modiloader | 83aa4fc19d2d632129b49ed54955cc263e7c9bc54f232e8717e79596248cda90

General

Target

bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe
Size

265KB
MD5

bc15a3d99e38ae394eb2a5e71ae45829
SHA1

1f056bc37b3ee76987931229401a898a1ab95453
SHA256

83aa4fc19d2d632129b49ed54955cc263e7c9bc54f232e8717e79596248cda90
SHA512

d7e890e88b624292c48c1d6b9eb5cbdb7bc265625f27e5fb9a44c2e88327baf10684c55759b934dfe6837617606734009c78ec983e5b5283015e6cb0f46f70aa
SSDEEP

6144:lz4AXgn5zdXBWEtc3+gy0nps2hFRedE56Eit7Ike9zPX:B4Cgn5D1c3Y0hF8dHnt7Ij9zPX

Score

10^/10

modiloader evasion persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

mshta.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2636 2800 mshta.exe
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions regsvr32.exe
Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
evasion

File and Directory Discovery
T1083

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2800	mshta.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	regsvr32.exe

description	ioc	process
File opened (read-only)	C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys	regsvr32.exe

ModiLoader Second Stage 58 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1876-2-0x0000000000400000-0x0000000000439000-memory.dmp	modiloader_stage2
behavioral1/memory/1876-4-0x0000000000400000-0x0000000000439000-memory.dmp	modiloader_stage2
behavioral1/memory/1876-5-0x0000000000400000-0x0000000000439000-memory.dmp	modiloader_stage2
behavioral1/memory/1876-6-0x0000000000220000-0x00000000002F4000-memory.dmp	modiloader_stage2
behavioral1/memory/1876-8-0x0000000000220000-0x00000000002F4000-memory.dmp	modiloader_stage2
behavioral1/memory/1876-7-0x0000000000220000-0x00000000002F4000-memory.dmp	modiloader_stage2
behavioral1/memory/1876-11-0x0000000000220000-0x00000000002F4000-memory.dmp	modiloader_stage2
behavioral1/memory/1876-10-0x0000000000220000-0x00000000002F4000-memory.dmp	modiloader_stage2
behavioral1/memory/1876-12-0x0000000000220000-0x00000000002F4000-memory.dmp	modiloader_stage2
behavioral1/memory/2804-21-0x00000000061C0000-0x0000000006294000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-25-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-23-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2804-26-0x00000000061C0000-0x0000000006294000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-27-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-42-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-43-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-44-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-41-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-40-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-39-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-38-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-37-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-36-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-35-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-34-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-33-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-32-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-31-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-30-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-29-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-28-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-47-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-46-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-48-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-50-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-54-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-55-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-53-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-52-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-51-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-49-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/2704-66-0x00000000002A0000-0x00000000003DE000-memory.dmp	modiloader_stage2
behavioral1/memory/1860-67-0x0000000000260000-0x000000000039E000-memory.dmp	modiloader_stage2
behavioral1/memory/1860-68-0x0000000000260000-0x000000000039E000-memory.dmp	modiloader_stage2
behavioral1/memory/1860-75-0x0000000000260000-0x000000000039E000-memory.dmp	modiloader_stage2
behavioral1/memory/1860-82-0x0000000000260000-0x000000000039E000-memory.dmp	modiloader_stage2
behavioral1/memory/1860-81-0x0000000000260000-0x000000000039E000-memory.dmp	modiloader_stage2
behavioral1/memory/1860-79-0x0000000000260000-0x000000000039E000-memory.dmp	modiloader_stage2
behavioral1/memory/1860-78-0x0000000000260000-0x000000000039E000-memory.dmp	modiloader_stage2
behavioral1/memory/1860-77-0x0000000000260000-0x000000000039E000-memory.dmp	modiloader_stage2
behavioral1/memory/1860-76-0x0000000000260000-0x000000000039E000-memory.dmp	modiloader_stage2
behavioral1/memory/1860-74-0x0000000000260000-0x000000000039E000-memory.dmp	modiloader_stage2
behavioral1/memory/1860-73-0x0000000000260000-0x000000000039E000-memory.dmp	modiloader_stage2
behavioral1/memory/1860-72-0x0000000000260000-0x000000000039E000-memory.dmp	modiloader_stage2
behavioral1/memory/1860-70-0x0000000000260000-0x000000000039E000-memory.dmp	modiloader_stage2
behavioral1/memory/1860-69-0x0000000000260000-0x000000000039E000-memory.dmp	modiloader_stage2
behavioral1/memory/1860-80-0x0000000000260000-0x000000000039E000-memory.dmp	modiloader_stage2
behavioral1/memory/1860-71-0x0000000000260000-0x000000000039E000-memory.dmp	modiloader_stage2

Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	regsvr32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	regsvr32.exe

Deletes itself 1 IoCs

Processes:

regsvr32.exe

pid process

2704 regsvr32.exe
Drops startup file 1 IoCs

Processes:

regsvr32.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3011.lnk regsvr32.exe

pid	process
2704	regsvr32.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3011.lnk	regsvr32.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\43e4\\fa89.lnk\""	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:FVT9cLzMx=\"NtDxWFG\";Ch11=new%20ActiveXObject(\"WScript.Shell\");nsINCmu41I=\"B0\";p63Qdh=Ch11.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\epsehio\\\\uqkiailgu\");HciXS4hF=\"SjWIg9\";eval(p63Qdh);IOIIN0P=\"CWMG2tYQ\";"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:VzskqP3S8=\"srbJPMGY\";D7Q0=new%20ActiveXObject(\"WScript.Shell\");hewDWF8iT=\"K\";VoHy8=D7Q0.RegRead(\"HKCU\\\\software\\\\epsehio\\\\uqkiailgu\");g8iuEXT=\"I0Vgj\";eval(VoHy8);ZYL9T1BUFm=\"KdbjaYASvp\";"	regsvr32.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	regsvr32.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exepowershell.exeregsvr32.exe

description	pid	process	target process
PID 1620 set thread context of 1876	1620	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe
PID 2804 set thread context of 2704	2804	powershell.exe	regsvr32.exe
PID 2704 set thread context of 1860	2704	regsvr32.exe	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International	regsvr32.exe

Modifies registry class 7 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\49a7	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\49a7\shell	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\49a7\shell\open	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\49a7\shell\open\command	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\49a7\shell\open\command\ = "mshta \"javascript:GTGTHA0=\"3OGBEk\";Sj57=new ActiveXObject(\"WScript.Shell\");ucH77BQra=\"WArCiWmwD\";K2WUb9=Sj57.RegRead(\"HKCU\\\\software\\\\epsehio\\\\uqkiailgu\");RUP4S9Hl=\"3QklhToe\";eval(K2WUb9);Y2Xltew2z=\"MEn\";\""	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.6f350	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.6f350\ = "49a7"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeregsvr32.exe

pid	process
2804	powershell.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

powershell.exeregsvr32.exe

pid process

2804 powershell.exe
2704 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2804 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe

pid process

1620 bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2804	powershell.exe

pid	process
1620	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exemshta.exepowershell.exeregsvr32.exe

description	pid	process	target process
PID 1620 wrote to memory of 1876	1620	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe
PID 1620 wrote to memory of 1876	1620	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe
PID 1620 wrote to memory of 1876	1620	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe
PID 1620 wrote to memory of 1876	1620	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe
PID 1620 wrote to memory of 1876	1620	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe
PID 1620 wrote to memory of 1876	1620	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe
PID 1620 wrote to memory of 1876	1620	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe
PID 1620 wrote to memory of 1876	1620	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe
PID 1620 wrote to memory of 1876	1620	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe
PID 1620 wrote to memory of 1876	1620	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe
PID 1620 wrote to memory of 1876	1620	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe	bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe
PID 2636 wrote to memory of 2804	2636	mshta.exe	powershell.exe
PID 2636 wrote to memory of 2804	2636	mshta.exe	powershell.exe
PID 2636 wrote to memory of 2804	2636	mshta.exe	powershell.exe
PID 2636 wrote to memory of 2804	2636	mshta.exe	powershell.exe
PID 2804 wrote to memory of 2704	2804	powershell.exe	regsvr32.exe
PID 2804 wrote to memory of 2704	2804	powershell.exe	regsvr32.exe
PID 2804 wrote to memory of 2704	2804	powershell.exe	regsvr32.exe
PID 2804 wrote to memory of 2704	2804	powershell.exe	regsvr32.exe
PID 2804 wrote to memory of 2704	2804	powershell.exe	regsvr32.exe
PID 2804 wrote to memory of 2704	2804	powershell.exe	regsvr32.exe
PID 2804 wrote to memory of 2704	2804	powershell.exe	regsvr32.exe
PID 2804 wrote to memory of 2704	2804	powershell.exe	regsvr32.exe
PID 2704 wrote to memory of 1860	2704	regsvr32.exe	regsvr32.exe
PID 2704 wrote to memory of 1860	2704	regsvr32.exe	regsvr32.exe
PID 2704 wrote to memory of 1860	2704	regsvr32.exe	regsvr32.exe
PID 2704 wrote to memory of 1860	2704	regsvr32.exe	regsvr32.exe
PID 2704 wrote to memory of 1860	2704	regsvr32.exe	regsvr32.exe
PID 2704 wrote to memory of 1860	2704	regsvr32.exe	regsvr32.exe
PID 2704 wrote to memory of 1860	2704	regsvr32.exe	regsvr32.exe
PID 2704 wrote to memory of 1860	2704	regsvr32.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620

C:\Users\Admin\AppData\Local\Temp\bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bc15a3d99e38ae394eb2a5e71ae45829_JaffaCakes118.exe"
2⤵
PID:1876

C:\Windows\system32\mshta.exe
"C:\Windows\system32\mshta.exe" javascript:octoJzs83="LNT";f7E=new%20ActiveXObject("WScript.Shell");w3ReXg2kkX="TihmQir";JZg5I=f7E.RegRead("HKLM\\software\\Wow6432Node\\WpMlzBbWbQ\\xJ3QcN");B0hctU1uRv="cDq";eval(JZg5I);v8FauDQh1="CJN";
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2636

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:gxtyc
2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe
3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Drops startup file
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2704

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\SysWOW64\regsvr32.exe"
4⤵
PID:1860

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

3

T1497

Modify Registry

2

T1112

Credential Access

Discovery

Software Discovery

1

T1518

Query Registry

4

T1012

Virtualization/Sandbox Evasion

3

T1497

File and Directory Discovery

1

T1083

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\43e4\8d79.6f350
Filesize
28KB

MD5
ec074fc0ed016c440701b15a00a1be27

SHA1
a50adc17b29672649f159d168346be381bd00d21

SHA256
470399d8614f49ba259700daf2b05ed806bb70b7cea0019f86ce4e8bca1ab5d1

SHA512
486dc39e66e1e7b7bddcbf9534ece991a37999da02690ccb48b2ec80c9f741aad7209c4a27c7e0f3ed91da1da5d477761fb7883a3262d5dc3edab5c390ebe707

Download Submit
C:\Users\Admin\AppData\Local\43e4\b67d.bat
Filesize
55B

MD5
27ce144177a8617384899301a2b4330f

SHA1
1dead7588f1982006065dc8a25deb05385fbe649

SHA256
fa24ed9d8ea201f657bfea7f56fc698a39216eecccdc29fc0a12dc3592badce4

SHA512
0724ac2a3c9321241afdaad3fed8923b5748a47fde6319daf4fd320420a0a20e5487c5c1e36bdea009c5e686371fd172832ba92e4e9086f307afb7d8c741608b

Download Submit
C:\Users\Admin\AppData\Local\43e4\fa89.lnk
Filesize
857B

MD5
a644ea1f5e64ddd4b78d530f65682efc

SHA1
e718d645cb561bcf1efef4befe7f599bc81e464c

SHA256
fb99bb4e3b47034b80ae9e0d8a339cd34ca538880fd3515e9bcb957ba6b62d53

SHA512
d4925beadf2c39a5bad4140a27949d78b39d369f59f00ffdf99e62a2e7ea7becbbfa1794705724d97b2ad7ec17177ddcb725cbf5a53683f43bafd1bbd3ce29fc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3011.lnk
Filesize
975B

MD5
8d5bb2b931a7e033cee142b8b13bb0e3

SHA1
207008a44b3025dfb99a1bb899dd34ea1738bcbf

SHA256
84dd529a018e650b9e92289f2aaeeaf04bf6b439f2cfd6b4ab29b991eff6a162

SHA512
5d67ec78cbb5add4e926afa1ab468ca5e3d47e75711319d5fe0813d32027870500eea90ce3c968875db0882318afb44f61a9eae2be9ea907c03bce4bcef27315

Download Submit
C:\Users\Admin\AppData\Roaming\ef44\0b63.6f350
Filesize
15KB

MD5
2e3f1aa813ba0f98e04d940697ee2382

SHA1
c5a6114358b70318632db1c6863df1e00ae1478f

SHA256
8949749c9ee47e8f6be75d89da329ed4a741d8540ef9aa6cccda5a5008fa1fcc

SHA512
174474285ad7eafb49711eedd1c2e91c36b67932ed5eb60671beab207dd6a73d210c401a8a3e77a9f6c92641f88d08daa303c0e7b42e8340e8efb1d0efa24536

Download Submit
memory/1860-74-0x0000000000260000-0x000000000039E000-memory.dmp

Filesize
1.2MB

Download
memory/1860-78-0x0000000000260000-0x000000000039E000-memory.dmp

Filesize
1.2MB

Download
memory/1860-68-0x0000000000260000-0x000000000039E000-memory.dmp

Filesize
1.2MB

Download
memory/1860-75-0x0000000000260000-0x000000000039E000-memory.dmp

Filesize
1.2MB

Download
memory/1860-82-0x0000000000260000-0x000000000039E000-memory.dmp

Filesize
1.2MB

Download
memory/1860-81-0x0000000000260000-0x000000000039E000-memory.dmp

Filesize
1.2MB

Download
memory/1860-79-0x0000000000260000-0x000000000039E000-memory.dmp

Filesize
1.2MB

Download
memory/1860-77-0x0000000000260000-0x000000000039E000-memory.dmp

Filesize
1.2MB

Download
memory/1860-76-0x0000000000260000-0x000000000039E000-memory.dmp

Filesize
1.2MB

Download
memory/1860-71-0x0000000000260000-0x000000000039E000-memory.dmp

Filesize
1.2MB

Download
memory/1860-67-0x0000000000260000-0x000000000039E000-memory.dmp

Filesize
1.2MB

Download
memory/1860-80-0x0000000000260000-0x000000000039E000-memory.dmp

Filesize
1.2MB

Download
memory/1860-69-0x0000000000260000-0x000000000039E000-memory.dmp

Filesize
1.2MB

Download
memory/1860-70-0x0000000000260000-0x000000000039E000-memory.dmp

Filesize
1.2MB

Download
memory/1860-72-0x0000000000260000-0x000000000039E000-memory.dmp

Filesize
1.2MB

Download
memory/1860-73-0x0000000000260000-0x000000000039E000-memory.dmp

Filesize
1.2MB

Download
memory/1876-2-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1876-4-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1876-5-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1876-11-0x0000000000220000-0x00000000002F4000-memory.dmp

Filesize
848KB

Download
memory/1876-6-0x0000000000220000-0x00000000002F4000-memory.dmp

Filesize
848KB

Download
memory/1876-8-0x0000000000220000-0x00000000002F4000-memory.dmp

Filesize
848KB

Download
memory/1876-7-0x0000000000220000-0x00000000002F4000-memory.dmp

Filesize
848KB

Download
memory/1876-12-0x0000000000220000-0x00000000002F4000-memory.dmp

Filesize
848KB

Download
memory/1876-10-0x0000000000220000-0x00000000002F4000-memory.dmp

Filesize
848KB

Download
memory/2704-43-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-33-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-46-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-48-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-50-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-54-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-55-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-53-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-52-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-51-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-49-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-66-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-28-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-29-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-30-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-31-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-32-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-47-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-34-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-35-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-36-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-37-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-38-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-39-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-40-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-41-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-44-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-42-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-27-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-25-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2704-23-0x00000000002A0000-0x00000000003DE000-memory.dmp

Filesize
1.2MB

Download
memory/2804-26-0x00000000061C0000-0x0000000006294000-memory.dmp

Filesize
848KB

Download
memory/2804-21-0x00000000061C0000-0x0000000006294000-memory.dmp

Filesize
848KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads