modiloader | 28d369088831902f5d89c33f382a8d00d51191a69a42db378ab587696601484b

Analysis

max time kernel
137s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
Size 72KB
Sample240620-ldvk6szekf
SHA256 28d369088831902f5d89c33f382a8d00d51191a69a42db378ab587696601484b
MD5 04b48578b432520f9f5b22b869b0bac6
SHA1 0f577f44d5c6e6d648a8b06b20141b67f3e2dfb7
SHA512 45c49b0457dc1f455d2c03c1f6c146ef7ad8b3c24206341be9ef707d0cbbcb68ba5d954ce83f2f5524dd7858a108fdaf3ca1cb6de663c00ce3834b6c4f8f14f0
SSDEEP 1536:IEQJB6JXG3L+v4HP0LsbvTkx5YJGFAaqk068vVGWqm:IEQuNq/Ej9t06WV6m
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader evasion trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies security service 2 TTPs 20 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe

ModiLoader Second Stage 22 IoCs

resource	yara_rule
behavioral2/memory/3808-0-0x0000000010000000-0x0000000010041000-memory.dmp	modiloader_stage2
behavioral2/memory/3808-5-0x0000000010000000-0x0000000010041000-memory.dmp	modiloader_stage2
behavioral2/memory/2788-89-0x0000000010000000-0x0000000010041000-memory.dmp	modiloader_stage2
behavioral2/memory/2788-40-0x0000000010000000-0x0000000010041000-memory.dmp	modiloader_stage2
behavioral2/memory/1772-210-0x0000000010000000-0x0000000010041000-memory.dmp	modiloader_stage2
behavioral2/memory/1772-215-0x0000000010000000-0x0000000010041000-memory.dmp	modiloader_stage2
behavioral2/memory/2436-326-0x0000000010000000-0x0000000010041000-memory.dmp	modiloader_stage2
behavioral2/memory/2436-331-0x0000000010000000-0x0000000010041000-memory.dmp	modiloader_stage2
behavioral2/memory/3100-442-0x0000000010000000-0x0000000010041000-memory.dmp	modiloader_stage2
behavioral2/memory/3100-448-0x0000000010000000-0x0000000010041000-memory.dmp	modiloader_stage2
behavioral2/memory/2252-558-0x0000000010000000-0x0000000010041000-memory.dmp	modiloader_stage2
behavioral2/memory/2252-563-0x0000000010000000-0x0000000010041000-memory.dmp	modiloader_stage2
behavioral2/memory/3568-674-0x0000000010000000-0x0000000010041000-memory.dmp	modiloader_stage2
behavioral2/memory/3568-679-0x0000000010000000-0x0000000010041000-memory.dmp	modiloader_stage2
behavioral2/memory/432-790-0x0000000010000000-0x0000000010041000-memory.dmp	modiloader_stage2
behavioral2/memory/432-796-0x0000000010000000-0x0000000010041000-memory.dmp	modiloader_stage2
behavioral2/memory/1996-906-0x0000000010000000-0x0000000010041000-memory.dmp	modiloader_stage2
behavioral2/memory/1996-912-0x0000000010000000-0x0000000010041000-memory.dmp	modiloader_stage2
behavioral2/memory/1420-1022-0x0000000010000000-0x0000000010041000-memory.dmp	modiloader_stage2
behavioral2/memory/1420-1027-0x0000000010000000-0x0000000010041000-memory.dmp	modiloader_stage2
behavioral2/memory/4972-1138-0x0000000010000000-0x0000000010041000-memory.dmp	modiloader_stage2
behavioral2/memory/4972-1143-0x0000000010000000-0x0000000010041000-memory.dmp	modiloader_stage2

Executes dropped EXE 20 IoCs

pid	Process
2788	sysproc.exe
1848	sysproc.exe
1772	sysproc.exe
2244	sysproc.exe
2436	sysproc.exe
552	sysproc.exe
3100	sysproc.exe
4596	sysproc.exe
2252	sysproc.exe
5052	sysproc.exe
3568	sysproc.exe
2716	sysproc.exe
432	sysproc.exe
3116	sysproc.exe
1996	sysproc.exe
1668	sysproc.exe
1420	sysproc.exe
1852	sysproc.exe
4972	sysproc.exe
3204	sysproc.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\sysproc.exe	sysproc.exe
File created	C:\Windows\SysWOW64\sysproc.exe	sysproc.exe
File opened for modification	C:\Windows\SysWOW64\sysproc.exe	sysproc.exe
File created	C:\Windows\SysWOW64\sysproc.exe	sysproc.exe
File created	C:\Windows\SysWOW64\sysproc.exe	sysproc.exe
File opened for modification	C:\Windows\SysWOW64\sysproc.exe	sysproc.exe
File opened for modification	C:\Windows\SysWOW64\sysproc.exe	sysproc.exe
File created	C:\Windows\SysWOW64\sysproc.exe	sysproc.exe
File opened for modification	C:\Windows\SysWOW64\sysproc.exe	sysproc.exe
File created	C:\Windows\SysWOW64\sysproc.exe	sysproc.exe
File created	C:\Windows\SysWOW64\sysproc.exe	sysproc.exe
File opened for modification	C:\Windows\SysWOW64\sysproc.exe	sysproc.exe
File opened for modification	C:\Windows\SysWOW64\sysproc.exe	sysproc.exe
File opened for modification	C:\Windows\SysWOW64\sysproc.exe	sysproc.exe
File created	C:\Windows\SysWOW64\sysproc.exe	sysproc.exe
File opened for modification	C:\Windows\SysWOW64\sysproc.exe	sysproc.exe
File created	C:\Windows\SysWOW64\sysproc.exe	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sysproc.exe	sysproc.exe
File opened for modification	C:\Windows\SysWOW64\sysproc.exe	sysproc.exe
File opened for modification	C:\Windows\SysWOW64\sysproc.exe	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sysproc.exe	sysproc.exe
File created	C:\Windows\SysWOW64\sysproc.exe	sysproc.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 3808 set thread context of 4400	3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe	82
PID 2788 set thread context of 1848	2788	sysproc.exe	85
PID 1772 set thread context of 2244	1772	sysproc.exe	92
PID 2436 set thread context of 552	2436	sysproc.exe	98
PID 3100 set thread context of 4596	3100	sysproc.exe	105
PID 2252 set thread context of 5052	2252	sysproc.exe	111
PID 3568 set thread context of 2716	3568	sysproc.exe	115
PID 432 set thread context of 3116	432	sysproc.exe	119
PID 1996 set thread context of 1668	1996	sysproc.exe	123
PID 1420 set thread context of 1852	1420	sysproc.exe	127
PID 4972 set thread context of 3204	4972	sysproc.exe	131

Runs .reg file with regedit 10 IoCs

pid	Process
1196	regedit.exe
764	regedit.exe
5064	regedit.exe
4052	regedit.exe
1376	regedit.exe
4100	regedit.exe
2136	regedit.exe
2920	regedit.exe
3272	regedit.exe
2704	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
2788	sysproc.exe
2788	sysproc.exe
2788	sysproc.exe
2788	sysproc.exe
2788	sysproc.exe
2788	sysproc.exe
2788	sysproc.exe
2788	sysproc.exe
2788	sysproc.exe
2788	sysproc.exe
2788	sysproc.exe
2788	sysproc.exe
2788	sysproc.exe
2788	sysproc.exe
2788	sysproc.exe
2788	sysproc.exe
2788	sysproc.exe
2788	sysproc.exe
2788	sysproc.exe
2788	sysproc.exe
1772	sysproc.exe
1772	sysproc.exe
1772	sysproc.exe
1772	sysproc.exe
1772	sysproc.exe
1772	sysproc.exe
1772	sysproc.exe
1772	sysproc.exe
1772	sysproc.exe
1772	sysproc.exe
1772	sysproc.exe
1772	sysproc.exe
1772	sysproc.exe
1772	sysproc.exe
1772	sysproc.exe
1772	sysproc.exe
1772	sysproc.exe
1772	sysproc.exe
1772	sysproc.exe
1772	sysproc.exe
2436	sysproc.exe
2436	sysproc.exe
2436	sysproc.exe
2436	sysproc.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeDebugPrivilege	3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
Token: SeDebugPrivilege	3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
Token: SeDebugPrivilege	3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
Token: SeDebugPrivilege	3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
Token: SeDebugPrivilege	3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
Token: SeDebugPrivilege	2788	sysproc.exe
Token: SeDebugPrivilege	2788	sysproc.exe
Token: SeDebugPrivilege	2788	sysproc.exe
Token: SeDebugPrivilege	2788	sysproc.exe
Token: SeDebugPrivilege	2788	sysproc.exe
Token: SeDebugPrivilege	1772	sysproc.exe
Token: SeDebugPrivilege	1772	sysproc.exe
Token: SeDebugPrivilege	1772	sysproc.exe
Token: SeDebugPrivilege	1772	sysproc.exe
Token: SeDebugPrivilege	1772	sysproc.exe
Token: SeDebugPrivilege	2436	sysproc.exe
Token: SeDebugPrivilege	2436	sysproc.exe
Token: SeDebugPrivilege	2436	sysproc.exe
Token: SeDebugPrivilege	2436	sysproc.exe
Token: SeDebugPrivilege	2436	sysproc.exe
Token: SeDebugPrivilege	3100	sysproc.exe
Token: SeDebugPrivilege	3100	sysproc.exe
Token: SeDebugPrivilege	3100	sysproc.exe
Token: SeDebugPrivilege	3100	sysproc.exe
Token: SeDebugPrivilege	3100	sysproc.exe
Token: SeDebugPrivilege	2252	sysproc.exe
Token: SeDebugPrivilege	2252	sysproc.exe
Token: SeDebugPrivilege	2252	sysproc.exe
Token: SeDebugPrivilege	2252	sysproc.exe
Token: SeDebugPrivilege	2252	sysproc.exe
Token: SeDebugPrivilege	3568	sysproc.exe
Token: SeDebugPrivilege	3568	sysproc.exe
Token: SeDebugPrivilege	3568	sysproc.exe
Token: SeDebugPrivilege	3568	sysproc.exe
Token: SeDebugPrivilege	3568	sysproc.exe
Token: SeDebugPrivilege	432	sysproc.exe
Token: SeDebugPrivilege	432	sysproc.exe
Token: SeDebugPrivilege	432	sysproc.exe
Token: SeDebugPrivilege	432	sysproc.exe
Token: SeDebugPrivilege	432	sysproc.exe
Token: SeDebugPrivilege	1996	sysproc.exe
Token: SeDebugPrivilege	1996	sysproc.exe
Token: SeDebugPrivilege	1996	sysproc.exe
Token: SeDebugPrivilege	1996	sysproc.exe
Token: SeDebugPrivilege	1996	sysproc.exe
Token: SeDebugPrivilege	1420	sysproc.exe
Token: SeDebugPrivilege	1420	sysproc.exe
Token: SeDebugPrivilege	1420	sysproc.exe
Token: SeDebugPrivilege	1420	sysproc.exe
Token: SeDebugPrivilege	1420	sysproc.exe
Token: SeDebugPrivilege	4972	sysproc.exe
Token: SeDebugPrivilege	4972	sysproc.exe
Token: SeDebugPrivilege	4972	sysproc.exe
Token: SeDebugPrivilege	4972	sysproc.exe
Token: SeDebugPrivilege	4972	sysproc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 4400	3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe	82
PID 3808 wrote to memory of 4400	3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe	82
PID 3808 wrote to memory of 4400	3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe	82
PID 3808 wrote to memory of 4400	3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe	82
PID 3808 wrote to memory of 4400	3808	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe	82
PID 4400 wrote to memory of 8	4400	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe	83
PID 4400 wrote to memory of 8	4400	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe	83
PID 4400 wrote to memory of 8	4400	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe	83
PID 4400 wrote to memory of 2788	4400	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe	84
PID 4400 wrote to memory of 2788	4400	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe	84
PID 4400 wrote to memory of 2788	4400	04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe	84
PID 2788 wrote to memory of 1848	2788	sysproc.exe	85
PID 2788 wrote to memory of 1848	2788	sysproc.exe	85
PID 2788 wrote to memory of 1848	2788	sysproc.exe	85
PID 2788 wrote to memory of 1848	2788	sysproc.exe	85
PID 2788 wrote to memory of 1848	2788	sysproc.exe	85
PID 1848 wrote to memory of 5040	1848	sysproc.exe	86
PID 1848 wrote to memory of 5040	1848	sysproc.exe	86
PID 1848 wrote to memory of 5040	1848	sysproc.exe	86
PID 5040 wrote to memory of 4052	5040	cmd.exe	88
PID 5040 wrote to memory of 4052	5040	cmd.exe	88
PID 5040 wrote to memory of 4052	5040	cmd.exe	88
PID 1848 wrote to memory of 1772	1848	sysproc.exe	91
PID 1848 wrote to memory of 1772	1848	sysproc.exe	91
PID 1848 wrote to memory of 1772	1848	sysproc.exe	91
PID 1772 wrote to memory of 2244	1772	sysproc.exe	92
PID 1772 wrote to memory of 2244	1772	sysproc.exe	92
PID 1772 wrote to memory of 2244	1772	sysproc.exe	92
PID 1772 wrote to memory of 2244	1772	sysproc.exe	92
PID 1772 wrote to memory of 2244	1772	sysproc.exe	92
PID 2244 wrote to memory of 2980	2244	sysproc.exe	93
PID 2244 wrote to memory of 2980	2244	sysproc.exe	93
PID 2244 wrote to memory of 2980	2244	sysproc.exe	93
PID 2980 wrote to memory of 1376	2980	cmd.exe	94
PID 2980 wrote to memory of 1376	2980	cmd.exe	94
PID 2980 wrote to memory of 1376	2980	cmd.exe	94
PID 2244 wrote to memory of 2436	2244	sysproc.exe	97
PID 2244 wrote to memory of 2436	2244	sysproc.exe	97
PID 2244 wrote to memory of 2436	2244	sysproc.exe	97
PID 2436 wrote to memory of 552	2436	sysproc.exe	98
PID 2436 wrote to memory of 552	2436	sysproc.exe	98
PID 2436 wrote to memory of 552	2436	sysproc.exe	98
PID 2436 wrote to memory of 552	2436	sysproc.exe	98
PID 2436 wrote to memory of 552	2436	sysproc.exe	98
PID 552 wrote to memory of 3216	552	sysproc.exe	99
PID 552 wrote to memory of 3216	552	sysproc.exe	99
PID 552 wrote to memory of 3216	552	sysproc.exe	99
PID 3216 wrote to memory of 2920	3216	cmd.exe	100
PID 3216 wrote to memory of 2920	3216	cmd.exe	100
PID 3216 wrote to memory of 2920	3216	cmd.exe	100
PID 552 wrote to memory of 3100	552	sysproc.exe	104
PID 552 wrote to memory of 3100	552	sysproc.exe	104
PID 552 wrote to memory of 3100	552	sysproc.exe	104
PID 3100 wrote to memory of 4596	3100	sysproc.exe	105
PID 3100 wrote to memory of 4596	3100	sysproc.exe	105
PID 3100 wrote to memory of 4596	3100	sysproc.exe	105
PID 3100 wrote to memory of 4596	3100	sysproc.exe	105
PID 3100 wrote to memory of 4596	3100	sysproc.exe	105
PID 4596 wrote to memory of 5100	4596	sysproc.exe	106
PID 4596 wrote to memory of 5100	4596	sysproc.exe	106
PID 4596 wrote to memory of 5100	4596	sysproc.exe	106
PID 5100 wrote to memory of 3272	5100	cmd.exe	107
PID 5100 wrote to memory of 3272	5100	cmd.exe	107
PID 5100 wrote to memory of 3272	5100	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Users\Admin\AppData\Local\Temp\04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\a.bat
    3⤵
    PID:8
- - C:\Windows\SysWOW64\sysproc.exe
    C:\Windows\system32\sysproc.exe 992 "C:\Users\Admin\AppData\Local\Temp\04b48578b432520f9f5b22b869b0bac6_JaffaCakes118.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Windows\SysWOW64\sysproc.exe
      C:\Windows\SysWOW64\sysproc.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1848
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5040
      - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        6⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:4052
    - - C:\Windows\SysWOW64\sysproc.exe
        
        C:\Windows\system32\sysproc.exe 1140 "C:\Windows\SysWOW64\sysproc.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1772
      - C:\Windows\SysWOW64\sysproc.exe
        
        C:\Windows\SysWOW64\sysproc.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        8⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1376
        
        C:\Windows\SysWOW64\sysproc.exe
        
        C:\Windows\system32\sysproc.exe 1112 "C:\Windows\SysWOW64\sysproc.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2436
        
        C:\Windows\SysWOW64\sysproc.exe
        
        C:\Windows\SysWOW64\sysproc.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3216
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        10⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2920
        
        C:\Windows\SysWOW64\sysproc.exe
        
        C:\Windows\system32\sysproc.exe 1112 "C:\Windows\SysWOW64\sysproc.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3100
        
        C:\Windows\SysWOW64\sysproc.exe
        
        C:\Windows\SysWOW64\sysproc.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        12⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:3272
        
        C:\Windows\SysWOW64\sysproc.exe
        
        C:\Windows\system32\sysproc.exe 1112 "C:\Windows\SysWOW64\sysproc.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:2252
        
        C:\Windows\SysWOW64\sysproc.exe
        
        C:\Windows\SysWOW64\sysproc.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        13⤵
        
        PID:744
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        14⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:4100
        
        C:\Windows\SysWOW64\sysproc.exe
        
        C:\Windows\system32\sysproc.exe 1112 "C:\Windows\SysWOW64\sysproc.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:3568
        
        C:\Windows\SysWOW64\sysproc.exe
        
        C:\Windows\SysWOW64\sysproc.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        15⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        16⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1196
        
        C:\Windows\SysWOW64\sysproc.exe
        
        C:\Windows\system32\sysproc.exe 1112 "C:\Windows\SysWOW64\sysproc.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:432
        
        C:\Windows\SysWOW64\sysproc.exe
        
        C:\Windows\SysWOW64\sysproc.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        17⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        18⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2704
        
        C:\Windows\SysWOW64\sysproc.exe
        
        C:\Windows\system32\sysproc.exe 1112 "C:\Windows\SysWOW64\sysproc.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:1996
        
        C:\Windows\SysWOW64\sysproc.exe
        
        C:\Windows\SysWOW64\sysproc.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        19⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        20⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:764
        
        C:\Windows\SysWOW64\sysproc.exe
        
        C:\Windows\system32\sysproc.exe 1116 "C:\Windows\SysWOW64\sysproc.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:1420
        
        C:\Windows\SysWOW64\sysproc.exe
        
        C:\Windows\SysWOW64\sysproc.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        21⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        22⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2136
        
        C:\Windows\SysWOW64\sysproc.exe
        
        C:\Windows\system32\sysproc.exe 1116 "C:\Windows\SysWOW64\sysproc.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:4972
        
        C:\Windows\SysWOW64\sysproc.exe
        
        C:\Windows\SysWOW64\sysproc.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        23⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        24⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 2KB
SHA256 c19e534b06ed8a39cbd26acaa77742b9ed2928bfe5caab04448088bc02e992d8
MD5 f997313cc3f22f90a45956e06703c83b
SHA1 c0ccb967876ef0491bf84bf1bcd79ab383d43afd
SHA512 0700c37c4a71d71431d47ebb18563707ea0db7485586993168340fa4d6adb1bcac2ab066b9cdb70d717424f27c0776d19a078ac1f3fa254b74cbec252ce1e424
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 3KB
SHA256 37e81e9667ba7f7b70caca2890f237e25b68141805edf42d9ffc8ae615ab5ed3
MD5 464dcd4b010ddf8f7be907e6f7a1d717
SHA1 66f2edefebb4d0364949c19c4794e8b2ce505ef5
SHA512 f9044b440f2f29a9efa66a4269e4894c48e9d42348563c1e273649c31f56a28254bcabd707bc3bfa24f2703add1cebc544f84c3ca88e21c65f58cf9d0899d6b4
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 3KB
SHA256 4c9aee98b0aeb763807e0f54856dc2ac0ba30e096a741c9a0c2db520c16040c3
MD5 4c52017724a5ef752bbf72ac7829725d
SHA1 248f1da027cfc7ce5c445f1028be8379e7082317
SHA512 2bc2b7ca4e8fd4d3d0e0174df1eb92fc13c3f0e933d15d2c00fc962da6f174d5cc1fddfb65e4c2724064df62160844e3c745b691e2f6a35ab8d936c03ae01a89
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 1KB
SHA256 e07a61f5cf667907d8ad83bcba6d0e27737ed13ca6f2c9f5d72e05c2fe41304b
MD5 2559a5ff2647678656bc89ae72187bbd
SHA1 3e51d74bf6e0404c36aeb6da9d04e412446a90f2
SHA512 825791067aaafc41f40290733adb6d2b2a38065ac9e282737db5e006f75a7d93a8190015bf180a4535ac35780b43e4935194d034c13b0f0bb68008880307c994
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 384B
SHA256 32eae568e5a03070b122719c66798a0574658b85dc61bcf3c48eae29f4d77851
MD5 c93c561465db53bf9a99759de9d25f07
SHA1 5386934828e2c2589bfe394ac1f03ffbfba93bfa
SHA512 bb0163e1a26f6b7cfd4ce214ae33a56e446fa74efca7682352ab52aa4b4d5b5b92a141e3e2a12b76f33827b1cd423f3d862cc973079d5da291832ce6a9fb9b18
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 1KB
SHA256 13dc8dc70b7bb240f6f4cf6be5ff0ec55c606267a328bb9c9e34e5fa70cce0d9
MD5 bf7ee07851e04b2a0dbe554db62dc3aa
SHA1 cad155b66053cd7ce2b969a0eb20a8f4812b1f46
SHA512 9ed79305c81287cf01d0138d87c6ec981b5bdd9195c56f8def4c74fdbc9b4816661d084fc1314f99b40102945b61d05121f4eaadec6403d4295a80847b797bc4
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 2KB
SHA256 550abc09abce5b065d360dfea741ab7dd8abbe2ea11cd46b093632860775baec
MD5 e6d8af5aed642209c88269bf56af50ae
SHA1 633d40da997074dc0ed10938ebc49a3aeb3a7fc8
SHA512 6949fc255c1abf009ecbe0591fb6dbfd96409ee98ae438dbac8945684ccf694c046d5b51d2bf7679c1e02f42e8f32e8e29a9b7bdbc84442bec0497b64dfa84cf
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 2KB
SHA256 901619f668fe541b53d809cd550460f579985c3d2f3d899a557997e778eb1d82
MD5 d8be0d42e512d922804552250f01eb90
SHA1 cda2fd8fc9c4cdf15d5e2f07a4c633e21d11c9d3
SHA512 f53619e1ec3c9abc833f9fca1174529fb4a4723b64f7560059cd3147d74ea8fe945a7bd0034f6fb68c0e61b6782a26908d30a749a256e019031b5a6ac088eb97
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 815B
SHA256 d6e4760c4554b061363e89648dc4144f8a9ba8a300dde1a1621f22ecc62ab759
MD5 fadf3805f68986d2ee9c82f560a564e4
SHA1 87bcab6ab1fb66ace98eb1d36e54eb9c11628aa6
SHA512 e3e495385da6d181a2411554a61b27c480ff31fa49225e8b2dc46b9ec4f618343475a8d189786b956c91efc65bfb05be19065bfdf3288eb011c5ec427e764cb9
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 2KB
SHA256 088881ff28ef1240847decd884be366614865bf9660f862dbffa64d504467aea
MD5 61ec72543aaac5c7b336d2b22f919c07
SHA1 5bddb1f73b24c2113e9bf8268640f75fb0f3bd8d
SHA512 e8ed6c1813218a542e0449f6bcda47b9464f2445a5d4b20e20b657d5328eb9fd5ddf859e61794a0b3d32057590ac029064c078d5743fe1a316ca8fdf254f7f62
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 3KB
SHA256 03223eaae4ac389215cb8a9cb4e4d5a70b67f791f90e57b8efd3f975f5cf6af2
MD5 831afd728dd974045c0654510071d405
SHA1 9484f4ee8e9eef0956553a59cfbcbe99a8822026
SHA512 ab7ac4d6d45b8aac5f82432468d40bd2b5bfae6d93006732ce27a6513fd3e7ddc94c029051092bf8b6f5649688c0f6600dbd88968732fc7b779e916e6bcda5c9
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 2KB
SHA256 dc98a84d679d0ba1e36e3142000fa9fd7c5cd4606e07cbcb33f12c98bc1510fa
MD5 8c6aa92ac8ffdfb7a0fb3dafd14d65f1
SHA1 cac3992d696a99a5dec2ab1c824c816117414b16
SHA512 f17a7cbfc11ce2a258aee2857720dcc72ddcfd17ebe9c9b1b04bedb52835c2b35ca4bb649fd5ef3d7ef3f9585f87ef321efec52cb7524be3b83a919999c4900c
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 3KB
SHA256 7af82efceff1e9221d76472e6ffd6aa78ca00ccbb5fa32cb2238ed08812b931f
MD5 ad9e5e67282bb74482c05e3bf2eb188b
SHA1 10b02442ea4b1151a2334645c3e290a82ecfad1f
SHA512 b0ca37f35618547b4e5ab94eb367940a9d5a500b5c91cf2bbdddba8d1725bcc619c5acd2365711a970c307bbe0aa539b50803d119963b9f0c6da198e3157ded7
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 3KB
SHA256 f3aec599ccf14f9ee446772c26b24628ba08698be4dc66b5b54acd37d26b8e39
MD5 ffbb389d817acf25cc38799c239d512c
SHA1 8b4854ed9e257c3da9ec11d0f145805c6ae6193f
SHA512 382e043195d74ed0e0978dcac0db8bc962bc41f2cbd1a8a80c1a5a54cb8831b5e63a74bb3f69ccd9e241a47c1a79fcc7e7dad71696bf957a349a0f7e62247931
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 1KB
SHA256 248c7793d113ca762bbe56b974f4c5902339dacb0b47ddd7c412340a623dfe38
MD5 989c5352030fafd44b92adf4d4164738
SHA1 e02985c15eb20682115e3fc343f829e28770ed6c
SHA512 9ebcfc38952d968d608d68b2e8fbb56f5d02ed03e0e2d02661caeb50f804404d95fc45f22a8376ca88b69548c89c22b6c6a9acbb7fdcb5f6f906bd871b3465f1
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 3KB
SHA256 f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e
MD5 9e5db93bd3302c217b15561d8f1e299d
SHA1 95a5579b336d16213909beda75589fd0a2091f30
SHA512 b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 2KB
SHA256 abf4c5f7dbed40d58dc982256535a56128f86d5eaf163d634037ae2b61027a10
MD5 f708dcfd087b5b3763678cfb8d63735e
SHA1 a38fa7fa516c1402762425176ff1b607db36c752
SHA512 fa0e84032b88e19fc67c5be846983cf89c8ba021351a0aa9cab0162ea27a3933dade0b78146b2230b0c57f218b18da52a5ce1d04b6f9746b21e4285e2540049c
MD5 SHA1 SHA512

Submit Download

sysproc.exe

Path C:\Windows\SysWOW64\sysproc.exe
Size 72KB
SHA256 28d369088831902f5d89c33f382a8d00d51191a69a42db378ab587696601484b
MD5 04b48578b432520f9f5b22b869b0bac6
SHA1 0f577f44d5c6e6d648a8b06b20141b67f3e2dfb7
SHA512 45c49b0457dc1f455d2c03c1f6c146ef7ad8b3c24206341be9ef707d0cbbcb68ba5d954ce83f2f5524dd7858a108fdaf3ca1cb6de663c00ce3834b6c4f8f14f0
SSDEEP 1536:IEQJB6JXG3L+v4HP0LsbvTkx5YJGFAaqk068vVGWqm:IEQuNq/Ej9t06WV6m
MD5 SHA1 SHA512 SSDEEP

Submit Download

a.bat

Path \??\c:\a.bat
Size 5KB
SHA256 ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876
MD5 0019a0451cc6b9659762c3e274bc04fb
SHA1 5259e256cc0908f2846e532161b989f1295f479b
SHA512 314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904
SSDEEP 96:riZ6ie0DiQDiVDiVsHQi7NifhbR/i2OjOpiAqWr2vKV+A2gp6rmP2L9MCIMdwvbA:HGGSaaxb32O1iczC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/432-796-0x0000000010000000-0x0000000010041000-memory.dmp

Download

memory/432-790-0x0000000010000000-0x0000000010041000-memory.dmp

Download

memory/1420-1022-0x0000000010000000-0x0000000010041000-memory.dmp

Download

memory/1420-1027-0x0000000010000000-0x0000000010041000-memory.dmp

Download

memory/1772-215-0x0000000010000000-0x0000000010041000-memory.dmp

Download

memory/1772-210-0x0000000010000000-0x0000000010041000-memory.dmp

Download

memory/1848-140-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/1996-906-0x0000000010000000-0x0000000010041000-memory.dmp

Download

memory/1996-912-0x0000000010000000-0x0000000010041000-memory.dmp

Download

memory/2252-563-0x0000000010000000-0x0000000010041000-memory.dmp

Download

memory/2252-558-0x0000000010000000-0x0000000010041000-memory.dmp

Download

memory/2436-326-0x0000000010000000-0x0000000010041000-memory.dmp

Download

memory/2436-331-0x0000000010000000-0x0000000010041000-memory.dmp

Download

memory/2788-40-0x0000000010000000-0x0000000010041000-memory.dmp

Download

memory/2788-89-0x0000000010000000-0x0000000010041000-memory.dmp

Download

memory/3100-448-0x0000000010000000-0x0000000010041000-memory.dmp

Download

memory/3100-442-0x0000000010000000-0x0000000010041000-memory.dmp

Download

memory/3568-679-0x0000000010000000-0x0000000010041000-memory.dmp

Download

memory/3568-674-0x0000000010000000-0x0000000010041000-memory.dmp

Download

memory/3808-5-0x0000000010000000-0x0000000010041000-memory.dmp

Download

memory/3808-0-0x0000000010000000-0x0000000010041000-memory.dmp

Download

memory/4400-8-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/4400-173-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/4400-1-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/4400-7-0x0000000010000000-0x0000000010041000-memory.dmp

Download

memory/4400-3-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/4972-1138-0x0000000010000000-0x0000000010041000-memory.dmp

Download

memory/4972-1143-0x0000000010000000-0x0000000010041000-memory.dmp

Download