modiloader | 524327f487803c531734eb5d043f8a20ef0ca1837cafc228fd4de0a057739b8e

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3911b929fbaca50a56c5045f7f856422_JaffaCakes118.exe
Size

187KB
MD5

3911b929fbaca50a56c5045f7f856422
SHA1

7ec73b461d3cf6927fc6b08bf8868fece812565b
SHA256

524327f487803c531734eb5d043f8a20ef0ca1837cafc228fd4de0a057739b8e
SHA512

2d976299235e368ef8cc47cad4c497dbc96d7251a5b32643776f9ead5304d33b0cc82b720eae1a4db922d2c8fee41373f32548c1b091be5393542bb7d132d56d
SSDEEP

3072:sCgTB4W/dERuowa1z+i8OvoZaawiDhuTpnXGpGhST+xURuYZQz8jOy:sB4CEc/d7VuT2QST+2QA

Score

10^/10

modiloader evasion persistence privilege_escalation trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Crypted.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan.exe

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/1760-8-0x0000000000400000-0x0000000000436000-memory.dmp	modiloader_stage2

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2840	netsh.exe
2820	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe	Trojan.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe	Trojan.exe

Executes dropped EXE 2 IoCs

pid	Process
1952	Crypted.exe
1144	Trojan.exe

Loads dropped DLL 4 IoCs

pid	Process
1760	3911b929fbaca50a56c5045f7f856422_JaffaCakes118.exe
1760	3911b929fbaca50a56c5045f7f856422_JaffaCakes118.exe
1952	Crypted.exe
1952	Crypted.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .."	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .."	Trojan.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Crypted.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Crypted.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Trojan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Modifies registry class 61 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xyshjsxtkmc.dkhfpjjxnb	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\Implemented Categories	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32\ThreadingModel = "Both"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/Trojan.exe"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32\0.0.0.0	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32\0.0.0.0	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32\RuntimeVersion = "v2.0.50727"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\Implemented Categories	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32\ = "mscoree.dll"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32\0.0.0.0\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/Trojan.exe"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\ProgId\ = "xyshjsxtkmc.dkhfpjjxnb"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\ = "xyshjsxtkmc.ulntsremnk"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32\Class = "xyshjsxtkmc.dkhfpjjxnb"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32\0.0.0.0\RuntimeVersion = "v2.0.50727"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xyshjsxtkmc.ulntsremnk\CLSID	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32\RuntimeVersion = "v2.0.50727"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xyshjsxtkmc.dkhfpjjxnb\CLSID	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\Implemented Categories	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xyshjsxtkmc.dkhfpjjxnb\CLSID\ = "{697688CD-6632-31D8-9503-ED35D75B7B00}"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32\0.0.0.0	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}\0 = ".NET Category"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32\ThreadingModel = "Both"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xyshjsxtkmc.ulntsremnk	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\ProgId	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\ProgId	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xyshjsxtkmc.dkhfpjjxnb	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\ProgId	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xyshjsxtkmc.ulntsremnk	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32\0.0.0.0\Class = "xyshjsxtkmc.dkhfpjjxnb"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32\ = "mscoree.dll"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32\0.0.0.0\RuntimeVersion = "v2.0.50727"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32\0.0.0.0\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/Trojan.exe"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/Trojan.exe"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\Implemented Categories	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32\0.0.0.0\Assembly = "xyshjsxtkmc, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\ = "xyshjsxtkmc.dkhfpjjxnb"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32\Assembly = "xyshjsxtkmc, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xyshjsxtkmc.ulntsremnk\ = "xyshjsxtkmc.ulntsremnk"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xyshjsxtkmc.ulntsremnk\CLSID\ = "{42B5FF65-6B94-327B-84B2-65254234572C}"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32\0.0.0.0\Class = "xyshjsxtkmc.ulntsremnk"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xyshjsxtkmc.dkhfpjjxnb\ = "xyshjsxtkmc.dkhfpjjxnb"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32\Class = "xyshjsxtkmc.ulntsremnk"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32\0.0.0.0\Assembly = "xyshjsxtkmc, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32\Assembly = "xyshjsxtkmc, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xyshjsxtkmc.dkhfpjjxnb\CLSID	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\ProgId\ = "xyshjsxtkmc.ulntsremnk"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\ProgId	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32\0.0.0.0	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xyshjsxtkmc.ulntsremnk\CLSID	Trojan.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1144	Trojan.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1144	Trojan.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1952	1760	3911b929fbaca50a56c5045f7f856422_JaffaCakes118.exe	30
PID 1760 wrote to memory of 1952	1760	3911b929fbaca50a56c5045f7f856422_JaffaCakes118.exe	30
PID 1760 wrote to memory of 1952	1760	3911b929fbaca50a56c5045f7f856422_JaffaCakes118.exe	30
PID 1760 wrote to memory of 1952	1760	3911b929fbaca50a56c5045f7f856422_JaffaCakes118.exe	30
PID 1952 wrote to memory of 1144	1952	Crypted.exe	31
PID 1952 wrote to memory of 1144	1952	Crypted.exe	31
PID 1952 wrote to memory of 1144	1952	Crypted.exe	31
PID 1952 wrote to memory of 1144	1952	Crypted.exe	31
PID 1144 wrote to memory of 2840	1144	Trojan.exe	32
PID 1144 wrote to memory of 2840	1144	Trojan.exe	32
PID 1144 wrote to memory of 2840	1144	Trojan.exe	32
PID 1144 wrote to memory of 2840	1144	Trojan.exe	32
PID 1144 wrote to memory of 2820	1144	Trojan.exe	33
PID 1144 wrote to memory of 2820	1144	Trojan.exe	33
PID 1144 wrote to memory of 2820	1144	Trojan.exe	33
PID 1144 wrote to memory of 2820	1144	Trojan.exe	33
PID 1144 wrote to memory of 2732	1144	Trojan.exe	36
PID 1144 wrote to memory of 2732	1144	Trojan.exe	36
PID 1144 wrote to memory of 2732	1144	Trojan.exe	36
PID 1144 wrote to memory of 2732	1144	Trojan.exe	36

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Crypted.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan.exe

C:\Users\Admin\AppData\Local\Temp\3911b929fbaca50a56c5045f7f856422_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3911b929fbaca50a56c5045f7f856422_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Users\Admin\AppData\Local\Temp\Crypted.exe
  "C:\Users\Admin\AppData\Local\Temp\Crypted.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1952
- - C:\Users\Admin\AppData\Local\Temp\Trojan.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan.exe"
    3⤵
    - UAC bypass
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1144
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2840
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Windows\SysWOW64\wscript.exe" "wscript.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2820
  - - C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\SysWOW64\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\Trojan.vbe"
      4⤵
      PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Trojan.vbe

Filesize
54B

MD5
d30c09a41463aedb81889a81e44a6c27

SHA1
7bf7841332ab42cd92fb85d6c71a97b42770dbb8

SHA256
255e6e872739e45789adc5f3b4cfd906338135f005c1450e1f9615c99af2f66e

SHA512
4a0f781bffc283d5db32b2d522f7f6e2a4d73a16876f536cb93b6d6813dccdeefcb4bc425c521331b77ec75c0f6f8be3cc7e9e1cc121f2cd01ec499ae9087203

Download Submit
\Users\Admin\AppData\Local\Temp\Crypted.exe

Filesize
127KB

MD5
956d69e0a14e3883410e4f734b48868c

SHA1
89ae1afa603545d46163177bb960f2a3120ab516

SHA256
57eccddd137099416b8e4b80a219161b83e8acc070d7f816ca2a518e2195b245

SHA512
9cf86d741ad65bf04fe08f28be2e24b24c472595fc6c5b863ae52e234d8e420d254eb593dd14fab95a2280ddfd5d3f48f7d5be450fcdd0b4ea66d0a66c20cd04

Download Submit
memory/1144-25-0x00000000748E0000-0x0000000074E8B000-memory.dmp

Filesize
5.7MB

Download
memory/1144-31-0x00000000748E0000-0x0000000074E8B000-memory.dmp

Filesize
5.7MB

Download
memory/1760-8-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1952-11-0x00000000748E1000-0x00000000748E2000-memory.dmp

Filesize
4KB

Download
memory/1952-13-0x00000000748E0000-0x0000000074E8B000-memory.dmp

Filesize
5.7MB

Download
memory/1952-12-0x00000000748E0000-0x0000000074E8B000-memory.dmp

Filesize
5.7MB

Download
memory/1952-24-0x00000000748E0000-0x0000000074E8B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads