modiloader | 67148585e3e45054749c2ea832680577ee2043705b7559d233a99c9567d55507

General

Target

02d98b95a8871f838c5a365f24383b9a_JaffaCakes118.exe
Size

417KB
MD5

02d98b95a8871f838c5a365f24383b9a
SHA1

a6c1205fc773bc08ca64710dae40a74d77aca6a8
SHA256

67148585e3e45054749c2ea832680577ee2043705b7559d233a99c9567d55507
SHA512

381272c38b799872c82afe1760402d7d8b371165635c3834ee5d911d5a2bf38c0a29db27e1646bb1b93cc3f8fb4ca80796b25c70c4a582aa61db4eb08ca1b12e
SSDEEP

12288:ysRpeFovtrv8UXOndOGqJXkv53C4taA9tGel:y+eWlrvXXOnUKRFtH

Score

10^/10

modiloader evasion persistence privilege_escalation trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

mstwain32.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

ModiLoader Second Stage 13 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2024-38-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/3056-53-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/3056-62-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/3056-67-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/3056-72-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/3056-77-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/3056-82-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/3056-87-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/3056-92-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/3056-97-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/3056-102-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/3056-107-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/3056-112-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

4480 netsh.exe

pid	process
4480	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

02d98b95a8871f838c5a365f24383b9a_JaffaCakes118.exeNT.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	02d98b95a8871f838c5a365f24383b9a_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	NT.exe

Executes dropped EXE 3 IoCs

Processes:

NT.exeSPAM BOT 3.6.exemstwain32.exe

pid process

2024 NT.exe
3556 SPAM BOT 3.6.exe
3056 mstwain32.exe
Loads dropped DLL 6 IoCs

Processes:

mstwain32.exeSPAM BOT 3.6.exe

pid process

3056 mstwain32.exe
3056 mstwain32.exe
3056 mstwain32.exe
3056 mstwain32.exe
3556 SPAM BOT 3.6.exe
3556 SPAM BOT 3.6.exe

pid	process
2024	NT.exe
3556	SPAM BOT 3.6.exe
3056	mstwain32.exe

pid	process
3056	mstwain32.exe
3056	mstwain32.exe
3056	mstwain32.exe
3056	mstwain32.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe

UPX packed file 30 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\NT.exe	upx
behavioral2/memory/2024-10-0x0000000000400000-0x0000000000450000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\SPAM BOT 3.6.exe	upx
behavioral2/memory/3556-25-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral2/memory/2024-38-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/3556-52-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral2/memory/3056-53-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/3556-60-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral2/memory/3056-62-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/3556-65-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral2/memory/3056-67-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/3556-70-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral2/memory/3056-72-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/3556-75-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral2/memory/3056-77-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/3556-80-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral2/memory/3056-82-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/3556-85-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral2/memory/3056-87-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/3556-90-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral2/memory/3056-92-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/3556-95-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral2/memory/3056-97-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/3556-100-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral2/memory/3056-102-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/3556-105-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral2/memory/3056-107-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/3556-110-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral2/memory/3056-112-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/3556-115-0x0000000000400000-0x00000000004C1000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

mstwain32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe"	mstwain32.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

NT.exemstwain32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	NT.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mstwain32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

AutoIT Executable 13 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/3556-52-0x0000000000400000-0x00000000004C1000-memory.dmp	autoit_exe
behavioral2/memory/3556-60-0x0000000000400000-0x00000000004C1000-memory.dmp	autoit_exe
behavioral2/memory/3556-65-0x0000000000400000-0x00000000004C1000-memory.dmp	autoit_exe
behavioral2/memory/3556-70-0x0000000000400000-0x00000000004C1000-memory.dmp	autoit_exe
behavioral2/memory/3556-75-0x0000000000400000-0x00000000004C1000-memory.dmp	autoit_exe
behavioral2/memory/3556-80-0x0000000000400000-0x00000000004C1000-memory.dmp	autoit_exe
behavioral2/memory/3556-85-0x0000000000400000-0x00000000004C1000-memory.dmp	autoit_exe
behavioral2/memory/3556-90-0x0000000000400000-0x00000000004C1000-memory.dmp	autoit_exe
behavioral2/memory/3556-95-0x0000000000400000-0x00000000004C1000-memory.dmp	autoit_exe
behavioral2/memory/3556-100-0x0000000000400000-0x00000000004C1000-memory.dmp	autoit_exe
behavioral2/memory/3556-105-0x0000000000400000-0x00000000004C1000-memory.dmp	autoit_exe
behavioral2/memory/3556-110-0x0000000000400000-0x00000000004C1000-memory.dmp	autoit_exe
behavioral2/memory/3556-115-0x0000000000400000-0x00000000004C1000-memory.dmp	autoit_exe

Drops file in Windows directory 4 IoCs

Processes:

NT.exemstwain32.exe

description	ioc	process
File opened for modification	C:\Windows\mstwain32.exe	NT.exe
File created	C:\Windows\ntdtcstp.dll	mstwain32.exe
File created	C:\Windows\cmsetac.dll	mstwain32.exe
File created	C:\Windows\mstwain32.exe	NT.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Modifies registry class 1 IoCs

Processes:

rundll32.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings rundll32.exe
Runs net.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	rundll32.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

NT.exevssvc.exemstwain32.exeSPAM BOT 3.6.exe

description	pid	process
Token: SeDebugPrivilege	2024	NT.exe
Token: SeBackupPrivilege	532	vssvc.exe
Token: SeRestorePrivilege	532	vssvc.exe
Token: SeAuditPrivilege	532	vssvc.exe
Token: SeDebugPrivilege	3056	mstwain32.exe
Token: SeDebugPrivilege	3056	mstwain32.exe
Token: SeDebugPrivilege	3556	SPAM BOT 3.6.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

SPAM BOT 3.6.exe

pid	process
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

SPAM BOT 3.6.exe

pid	process
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe
3556	SPAM BOT 3.6.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

02d98b95a8871f838c5a365f24383b9a_JaffaCakes118.exemstwain32.exe

pid process

320 02d98b95a8871f838c5a365f24383b9a_JaffaCakes118.exe
3056 mstwain32.exe
3056 mstwain32.exe

pid	process
320	02d98b95a8871f838c5a365f24383b9a_JaffaCakes118.exe
3056	mstwain32.exe
3056	mstwain32.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

02d98b95a8871f838c5a365f24383b9a_JaffaCakes118.execmd.exenet.exeNT.exe

description	pid	process	target process
PID 320 wrote to memory of 2024	320	02d98b95a8871f838c5a365f24383b9a_JaffaCakes118.exe	NT.exe
PID 320 wrote to memory of 2024	320	02d98b95a8871f838c5a365f24383b9a_JaffaCakes118.exe	NT.exe
PID 320 wrote to memory of 2024	320	02d98b95a8871f838c5a365f24383b9a_JaffaCakes118.exe	NT.exe
PID 320 wrote to memory of 1620	320	02d98b95a8871f838c5a365f24383b9a_JaffaCakes118.exe	cmd.exe
PID 320 wrote to memory of 1620	320	02d98b95a8871f838c5a365f24383b9a_JaffaCakes118.exe	cmd.exe
PID 320 wrote to memory of 1620	320	02d98b95a8871f838c5a365f24383b9a_JaffaCakes118.exe	cmd.exe
PID 320 wrote to memory of 3556	320	02d98b95a8871f838c5a365f24383b9a_JaffaCakes118.exe	SPAM BOT 3.6.exe
PID 320 wrote to memory of 3556	320	02d98b95a8871f838c5a365f24383b9a_JaffaCakes118.exe	SPAM BOT 3.6.exe
PID 320 wrote to memory of 3556	320	02d98b95a8871f838c5a365f24383b9a_JaffaCakes118.exe	SPAM BOT 3.6.exe
PID 1620 wrote to memory of 5104	1620	cmd.exe	net.exe
PID 1620 wrote to memory of 5104	1620	cmd.exe	net.exe
PID 1620 wrote to memory of 5104	1620	cmd.exe	net.exe
PID 5104 wrote to memory of 1420	5104	net.exe	net1.exe
PID 5104 wrote to memory of 1420	5104	net.exe	net1.exe
PID 5104 wrote to memory of 1420	5104	net.exe	net1.exe
PID 1620 wrote to memory of 4480	1620	cmd.exe	netsh.exe
PID 1620 wrote to memory of 4480	1620	cmd.exe	netsh.exe
PID 1620 wrote to memory of 4480	1620	cmd.exe	netsh.exe
PID 2024 wrote to memory of 3056	2024	NT.exe	mstwain32.exe
PID 2024 wrote to memory of 3056	2024	NT.exe	mstwain32.exe
PID 2024 wrote to memory of 3056	2024	NT.exe	mstwain32.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

mstwain32.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

C:\Users\Admin\AppData\Local\Temp\02d98b95a8871f838c5a365f24383b9a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02d98b95a8871f838c5a365f24383b9a_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:320

C:\Users\Admin\AppData\Local\Temp\NT.exe
"C:\Users\Admin\AppData\Local\Temp\NT.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\mstwain32.exe
"C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\NT.exe"
3⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3056

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\avkill.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\net.exe
net stop ôSecurity Centerö
3⤵
- Suspicious use of WriteProcessMemory
PID:5104

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ôSecurity Centerö
4⤵
PID:1420

C:\Windows\SysWOW64\netsh.exe
netsh firewall set opmode mode=disable
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4480

C:\Users\Admin\AppData\Local\Temp\SPAM BOT 3.6.exe
"C:\Users\Admin\AppData\Local\Temp\SPAM BOT 3.6.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3556

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\FirewallControlPanel.dll,ShowWarningDialog "C:\Users\Admin\AppData\Local\Temp\02d98b95a8871f838c5a365f24383b9a_JaffaCakes118.exe"
1⤵
- Modifies registry class
PID:3136

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

2

T1562

Disable or Modify System Firewall

1

T1562.004

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NT.exe

Filesize
108KB

MD5
e406cde5416946c9e981883490e595e8

SHA1
3ddbcea853f80d81694c8d1d972cd1d621fa2cb1

SHA256
ab3dc315ee4641d441c9bca8f4a46075b46b73816b5f94e2f5f49eed057a2c1b

SHA512
66d461001e158734c01bb18a03db309f2c0782f4bcc40b97852d28bc6076d8ca5288a77b4c15ce32936cffe2a065877a42503bc8bda55e674780c003074b48af

Download Submit
C:\Users\Admin\AppData\Local\Temp\SPAM BOT 3.6.exe

Filesize
294KB

MD5
22db07292cc0870e26231830c2eeafa4

SHA1
29a0948182c6596f5642b30dfeeb4719a0544a93

SHA256
dbcd465def8e9c922989f8806610f09b16599461dfa96797d5ae8a1145e6de52

SHA512
fb9475f59c2492351b8e2670fca505eba55bb798612a84005af68779334bca9c0a8acb8866d70ad10b36c51728ad00a98a785fe71bb69f154ffa8eafa4ba71dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\avkill.bat

Filesize
3KB

MD5
4bada7092792b20a2c1e04a5da38aa0a

SHA1
a40300cf1479be56f3ff204cf358f6c5df91951d

SHA256
5c8a9d231b38c258d586cd95b26302e24c9f725eca2b7eec7b129951a6903301

SHA512
60cafa3ad4299136d426eb4f9642a6ae4ab087e8df9d24d775276b367830dd40f9088a6f6df9975de8ea9e77fd7661969b4c674cfb2d01698468adc6c0f9e3d9

Download Submit
C:\Windows\cmsetac.dll

Filesize
33KB

MD5
7c3ff4d4d394fde7c693d04c488a55f8

SHA1
ae2b2acc7e91a910f9075e0e095b528e97827ba4

SHA256
4878bf71fd37ffac1fd6f5153357298544d0ef1f3a114c1f0451befcb85c59a8

SHA512
33c601d9e706cff0c3dce8280b040c361aa51004fd20b51946469b6a02453def5a7aad1e5f58bec3435cc6e25470155d07f71dc0f81ec642efc53215d7be316a

Download Submit
C:\Windows\ntdtcstp.dll

Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
memory/2024-10-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2024-35-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/2024-38-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3056-87-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3056-77-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3056-112-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3056-53-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3056-55-0x00000000030E0000-0x00000000030EE000-memory.dmp

Filesize
56KB

Download
memory/3056-54-0x0000000000630000-0x0000000000638000-memory.dmp

Filesize
32KB

Download
memory/3056-107-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3056-102-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3056-49-0x00000000030E0000-0x00000000030EE000-memory.dmp

Filesize
56KB

Download
memory/3056-62-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3056-97-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3056-67-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3056-92-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3056-72-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3056-82-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3556-61-0x00000000012F0000-0x00000000012FE000-memory.dmp

Filesize
56KB

Download
memory/3556-95-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/3556-75-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/3556-85-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/3556-25-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/3556-90-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/3556-70-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/3556-80-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/3556-65-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/3556-100-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/3556-60-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/3556-105-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/3556-59-0x00000000012F0000-0x00000000012FE000-memory.dmp

Filesize
56KB

Download
memory/3556-110-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/3556-52-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/3556-115-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads