Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 04:12
Behavioral task
behavioral1
Sample
249701560c62eb9b32ad0b3091987c27_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
249701560c62eb9b32ad0b3091987c27_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
249701560c62eb9b32ad0b3091987c27_JaffaCakes118.exe
-
Size
246KB
-
MD5
249701560c62eb9b32ad0b3091987c27
-
SHA1
11be1e5754db25925cd50bd0929d482787ddd79b
-
SHA256
17491898ca9dd8ba531692d30a5bbf4088c008a120c5dd077e0ea9f8dd02990e
-
SHA512
2b2253f1ed4e115b2cc1cff25ac276570ad06b16b835368a850b501aadd37ad820f878e8f85a6fbc9b267f84c1f59170fd743c73dfdf0a66207425aa6a34ba41
-
SSDEEP
6144:KmgHeXIoHU8kFXWTTJuwxGo3cgpPZb9dGh9:1gH20dhq7oR
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" gh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Trojan.exe -
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral1/memory/2736-26-0x0000000000400000-0x0000000000445000-memory.dmp modiloader_stage2 -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 2568 netsh.exe 1960 netsh.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe wscript.exe -
Executes dropped EXE 2 IoCs
pid Process 2352 gh.exe 2628 Trojan.exe -
Loads dropped DLL 6 IoCs
pid Process 2736 249701560c62eb9b32ad0b3091987c27_JaffaCakes118.exe 2736 249701560c62eb9b32ad0b3091987c27_JaffaCakes118.exe 2352 gh.exe 2352 gh.exe 2992 wscript.exe 2992 wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." wscript.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA gh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" gh.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Trojan.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
Modifies registry class 61 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43DEEBC5-3682-35B6-BAE8-46049FAD2B65}\InprocServer32\Assembly = "xuwiicjduji, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null" Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43DEEBC5-3682-35B6-BAE8-46049FAD2B65}\InprocServer32\0.0.0.0\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/Trojan.exe" Trojan.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9}\ProgId Trojan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9}\InprocServer32 Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9}\InprocServer32\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/Trojan.exe" Trojan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\xuwiicjduji.xuwiicjduji\CLSID\ = "{43DEEBC5-3682-35B6-BAE8-46049FAD2B65}" Trojan.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43DEEBC5-3682-35B6-BAE8-46049FAD2B65}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} Trojan.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xuwiicjduji.xuwiicjduji Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9}\InprocServer32\0.0.0.0\Class = "xuwiicjduji.A" Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43DEEBC5-3682-35B6-BAE8-46049FAD2B65}\InprocServer32\0.0.0.0\Class = "xuwiicjduji.xuwiicjduji" Trojan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43DEEBC5-3682-35B6-BAE8-46049FAD2B65}\ProgId Trojan.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9}\Implemented Categories Trojan.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xuwiicjduji.A\CLSID Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9}\InprocServer32\0.0.0.0\Assembly = "xuwiicjduji, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null" Trojan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43DEEBC5-3682-35B6-BAE8-46049FAD2B65}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} Trojan.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xuwiicjduji.xuwiicjduji\CLSID Trojan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9}\InprocServer32\0.0.0.0 Trojan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9}\Implemented Categories Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}\0 = ".NET Category" Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43DEEBC5-3682-35B6-BAE8-46049FAD2B65}\InprocServer32\RuntimeVersion = "v2.0.50727" Trojan.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\xuwiicjduji.A\CLSID\ = "{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9}" Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43DEEBC5-3682-35B6-BAE8-46049FAD2B65}\InprocServer32\ThreadingModel = "Both" Trojan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43DEEBC5-3682-35B6-BAE8-46049FAD2B65}\InprocServer32\0.0.0.0 Trojan.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43DEEBC5-3682-35B6-BAE8-46049FAD2B65}\ProgId Trojan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\xuwiicjduji.A\CLSID Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9}\InprocServer32\Class = "xuwiicjduji.A" Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43DEEBC5-3682-35B6-BAE8-46049FAD2B65}\InprocServer32\ = "mscoree.dll" Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43DEEBC5-3682-35B6-BAE8-46049FAD2B65}\InprocServer32\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/Trojan.exe" Trojan.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43DEEBC5-3682-35B6-BAE8-46049FAD2B65} Trojan.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9}\InprocServer32 Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\xuwiicjduji.A\ = "xuwiicjduji.A" Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9}\InprocServer32\0.0.0.0\RuntimeVersion = "v2.0.50727" Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43DEEBC5-3682-35B6-BAE8-46049FAD2B65}\InprocServer32\0.0.0.0\RuntimeVersion = "v2.0.50727" Trojan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\xuwiicjduji.A Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9}\ = "xuwiicjduji.A" Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9}\InprocServer32\RuntimeVersion = "v2.0.50727" Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9}\InprocServer32\0.0.0.0\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/Trojan.exe" Trojan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\xuwiicjduji.xuwiicjduji Trojan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\xuwiicjduji.xuwiicjduji\CLSID Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43DEEBC5-3682-35B6-BAE8-46049FAD2B65}\InprocServer32\0.0.0.0\Assembly = "xuwiicjduji, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null" Trojan.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9} Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9}\InprocServer32\ThreadingModel = "Both" Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43DEEBC5-3682-35B6-BAE8-46049FAD2B65}\InprocServer32\Class = "xuwiicjduji.xuwiicjduji" Trojan.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43DEEBC5-3682-35B6-BAE8-46049FAD2B65}\InprocServer32 Trojan.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43DEEBC5-3682-35B6-BAE8-46049FAD2B65}\Implemented Categories Trojan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9} Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\xuwiicjduji.xuwiicjduji\ = "xuwiicjduji.xuwiicjduji" Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9}\InprocServer32\Assembly = "xuwiicjduji, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null" Trojan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43DEEBC5-3682-35B6-BAE8-46049FAD2B65}\InprocServer32 Trojan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43DEEBC5-3682-35B6-BAE8-46049FAD2B65}\Implemented Categories Trojan.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xuwiicjduji.A Trojan.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43DEEBC5-3682-35B6-BAE8-46049FAD2B65}\InprocServer32\0.0.0.0 Trojan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9}\ProgId Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9}\ProgId\ = "xuwiicjduji.A" Trojan.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43DEEBC5-3682-35B6-BAE8-46049FAD2B65} Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43DEEBC5-3682-35B6-BAE8-46049FAD2B65}\ProgId\ = "xuwiicjduji.xuwiicjduji" Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9}\InprocServer32\ = "mscoree.dll" Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43DEEBC5-3682-35B6-BAE8-46049FAD2B65}\ = "xuwiicjduji.xuwiicjduji" Trojan.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB999A0F-1AB9-33D9-BAE4-ED7776949AA9}\InprocServer32\0.0.0.0 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2992 wscript.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1508 DllHost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2992 wscript.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2736 wrote to memory of 2352 2736 249701560c62eb9b32ad0b3091987c27_JaffaCakes118.exe 28 PID 2736 wrote to memory of 2352 2736 249701560c62eb9b32ad0b3091987c27_JaffaCakes118.exe 28 PID 2736 wrote to memory of 2352 2736 249701560c62eb9b32ad0b3091987c27_JaffaCakes118.exe 28 PID 2736 wrote to memory of 2352 2736 249701560c62eb9b32ad0b3091987c27_JaffaCakes118.exe 28 PID 2352 wrote to memory of 2628 2352 gh.exe 30 PID 2352 wrote to memory of 2628 2352 gh.exe 30 PID 2352 wrote to memory of 2628 2352 gh.exe 30 PID 2352 wrote to memory of 2628 2352 gh.exe 30 PID 2628 wrote to memory of 2568 2628 Trojan.exe 31 PID 2628 wrote to memory of 2568 2628 Trojan.exe 31 PID 2628 wrote to memory of 2568 2628 Trojan.exe 31 PID 2628 wrote to memory of 2568 2628 Trojan.exe 31 PID 2628 wrote to memory of 1960 2628 Trojan.exe 32 PID 2628 wrote to memory of 1960 2628 Trojan.exe 32 PID 2628 wrote to memory of 1960 2628 Trojan.exe 32 PID 2628 wrote to memory of 1960 2628 Trojan.exe 32 PID 2628 wrote to memory of 2992 2628 Trojan.exe 35 PID 2628 wrote to memory of 2992 2628 Trojan.exe 35 PID 2628 wrote to memory of 2992 2628 Trojan.exe 35 PID 2628 wrote to memory of 2992 2628 Trojan.exe 35 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Trojan.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" gh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\249701560c62eb9b32ad0b3091987c27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\249701560c62eb9b32ad0b3091987c27_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\gh.exe"C:\Users\Admin\AppData\Local\Temp\gh.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"3⤵
- UAC bypass
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2628 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2568
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\SysWOW64\wscript.exe" "wscript.exe" ENABLE4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1960
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\Trojan.vbe"4⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2992
-
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
PID:1508
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54B
MD549d1ecdc211d43d17d90d7cffaf159c2
SHA1997a1bd83f41e7a8bebc037c9a59e520581eb70f
SHA256257d335e97e18bc1103e1707a6eda7dfd7e20be8f2d4b3a2f616730ff5c39d17
SHA51297481dc8338994e47978faad6bad68fc503bfe9a26756908636c238338cbac5dbcf62fc0e0e56c39415b6f6b48873d01a36f1f52a4e11ec722e1fb3650a36bd8
-
Filesize
7KB
MD5b07dbe51ded53ca9e8a8536d1a954ff1
SHA11fd2a400e442ce65581e72ea6191e4058430f7b3
SHA25648e172263d81fc3d899fa9cd21f8f1fc138d5ff0c9bd27a3d2a7b69c646b375a
SHA51212142d4d165ef7dbec609dec19b7241e6bfb54beb97764e1f9f1ee74c79c7ce557f8d061216f222cffe18bd0ac70b278d8bc297072b1a16c3ddbd3160d270144
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe
Filesize226KB
MD591102132470e20539589b076fe52fdc6
SHA1c9158b9847f1bbdcf7dde23467e5e4e8a708597d
SHA256353c51227ddbdf1e766886a448f83f786a8c946e6892192bb5ac44f97569210d
SHA5129a67c4a14fde5ea561f2a76a148c55339deeb28e53ed106c41a0d304ca45ca6c6066509981aca86c2f0a4fea88e6c5e9039fcb48556f933dcead77a39e79677c
-
Filesize
226KB
MD5ee6e49d34ec1d5a3d71c41419529141e
SHA1d21d3885974daf7ca4ff4a18c88edd2e755947f1
SHA256e7ae8b6a6cee6368cc9c6f5a28fafd919672dd6dd2525e8e74f52c5a222a8b8f
SHA5125a8d30e01651094435d33c5273e9c79adb899d784cb5a9c5cf70e4e8efa684e3fdd69dbd10bb159392e867fab0dbe0675e679ad00ff5041c25b412536fcda3c3