modiloader | ba4eed8384f52557827a6255f530b0b3e0b4fc5250da6388e2f28616f2b80bf5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe
Size 786KB
Sample240715-mtzeqsselq
SHA256 ba4eed8384f52557827a6255f530b0b3e0b4fc5250da6388e2f28616f2b80bf5
MD5 497282f5a24b7948b8f0ef8a3bbc4af3
SHA1 56acbe0d58dbd925c13660dd31899ea802b25746
SHA512 45b72c72efff8b716c1c08a047a64fdb3e53b12dbf0ee0dcd88e05efb95fd1f5ef5f0f6b53ebcf5bddbfb24a04d700e8a9636db8cdc9d3f11c4eaf65dae4c045
SSDEEP 12288:LhhSJRyeHyKAhIV4IoSoJze68PvanRJkHVphYJGTaTFxfj5jtEByClkRqTvB4gTf:LqyeHypU4RJK007QGTojfjlkB4Of
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader xtremerat evasion persistence rat spyware trojan upx

Malware Config

Extracted

Family

xtremerat

nerozhack.ddns.com.br
p ƒalonedevil.no-ip.org
gameszero.dyndns.org

Signatures

Detect XtremeRAT payload 12 IoCs

resource	yara_rule
behavioral2/memory/3136-45-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/3180-46-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/3272-47-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/3272-50-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/3272-52-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/3180-53-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/1132-113-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/1704-121-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/2540-124-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/2540-132-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/1704-134-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat
behavioral2/memory/2540-140-0x0000000010000000-0x000000001004D000-memory.dmp	family_xtremerat

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

ModiLoader Second Stage 13 IoCs

resource	yara_rule
behavioral2/memory/3608-24-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/3608-22-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/3608-34-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/3608-64-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/3972-76-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/3972-78-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/3972-81-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/3972-142-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/3972-145-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/3972-146-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/3972-149-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/3972-152-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/3972-155-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe

Executes dropped EXE 8 IoCs

pid	Process
4900	RSOP.exe
1492	RSOP.exe
3136	RSOP.exe
2460	mstwain32.exe
3708	RSOP.exe
3972	mstwain32.exe
4564	RSOP.exe
1132	RSOP.exe

Loads dropped DLL 19 IoCs

pid	Process
3972	mstwain32.exe
3972	mstwain32.exe
3972	mstwain32.exe
3972	mstwain32.exe
3708	RSOP.exe
3708	RSOP.exe
4564	RSOP.exe
4564	RSOP.exe
1132	RSOP.exe
1132	RSOP.exe
1696	WerFault.exe
1696	WerFault.exe
2540	taskmgr.exe
2540	taskmgr.exe
4192	WerFault.exe
1540	WerFault.exe
1540	WerFault.exe
3080	WerFault.exe
3080	WerFault.exe

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1528-0-0x0000000000400000-0x00000000004B1000-memory.dmp	upx
behavioral2/files/0x0009000000023451-11.dat	upx
behavioral2/memory/3608-21-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/1528-26-0x0000000000400000-0x00000000004B1000-memory.dmp	upx
behavioral2/memory/3608-24-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/4900-23-0x0000000000400000-0x00000000004B1000-memory.dmp	upx
behavioral2/memory/3608-22-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/3608-19-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/1492-27-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/1492-30-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/1492-35-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3608-34-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/4900-33-0x0000000000400000-0x00000000004B1000-memory.dmp	upx
behavioral2/memory/3136-38-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/3136-41-0x0000000000400000-0x00000000004B1000-memory.dmp	upx
behavioral2/memory/3136-42-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/1492-44-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3136-45-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/3180-46-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/3272-47-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/3272-50-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/3272-52-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/3180-53-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/files/0x0010000000023455-58.dat	upx
behavioral2/memory/3608-64-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/3972-76-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/3972-78-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/2460-80-0x0000000000400000-0x00000000004B1000-memory.dmp	upx
behavioral2/memory/3708-77-0x0000000000400000-0x00000000004B1000-memory.dmp	upx
behavioral2/memory/3972-75-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/3972-81-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/3708-104-0x0000000000400000-0x00000000004B1000-memory.dmp	upx
behavioral2/memory/4564-101-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/4564-100-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/1132-112-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/4564-117-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/1132-113-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/1704-121-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/2540-124-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/2540-132-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/1704-134-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/2540-140-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral2/memory/3972-142-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/3972-145-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/3972-146-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/3972-149-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/3972-152-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/3972-155-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\Microsoft\\Protect\\System.exe"	taskmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\Microsoft\\Protect\\System.exe"	taskmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Update = "C:\\Windows\\system32\\Microsoft\\Protect\\System.exe"	taskmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\Microsoft\\Protect\\System.exe"	taskmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe"	mstwain32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\Microsoft\\Protect\\System.exe"	taskmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Update = "C:\\Windows\\system32\\Microsoft\\Protect\\System.exe"	taskmgr.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mstwain32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe

AutoIT Executable 6 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/1528-26-0x0000000000400000-0x00000000004B1000-memory.dmp	autoit_exe
behavioral2/memory/4900-23-0x0000000000400000-0x00000000004B1000-memory.dmp	autoit_exe
behavioral2/memory/4900-33-0x0000000000400000-0x00000000004B1000-memory.dmp	autoit_exe
behavioral2/memory/2460-80-0x0000000000400000-0x00000000004B1000-memory.dmp	autoit_exe
behavioral2/memory/3708-77-0x0000000000400000-0x00000000004B1000-memory.dmp	autoit_exe
behavioral2/memory/3708-104-0x0000000000400000-0x00000000004B1000-memory.dmp	autoit_exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Microsoft\Protect\	taskmgr.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft\Protect\System.exe	taskmgr.exe
File created	C:\Windows\SysWOW64\Microsoft\Protect\System.exe	taskmgr.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft\Protect\	taskmgr.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft\Protect\System.exe	taskmgr.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 1528 set thread context of 3608	1528	497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe	86
PID 4900 set thread context of 1492	4900	RSOP.exe	88
PID 1492 set thread context of 3136	1492	RSOP.exe	89
PID 2460 set thread context of 3972	2460	mstwain32.exe	100
PID 3708 set thread context of 4564	3708	RSOP.exe	102
PID 4564 set thread context of 1132	4564	RSOP.exe	103

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mstwain32.exe	497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe
File created	C:\Windows\ntdtcstp.dll	mstwain32.exe
File created	C:\Windows\cmsetac.dll	mstwain32.exe
File opened for modification	C:\Windows\RSOP.exe	RSOP.exe
File created	C:\Windows\RSOP.exe	497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe
File opened for modification	C:\Windows\RSOP.exe	497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe
File opened for modification	C:\Windows\RSOP.exe	RSOP.exe
File created	C:\Windows\mstwain32.exe	497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 7 IoCs

pid	pid_target	Process	procid_target
1948	3180	WerFault.exe	90
4952	3272	WerFault.exe	91
4356	3180	WerFault.exe	90
1696	1704	WerFault.exe	104
4192	1704	WerFault.exe	104
1540	2540	WerFault.exe	105
3080	2540	WerFault.exe	105

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
2540	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3608	497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe
Token: SeDebugPrivilege	3972	mstwain32.exe
Token: SeDebugPrivilege	3972	mstwain32.exe
Token: SeDebugPrivilege	3708	RSOP.exe
Token: SeDebugPrivilege	4564	RSOP.exe
Token: SeDebugPrivilege	1132	RSOP.exe
Token: SeDebugPrivilege	2540	taskmgr.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1492	RSOP.exe
3272	taskmgr.exe
3972	mstwain32.exe
3972	mstwain32.exe
4564	RSOP.exe
2540	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 3608	1528	497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe	86
PID 1528 wrote to memory of 3608	1528	497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe	86
PID 1528 wrote to memory of 3608	1528	497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe	86
PID 1528 wrote to memory of 4900	1528	497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe	87
PID 1528 wrote to memory of 4900	1528	497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe	87
PID 1528 wrote to memory of 4900	1528	497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe	87
PID 1528 wrote to memory of 3608	1528	497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe	86
PID 1528 wrote to memory of 3608	1528	497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe	86
PID 1528 wrote to memory of 3608	1528	497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe	86
PID 4900 wrote to memory of 1492	4900	RSOP.exe	88
PID 4900 wrote to memory of 1492	4900	RSOP.exe	88
PID 4900 wrote to memory of 1492	4900	RSOP.exe	88
PID 4900 wrote to memory of 1492	4900	RSOP.exe	88
PID 4900 wrote to memory of 1492	4900	RSOP.exe	88
PID 4900 wrote to memory of 1492	4900	RSOP.exe	88
PID 1492 wrote to memory of 3136	1492	RSOP.exe	89
PID 1492 wrote to memory of 3136	1492	RSOP.exe	89
PID 1492 wrote to memory of 3136	1492	RSOP.exe	89
PID 1492 wrote to memory of 3136	1492	RSOP.exe	89
PID 1492 wrote to memory of 3136	1492	RSOP.exe	89
PID 1492 wrote to memory of 3136	1492	RSOP.exe	89
PID 1492 wrote to memory of 3136	1492	RSOP.exe	89
PID 1492 wrote to memory of 3136	1492	RSOP.exe	89
PID 3136 wrote to memory of 3180	3136	RSOP.exe	90
PID 3136 wrote to memory of 3180	3136	RSOP.exe	90
PID 3136 wrote to memory of 3180	3136	RSOP.exe	90
PID 3136 wrote to memory of 3180	3136	RSOP.exe	90
PID 3136 wrote to memory of 3272	3136	RSOP.exe	91
PID 3136 wrote to memory of 3272	3136	RSOP.exe	91
PID 3136 wrote to memory of 3272	3136	RSOP.exe	91
PID 3136 wrote to memory of 3272	3136	RSOP.exe	91
PID 3608 wrote to memory of 2460	3608	497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe	99
PID 3608 wrote to memory of 2460	3608	497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe	99
PID 3608 wrote to memory of 2460	3608	497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe	99
PID 2460 wrote to memory of 3972	2460	mstwain32.exe	100
PID 2460 wrote to memory of 3972	2460	mstwain32.exe	100
PID 2460 wrote to memory of 3972	2460	mstwain32.exe	100
PID 2460 wrote to memory of 3708	2460	mstwain32.exe	101
PID 2460 wrote to memory of 3708	2460	mstwain32.exe	101
PID 2460 wrote to memory of 3708	2460	mstwain32.exe	101
PID 2460 wrote to memory of 3972	2460	mstwain32.exe	100
PID 2460 wrote to memory of 3972	2460	mstwain32.exe	100
PID 2460 wrote to memory of 3972	2460	mstwain32.exe	100
PID 3708 wrote to memory of 4564	3708	RSOP.exe	102
PID 3708 wrote to memory of 4564	3708	RSOP.exe	102
PID 3708 wrote to memory of 4564	3708	RSOP.exe	102
PID 3708 wrote to memory of 4564	3708	RSOP.exe	102
PID 3708 wrote to memory of 4564	3708	RSOP.exe	102
PID 3708 wrote to memory of 4564	3708	RSOP.exe	102
PID 4564 wrote to memory of 1132	4564	RSOP.exe	103
PID 4564 wrote to memory of 1132	4564	RSOP.exe	103
PID 4564 wrote to memory of 1132	4564	RSOP.exe	103
PID 4564 wrote to memory of 1132	4564	RSOP.exe	103
PID 4564 wrote to memory of 1132	4564	RSOP.exe	103
PID 4564 wrote to memory of 1132	4564	RSOP.exe	103
PID 4564 wrote to memory of 1132	4564	RSOP.exe	103
PID 4564 wrote to memory of 1132	4564	RSOP.exe	103
PID 1132 wrote to memory of 1704	1132	RSOP.exe	104
PID 1132 wrote to memory of 1704	1132	RSOP.exe	104
PID 1132 wrote to memory of 1704	1132	RSOP.exe	104
PID 1132 wrote to memory of 1704	1132	RSOP.exe	104
PID 1132 wrote to memory of 2540	1132	RSOP.exe	105
PID 1132 wrote to memory of 2540	1132	RSOP.exe	105
PID 1132 wrote to memory of 2540	1132	RSOP.exe	105

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

C:\Users\Admin\AppData\Local\Temp\497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Users\Admin\AppData\Local\Temp\497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\497282f5a24b7948b8f0ef8a3bbc4af3_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Windows\mstwain32.exe
    "C:\Windows\mstwain32.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Windows\mstwain32.exe
      "C:\Windows\mstwain32.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:3972
  - - C:\Windows\RSOP.exe
      C:\Windows\RSOP.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3708
    - - C:\Windows\RSOP.exe
        
        "C:\Windows\RSOP.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4564
      - C:\Windows\RSOP.exe
        
        "C:\Windows\RSOP.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1132
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 480
        8⤵
        Loads dropped DLL
        Program crash
        
        PID:1696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 488
        8⤵
        Loads dropped DLL
        Program crash
        
        PID:4192
        
        C:\WINDOWS\SysWOW64\taskmgr.exe
        
        C:\WINDOWS\system32\taskmgr.exe
        7⤵
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: SetClipboardViewer
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 1088
        8⤵
        Loads dropped DLL
        Program crash
        
        PID:1540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 1116
        8⤵
        Loads dropped DLL
        Program crash
        
        PID:3080
- C:\Windows\RSOP.exe
  C:\Windows\RSOP.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\RSOP.exe
    "C:\Windows\RSOP.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\RSOP.exe
      "C:\Windows\RSOP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3136
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        
        PID:3180
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 480
        6⤵
        Program crash
        
        PID:1948
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 500
        6⤵
        Program crash
        
        PID:4356
    - - C:\WINDOWS\SysWOW64\taskmgr.exe
        
        C:\WINDOWS\system32\taskmgr.exe
        5⤵
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:3272
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 1076
        6⤵
        Program crash
        
        PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3180 -ip 3180
1⤵
PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3272 -ip 3272
1⤵
PID:548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3180 -ip 3180
1⤵
PID:2108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1704 -ip 1704
1⤵
PID:672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1704 -ip 1704
1⤵
PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2540 -ip 2540
1⤵
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2540 -ip 2540
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aaewrcp

Path C:\Users\Admin\AppData\Local\Temp\aaewrcp
Size 9KB
SHA256 b4efccf8457046aaf4c5b272addd3299003f41ef19bad993ee2be0554a2922ce
MD5 1cae2b547a78ece24949e7abc5ce0832
SHA1 54c4b7d4973c22818f87f8a5c5c145e408c65095
SHA512 786a678a513f09528335b48fc9e87c0c0e12f795090bb76f27a74fed522bcb0bf842c2b649e1bc19d2b22dbbf76a83a5d0df8e70db242e258de97758ebdc56d8
SSDEEP 192:ZLrHArHFgaW5hULbN61pJ53t5YwRBeQ+//:NH6HFs487v3t57u
MD5 SHA1 SHA512 SSDEEP

Submit Download

RSOP.exe

Path C:\Windows\RSOP.exe
Size 300KB
SHA256 3cdc6602fee91dc53c16573cf2f53dbcec491d53a0795312290a804a247a81a3
MD5 a87e455284d5aaf624c6c419fa7f9bed
SHA1 dd7335f04ef50375b124106cc599d4def55f40ac
SHA512 000fbf010fdcc5d47be1500372d8ca4d2fe399a4c0e1a9299da5e42fa0fae77711f38be13bab1264e8dd78f321ac79fefdcea52953749756f8d33c225842ae32
SSDEEP 6144:9H1UQYbnezSnflD5KGS/CQjXqbMl4uG93iFe/oSbhy+gCa:9VPSnfdEG+zqghGBiFe/oSb85t
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmsetac.dll

Path C:\Windows\cmsetac.dll
Size 33KB
SHA256 e14de95ab21c8c07b1b50d64b36cf8af63ae7f6b47d6c5185dcd6557bca88c19
MD5 90ce4b6ee88b15323e51e34e3c057db9
SHA1 658e70a669aececf85a3fd34f62bbedd2e59e36c
SHA512 2c8a83b29b728b57adc9d4e0ceae7157b222c1206eb609e7b5701d09ed0401359d7522570848def4cd017289bf5923ca1e3d8f8c1a25a90cd3c981ea4b4f47d3
SSDEEP 768:R+aoi6qZOpQB5ZpOc06HCMN9GT6RJ5BHUEy2YEZZEo:R+av6qZ4QxpP0AtNfRJ5BHxY
MD5 SHA1 SHA512 SSDEEP

Submit Download

mstwain32.exe

Path C:\Windows\mstwain32.exe
Size 786KB
SHA256 ba4eed8384f52557827a6255f530b0b3e0b4fc5250da6388e2f28616f2b80bf5
MD5 497282f5a24b7948b8f0ef8a3bbc4af3
SHA1 56acbe0d58dbd925c13660dd31899ea802b25746
SHA512 45b72c72efff8b716c1c08a047a64fdb3e53b12dbf0ee0dcd88e05efb95fd1f5ef5f0f6b53ebcf5bddbfb24a04d700e8a9636db8cdc9d3f11c4eaf65dae4c045
SSDEEP 12288:LhhSJRyeHyKAhIV4IoSoJze68PvanRJkHVphYJGTaTFxfj5jtEByClkRqTvB4gTf:LqyeHypU4RJK007QGTojfjlkB4Of
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntdtcstp.dll

Path C:\Windows\ntdtcstp.dll
Size 7KB
SHA256 e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
MD5 67587e25a971a141628d7f07bd40ffa0
SHA1 76fcd014539a3bb247cc0b761225f68bd6055f6b
SHA512 6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
SSDEEP 96:nPI4WiJu8aFwiFtih01Rl532eJWahK4oDImBx:ndW0u8/Jh0Dl532eJWao4i/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1132-112-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/1132-113-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/1132-120-0x0000000002720000-0x000000000272E000-memory.dmp

Download

memory/1132-125-0x0000000002720000-0x000000000272E000-memory.dmp

Download

memory/1492-35-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1492-44-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1492-27-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1492-30-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1528-26-0x0000000000400000-0x00000000004B1000-memory.dmp

Download

memory/1528-0-0x0000000000400000-0x00000000004B1000-memory.dmp

Download

memory/1704-121-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/1704-134-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/2460-80-0x0000000000400000-0x00000000004B1000-memory.dmp

Download

memory/2540-128-0x0000000000600000-0x000000000060E000-memory.dmp

Download

memory/2540-132-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/2540-140-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/2540-124-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/2540-141-0x0000000000600000-0x000000000060E000-memory.dmp

Download

memory/3136-41-0x0000000000400000-0x00000000004B1000-memory.dmp

Download

memory/3136-38-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/3136-42-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/3136-45-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/3180-46-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/3180-53-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/3272-50-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/3272-47-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/3272-52-0x0000000010000000-0x000000001004D000-memory.dmp

Download

memory/3608-34-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3608-64-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3608-21-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3608-24-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3608-22-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3608-19-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3708-98-0x0000000002A80000-0x0000000002A8E000-memory.dmp

Download

memory/3708-104-0x0000000000400000-0x00000000004B1000-memory.dmp

Download

memory/3708-103-0x0000000002A80000-0x0000000002A8E000-memory.dmp

Download

memory/3708-77-0x0000000000400000-0x00000000004B1000-memory.dmp

Download

memory/3972-149-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3972-81-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3972-152-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3972-78-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3972-76-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3972-145-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3972-75-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3972-146-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3972-144-0x00000000033E0000-0x00000000033EE000-memory.dmp

Download

memory/3972-143-0x00000000004B0000-0x00000000004B8000-memory.dmp

Download

memory/3972-155-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3972-91-0x00000000033E0000-0x00000000033EE000-memory.dmp

Download

memory/3972-142-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4564-116-0x0000000000440000-0x000000000044E000-memory.dmp

Download

memory/4564-117-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4564-107-0x0000000000440000-0x000000000044E000-memory.dmp

Download

memory/4564-100-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4564-101-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4900-23-0x0000000000400000-0x00000000004B1000-memory.dmp

Download

memory/4900-33-0x0000000000400000-0x00000000004B1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads