
2⤵
PID:2320

C:\Windows\system32\mshta.exe
"C:\Windows\system32\mshta.exe" javascript:zKpC98rA="TMreN6";Rl7=new%20ActiveXObject("WScript.Shell");WA3yQrm="wjfkKHBG";z30gkX=Rl7.RegRead("HKLM\\software\\Wow6432Node\\emQf7D\\Y90R67NczS");yvGN32MXT="ReE0iu4";eval(z30gkX);slZ1h1clJ="uO";
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2628

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:wypfsx
2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe
3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Drops startup file
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2712

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\SysWOW64\regsvr32.exe"
4⤵
PID:2008

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

3

T1497

Modify Registry

2

T1112

Credential Access

Discovery

Software Discovery

1

T1518

Query Registry

4

T1012

Virtualization/Sandbox Evasion

3

T1497

File and Directory Discovery

1

T1083

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\2f4789\6bc9fe.lnk
Filesize
877B

MD5
118d5880670d097dcc8e8daa6c99be4b

SHA1
1ea0a544121948291573c13649cacf7d6c732ce0

SHA256
1bd30d64e70799eb8c93ee812a3e4410ad112224ff7b1747b9bcc8bf370dbad2

SHA512
0676d2c5c93f77189e1523287a94a3f32e4fd15f5e885bfdfbabd5df579c5ba030af3722cd1b45c7ee6df4e5e364383ff1509fb60b723360203483a94a169cb5

Download Submit
C:\Users\Admin\AppData\Local\2f4789\cf743a.6cddf16
Filesize
24KB

MD5
bb8047abd95c0f433562863ec9f0c135

SHA1
bd9683e2788ecf190310d7c6014ab77af40f68da

SHA256
3d26e3e81d0ce9b4bb59a2ce139c9a991d0522d8ef515b35dd649c6c9ea3a46e

SHA512
15a7d228dfc9b7444fd8ab5c15adcbf879602c0d3d689669ceaeb58808f7db86b2e733f27f68023bdb4cd47e5305ad9db90a9496462f838131dd6454cd54024b

Download Submit
C:\Users\Admin\AppData\Local\2f4789\ea3dbb.bat
Filesize
61B

MD5
d4ec627a1d9ca558fd3d5fae26a947e9

SHA1
1c63212329281c2d22a9cba716e4ee6a03cf19e2

SHA256
167af01d0aa246d0c9572d34fcd254ede62be98708af922a6b521d5740a9ddde

SHA512
45708682cd7e4c12b68fd467d69a96fce4cf168fbf2ea5514fcc1b0970295aa8821b67663a6b96f2f126474994aa4858c8802df2083e6dc8ae009a3da66b1502

Download Submit
C:\Users\Admin\AppData\Roaming\06809f\0da6de.6cddf16
Filesize
32KB

MD5
b27774c576ec097c065c9eca492f5d07

SHA1
5425404d9269887c20c267bb086b10cd9191a994

SHA256
3704885a73db3038c743c574d57e4339752c30a8d100dde0d16496147a8e0a2b

SHA512
eca4e724d058e7271bf5833d03ba44841f1c90d5b91f46e7d52756e93c4aa73719394286ada275364a497ae2f44b5b5f602026e6c85c1de512401ce2da6b133d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\601f00.lnk
Filesize
987B

MD5
aa8bec15e78c5081c574592a9deb1641

SHA1
35b134c4570644753a153e7b36a0ef0888b1fa52

SHA256
da78a7c4e930eb9ec20bed774a42022394a29d5d8426c848164256633457fa84

SHA512
602a677f3069c91de184ab21e35dcde34701847d5581a1676f67d52f730e2ee42a6e43f116c39414f41586fb71b3e9dccad41dc7044aab65abfa13f559b013d5

Download Submit
memory/2008-74-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2008-75-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2008-78-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2008-76-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2008-82-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2008-80-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2008-79-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2008-77-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2008-73-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2008-72-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2008-67-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2008-81-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2008-68-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2008-69-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2008-70-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2008-71-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2320-2-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2320-5-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2320-4-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2320-8-0x0000000001D80000-0x0000000001E54000-memory.dmp

Filesize
848KB

Download
memory/2320-6-0x0000000001D80000-0x0000000001E54000-memory.dmp

Filesize
848KB

Download
memory/2320-10-0x0000000001D80000-0x0000000001E54000-memory.dmp

Filesize
848KB

Download
memory/2320-9-0x0000000001D80000-0x0000000001E54000-memory.dmp

Filesize
848KB

Download
memory/2320-12-0x0000000001D80000-0x0000000001E54000-memory.dmp

Filesize
848KB

Download
memory/2320-11-0x0000000001D80000-0x0000000001E54000-memory.dmp

Filesize
848KB

Download
memory/2320-7-0x0000000001D80000-0x0000000001E54000-memory.dmp

Filesize
848KB

Download
memory/2712-28-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-49-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-54-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-42-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-41-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-40-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-38-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-37-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-35-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-34-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-33-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-31-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-66-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-56-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-57-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-58-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-59-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-55-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-43-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-44-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-45-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-46-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-47-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-48-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-39-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-32-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-29-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-23-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-27-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-36-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-30-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2712-24-0x0000000000110000-0x000000000024E000-memory.dmp

Filesize
1.2MB

Download
memory/2804-26-0x0000000006230000-0x0000000006304000-memory.dmp

Filesize
848KB

Download
memory/2804-21-0x0000000006230000-0x0000000006304000-memory.dmp

Filesize
848KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads