modiloader | 524327f487803c531734eb5d043f8a20ef0ca1837cafc228fd4de0a057739b8e

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 12:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3911b929fbaca50a56c5045f7f856422_JaffaCakes118.exe
Size

187KB
MD5

3911b929fbaca50a56c5045f7f856422
SHA1

7ec73b461d3cf6927fc6b08bf8868fece812565b
SHA256

524327f487803c531734eb5d043f8a20ef0ca1837cafc228fd4de0a057739b8e
SHA512

2d976299235e368ef8cc47cad4c497dbc96d7251a5b32643776f9ead5304d33b0cc82b720eae1a4db922d2c8fee41373f32548c1b091be5393542bb7d132d56d
SSDEEP

3072:sCgTB4W/dERuowa1z+i8OvoZaawiDhuTpnXGpGhST+xURuYZQz8jOy:sB4CEc/d7VuT2QST+2QA

Score

10^/10

modiloader evasion persistence privilege_escalation trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Crypted.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan.exe

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/1604-7-0x0000000000400000-0x0000000000436000-memory.dmp	modiloader_stage2

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4376	netsh.exe
4548	netsh.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	3911b929fbaca50a56c5045f7f856422_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	Crypted.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	Trojan.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe	Trojan.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe	Trojan.exe

Executes dropped EXE 2 IoCs

pid	Process
2308	Crypted.exe
4236	Trojan.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .."	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .."	Trojan.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Trojan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Crypted.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Crypted.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Modifies registry class 61 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\ProgId	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xyshjsxtkmc.dkhfpjjxnb\CLSID\ = "{697688CD-6632-31D8-9503-ED35D75B7B00}"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xyshjsxtkmc.ulntsremnk	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xyshjsxtkmc.ulntsremnk\ = "xyshjsxtkmc.ulntsremnk"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32\0.0.0.0\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/Trojan.exe"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xyshjsxtkmc.dkhfpjjxnb\CLSID	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32\Class = "xyshjsxtkmc.dkhfpjjxnb"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32\0.0.0.0	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\ProgId	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32\0.0.0.0	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32\0.0.0.0\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/Trojan.exe"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32\0.0.0.0\Assembly = "xyshjsxtkmc, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xyshjsxtkmc.ulntsremnk	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\ProgId	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\Implemented Categories	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\Implemented Categories	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32\ThreadingModel = "Both"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32\RuntimeVersion = "v2.0.50727"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xyshjsxtkmc.dkhfpjjxnb	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/Trojan.exe"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32\RuntimeVersion = "v2.0.50727"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\ProgId\ = "xyshjsxtkmc.ulntsremnk"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xyshjsxtkmc.dkhfpjjxnb\CLSID	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\ = "xyshjsxtkmc.ulntsremnk"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32\ThreadingModel = "Both"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32\0.0.0.0\RuntimeVersion = "v2.0.50727"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xyshjsxtkmc.ulntsremnk\CLSID\ = "{42B5FF65-6B94-327B-84B2-65254234572C}"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\ = "xyshjsxtkmc.dkhfpjjxnb"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{62C8FE65-4EBB-45E7-B440-6E39B2CDBF29}\0 = ".NET Category"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\ProgId	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32\ = "mscoree.dll"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32\0.0.0.0\RuntimeVersion = "v2.0.50727"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\Implemented Categories	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32\0.0.0.0	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xyshjsxtkmc.ulntsremnk\CLSID	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32\Assembly = "xyshjsxtkmc, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32\Assembly = "xyshjsxtkmc, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32\ = "mscoree.dll"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xyshjsxtkmc.dkhfpjjxnb\ = "xyshjsxtkmc.dkhfpjjxnb"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/Trojan.exe"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32\0.0.0.0\Class = "xyshjsxtkmc.ulntsremnk"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\Implemented Categories	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32\0.0.0.0\Class = "xyshjsxtkmc.dkhfpjjxnb"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\ProgId\ = "xyshjsxtkmc.dkhfpjjxnb"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xyshjsxtkmc.ulntsremnk\CLSID	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32\0.0.0.0	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xyshjsxtkmc.dkhfpjjxnb	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32\Class = "xyshjsxtkmc.ulntsremnk"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{697688CD-6632-31D8-9503-ED35D75B7B00}\InprocServer32\0.0.0.0\Assembly = "xyshjsxtkmc, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\InprocServer32	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42B5FF65-6B94-327B-84B2-65254234572C}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	Trojan.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4236	Trojan.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4236	Trojan.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 2308	1604	3911b929fbaca50a56c5045f7f856422_JaffaCakes118.exe	86
PID 1604 wrote to memory of 2308	1604	3911b929fbaca50a56c5045f7f856422_JaffaCakes118.exe	86
PID 1604 wrote to memory of 2308	1604	3911b929fbaca50a56c5045f7f856422_JaffaCakes118.exe	86
PID 2308 wrote to memory of 4236	2308	Crypted.exe	87
PID 2308 wrote to memory of 4236	2308	Crypted.exe	87
PID 2308 wrote to memory of 4236	2308	Crypted.exe	87
PID 4236 wrote to memory of 4376	4236	Trojan.exe	88
PID 4236 wrote to memory of 4376	4236	Trojan.exe	88
PID 4236 wrote to memory of 4376	4236	Trojan.exe	88
PID 4236 wrote to memory of 4548	4236	Trojan.exe	89
PID 4236 wrote to memory of 4548	4236	Trojan.exe	89
PID 4236 wrote to memory of 4548	4236	Trojan.exe	89
PID 4236 wrote to memory of 2200	4236	Trojan.exe	92
PID 4236 wrote to memory of 2200	4236	Trojan.exe	92
PID 4236 wrote to memory of 2200	4236	Trojan.exe	92

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Crypted.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan.exe

C:\Users\Admin\AppData\Local\Temp\3911b929fbaca50a56c5045f7f856422_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3911b929fbaca50a56c5045f7f856422_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Users\Admin\AppData\Local\Temp\Crypted.exe
  "C:\Users\Admin\AppData\Local\Temp\Crypted.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2308
- - C:\Users\Admin\AppData\Local\Temp\Trojan.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4236
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4376
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Windows\SysWOW64\wscript.exe" "wscript.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4548
  - - C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\SysWOW64\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\Trojan.vbe"
      4⤵
      PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Crypted.exe

Filesize
127KB

MD5
956d69e0a14e3883410e4f734b48868c

SHA1
89ae1afa603545d46163177bb960f2a3120ab516

SHA256
57eccddd137099416b8e4b80a219161b83e8acc070d7f816ca2a518e2195b245

SHA512
9cf86d741ad65bf04fe08f28be2e24b24c472595fc6c5b863ae52e234d8e420d254eb593dd14fab95a2280ddfd5d3f48f7d5be450fcdd0b4ea66d0a66c20cd04

Download Submit
C:\Users\Admin\AppData\Local\Temp\Trojan.vbe

Filesize
54B

MD5
d30c09a41463aedb81889a81e44a6c27

SHA1
7bf7841332ab42cd92fb85d6c71a97b42770dbb8

SHA256
255e6e872739e45789adc5f3b4cfd906338135f005c1450e1f9615c99af2f66e

SHA512
4a0f781bffc283d5db32b2d522f7f6e2a4d73a16876f536cb93b6d6813dccdeefcb4bc425c521331b77ec75c0f6f8be3cc7e9e1cc121f2cd01ec499ae9087203

Download Submit
memory/1604-7-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2308-9-0x0000000074B12000-0x0000000074B13000-memory.dmp

Filesize
4KB

Download
memory/2308-10-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/2308-11-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/2308-23-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/4236-22-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/4236-20-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/4236-29-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads