modiloader | 6a837c71ebda00e63ac09d8cad5e01445f255ffed06f0b301c3293f0d88b322f

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25-09-2024 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe
Size

844KB
MD5

f6415e75dbc6b6c836e7502318f6987e
SHA1

0c19ba66c6d798fe4eb4183ead041cc44a03dfb5
SHA256

6a837c71ebda00e63ac09d8cad5e01445f255ffed06f0b301c3293f0d88b322f
SHA512

bcbb0b4d89ab11ade5bc5a3e2314262269b515606ced2af6b7ba84283fd7acccb931d6ebb24c2040a803022b1b3facc2e45366983c3eb7ca2ac6712d25774406
SSDEEP

24576:fvX0CqJm7lpD2KXQztsFvKlH0jmr5WisTzjle5U5TIDV+DwLQk9Qd:3X05Jm7sAKF0GELm8IDVGqQV

Score

10^/10

modiloader discovery evasion persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\fbe76925\\X"	Explorer.EXE

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	srRTMxaDv9.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	zkzuay.exe

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000016da7-34.dat	modiloader_stage2
behavioral1/memory/2908-46-0x0000000000400000-0x0000000000417000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
1680	cmd.exe

Executes dropped EXE 10 IoCs

pid	Process
1856	srRTMxaDv9.exe
2924	zkzuay.exe
2908	amhost.exe
2904	amhost.exe
2580	bmhost.exe
332	csrss.exe
2656	cmhost.exe
2060	X
1220	Explorer.EXE
3004	dmhost.exe

Loads dropped DLL 16 IoCs

pid	Process
1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe
1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe
1856	srRTMxaDv9.exe
1856	srRTMxaDv9.exe
1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe
1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe
1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe
1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe
1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe
1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe
2656	cmhost.exe
2656	cmhost.exe
2656	cmhost.exe
2060	X
1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe
1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /d"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /X"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /Z"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /u"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /D"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /F"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /I"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /g"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /h"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /M"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /x"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /w"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /s"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /j"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /V"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /A"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /r"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /f"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /H"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /N"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /G"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /e"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /m"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /B"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /J"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /p"	srRTMxaDv9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /W"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /U"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /Y"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /L"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /E"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /P"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /k"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /K"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /C"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /S"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /q"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /i"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /n"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /Q"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /o"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /p"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /a"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /y"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /v"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /c"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /l"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /t"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /T"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /z"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /b"	zkzuay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\zkzuay = "C:\\Users\\Admin\\zkzuay.exe /R"	zkzuay.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2820	tasklist.exe
2568	tasklist.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2908 set thread context of 2904	2908	amhost.exe	37
PID 2580 set thread context of 1056	2580	bmhost.exe	40
PID 2656 set thread context of 2184	2656	cmhost.exe	44

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2904-48-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2904-40-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2904-38-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2904-52-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2904-51-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2904-50-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	srRTMxaDv9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zkzuay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	amhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bmhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dmhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1856	srRTMxaDv9.exe
1856	srRTMxaDv9.exe
2904	amhost.exe
2580	bmhost.exe
2580	bmhost.exe
2580	bmhost.exe
2580	bmhost.exe
2924	zkzuay.exe
2924	zkzuay.exe
2924	zkzuay.exe
2060	X
2904	amhost.exe
2924	zkzuay.exe
2924	zkzuay.exe
2924	zkzuay.exe
2924	zkzuay.exe
2904	amhost.exe
2924	zkzuay.exe
2904	amhost.exe
2904	amhost.exe
2924	zkzuay.exe
2924	zkzuay.exe
2924	zkzuay.exe
2904	amhost.exe
2924	zkzuay.exe
2904	amhost.exe
2904	amhost.exe
2924	zkzuay.exe
2924	zkzuay.exe
2924	zkzuay.exe
2904	amhost.exe
2904	amhost.exe
2924	zkzuay.exe
2904	amhost.exe
2924	zkzuay.exe
2904	amhost.exe
2904	amhost.exe
2924	zkzuay.exe
2904	amhost.exe
2924	zkzuay.exe
2904	amhost.exe
2924	zkzuay.exe
2904	amhost.exe
2924	zkzuay.exe
2904	amhost.exe
2924	zkzuay.exe
2904	amhost.exe
2904	amhost.exe
2924	zkzuay.exe
2904	amhost.exe
2924	zkzuay.exe
2904	amhost.exe
2924	zkzuay.exe
2924	zkzuay.exe
2904	amhost.exe
2904	amhost.exe
2904	amhost.exe
2924	zkzuay.exe
2904	amhost.exe
2904	amhost.exe
2904	amhost.exe
2924	zkzuay.exe
2924	zkzuay.exe
2924	zkzuay.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2820	tasklist.exe
Token: SeDebugPrivilege	2580	bmhost.exe
Token: SeDebugPrivilege	2580	bmhost.exe
Token: SeDebugPrivilege	2568	tasklist.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe
1856	srRTMxaDv9.exe
2924	zkzuay.exe
3004	dmhost.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1856	1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe	30
PID 1620 wrote to memory of 1856	1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe	30
PID 1620 wrote to memory of 1856	1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe	30
PID 1620 wrote to memory of 1856	1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe	30
PID 1856 wrote to memory of 2924	1856	srRTMxaDv9.exe	31
PID 1856 wrote to memory of 2924	1856	srRTMxaDv9.exe	31
PID 1856 wrote to memory of 2924	1856	srRTMxaDv9.exe	31
PID 1856 wrote to memory of 2924	1856	srRTMxaDv9.exe	31
PID 1856 wrote to memory of 2696	1856	srRTMxaDv9.exe	32
PID 1856 wrote to memory of 2696	1856	srRTMxaDv9.exe	32
PID 1856 wrote to memory of 2696	1856	srRTMxaDv9.exe	32
PID 1856 wrote to memory of 2696	1856	srRTMxaDv9.exe	32
PID 2696 wrote to memory of 2820	2696	cmd.exe	34
PID 2696 wrote to memory of 2820	2696	cmd.exe	34
PID 2696 wrote to memory of 2820	2696	cmd.exe	34
PID 2696 wrote to memory of 2820	2696	cmd.exe	34
PID 1620 wrote to memory of 2908	1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe	36
PID 1620 wrote to memory of 2908	1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe	36
PID 1620 wrote to memory of 2908	1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe	36
PID 1620 wrote to memory of 2908	1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe	36
PID 2908 wrote to memory of 2904	2908	amhost.exe	37
PID 2908 wrote to memory of 2904	2908	amhost.exe	37
PID 2908 wrote to memory of 2904	2908	amhost.exe	37
PID 2908 wrote to memory of 2904	2908	amhost.exe	37
PID 2908 wrote to memory of 2904	2908	amhost.exe	37
PID 2908 wrote to memory of 2904	2908	amhost.exe	37
PID 2908 wrote to memory of 2904	2908	amhost.exe	37
PID 2908 wrote to memory of 2904	2908	amhost.exe	37
PID 1620 wrote to memory of 2580	1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe	38
PID 1620 wrote to memory of 2580	1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe	38
PID 1620 wrote to memory of 2580	1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe	38
PID 1620 wrote to memory of 2580	1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe	38
PID 2580 wrote to memory of 1220	2580	bmhost.exe	21
PID 2580 wrote to memory of 332	2580	bmhost.exe	2
PID 332 wrote to memory of 2108	332	csrss.exe	39
PID 332 wrote to memory of 2108	332	csrss.exe	39
PID 2580 wrote to memory of 1056	2580	bmhost.exe	40
PID 2580 wrote to memory of 1056	2580	bmhost.exe	40
PID 2580 wrote to memory of 1056	2580	bmhost.exe	40
PID 2580 wrote to memory of 1056	2580	bmhost.exe	40
PID 2580 wrote to memory of 1056	2580	bmhost.exe	40
PID 1620 wrote to memory of 2656	1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe	42
PID 1620 wrote to memory of 2656	1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe	42
PID 1620 wrote to memory of 2656	1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe	42
PID 1620 wrote to memory of 2656	1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe	42
PID 2656 wrote to memory of 2060	2656	cmhost.exe	43
PID 2656 wrote to memory of 2060	2656	cmhost.exe	43
PID 2656 wrote to memory of 2060	2656	cmhost.exe	43
PID 2656 wrote to memory of 2060	2656	cmhost.exe	43
PID 2060 wrote to memory of 1220	2060	X	21
PID 2656 wrote to memory of 2184	2656	cmhost.exe	44
PID 2656 wrote to memory of 2184	2656	cmhost.exe	44
PID 2656 wrote to memory of 2184	2656	cmhost.exe	44
PID 2656 wrote to memory of 2184	2656	cmhost.exe	44
PID 2656 wrote to memory of 2184	2656	cmhost.exe	44
PID 1620 wrote to memory of 3004	1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe	46
PID 1620 wrote to memory of 3004	1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe	46
PID 1620 wrote to memory of 3004	1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe	46
PID 1620 wrote to memory of 3004	1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe	46
PID 1620 wrote to memory of 1680	1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe	47
PID 1620 wrote to memory of 1680	1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe	47
PID 1620 wrote to memory of 1680	1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe	47
PID 1620 wrote to memory of 1680	1620	f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe	47
PID 1680 wrote to memory of 2568	1680	cmd.exe	49

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:840
- C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:2108

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
PID:1220
- C:\Users\Admin\AppData\Local\Temp\f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Users\Admin\srRTMxaDv9.exe
    C:\Users\Admin\srRTMxaDv9.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\Users\Admin\zkzuay.exe
      "C:\Users\Admin\zkzuay.exe"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2924
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del srRTMxaDv9.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2696
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2820
- - C:\Users\Admin\amhost.exe
    C:\Users\Admin\amhost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Users\Admin\amhost.exe
      amhost.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2904
- - C:\Users\Admin\bmhost.exe
    C:\Users\Admin\bmhost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1056
- - C:\Users\Admin\cmhost.exe
    C:\Users\Admin\cmhost.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Users\Admin\AppData\Local\fbe76925\X
      176.53.17.24:80
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2060
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2184
- - C:\Users\Admin\dmhost.exe
    C:\Users\Admin\dmhost.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3004
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tasklist&&del f6415e75dbc6b6c836e7502318f6987e_JaffaCakes118.exe
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\fbe76925\@

Filesize
2KB

MD5
f5e66a93bc297ba83db0e7b5564ced3f

SHA1
863c519546cfba7531b8ecbf10ae5bede6d2193d

SHA256
94257ae4c040d8487cb44bc23030193944c72c12678dcd8b80684a3721b21231

SHA512
b7ee82bdc3057df90eed61a9d0d6d52420fb8baf6cc8f12f30144ecdd1f298f13d89e14bfa474ea939bd734440f185d7bba72d1140080a3ef975253191adaea3

Download Submit
C:\Users\Admin\amhost.exe

Filesize
80KB

MD5
8ccbe4f27f9710f3e7f75e1d1de57e49

SHA1
272e95e476477cd4a1715ee0bcf32318e0351718

SHA256
3d36ee15c25b2308f8552e121d885c26b46b4e7fc6dbb41a684bec53e0ae3b5d

SHA512
334f56b5158839f521513aff9de334536c86da633bf1a3b78592529275457973ed67fd55a54bef8f88ce918c2863c365cababfbd0ef888a27272906e281105d0

Download Submit
C:\Windows\system32\consrv.dll

Filesize
53KB

MD5
4d7cde615a0f534bd5e359951829554b

SHA1
c885d00d9000f2a5dbc78f6193a052b36f4fe968

SHA256
414fdf9bdcae5136c1295d6d24740c50a484acd81f1f7d0fb5d5c138607cb80a

SHA512
33d632f9fbb694440a1ca568c90518784278efd1dc9ee2b57028149d56ebe1f7346d5b59dcfafee2eeaa10091dda05f48958e909d6bfc891e037ae1cfbd048d4

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
557c95adec9eaf6a6041608737a0d27f

SHA1
fe3d731a2460d1232e84216e588fc68a917471c8

SHA256
1bc6facae05a38f0b521f3300d6ead420884478f06bfe92cb73503bfa6701e75

SHA512
15697f8f302d67e7e29ad5d29466f14826889fe1cf7c64b352b793a8439d0a1b32054f091e254b5b09506331982f9881bd894d7068d6b752a4d039bfcd36fd1e

Download Submit
\Users\Admin\AppData\Local\fbe76925\X

Filesize
41KB

MD5
be40a2578e862f1cecc9b9194f524201

SHA1
0c379f375f9bcfab2e8d86161cec07fe4a7dbc12

SHA256
2c0f19272baa42d1af85a395fe8cd687c50e91450abc5911f6806c317a25b6a6

SHA512
25fbee1dce99c0ca80cd11bbe0d9fceaa07bf8a8b9b3ebc04e55645c0a733dafc83a7922975c31bc9fdff6f413257ac8b9ff72628c78b48a5b7ab669eab369f8

Download Submit
\Users\Admin\bmhost.exe

Filesize
258KB

MD5
2da0070a7c50f3a078b73b4fb7ee7c02

SHA1
999b4860a80b908622fadfc8fae27db66b200932

SHA256
f8a0f1b5b3f320f01173f151305dc780eac51bf78e7405fd2c0b9b3ba58945bf

SHA512
2d488508e785d92c5cf9f0abee8153d984d8dd8f1d59880643764f499e151fccc9572a9ad1fe0a82412b8ed230d25bd849a0beeded12325dc21839ed53512630

Download Submit
\Users\Admin\cmhost.exe

Filesize
358KB

MD5
03102e4338eb16e0c4dfe106830557e3

SHA1
4fdb5baf0900e44e95acdeee1c947be3b0518b39

SHA256
7dd28bddc46daddc8f7e14906f50ef991d3d7f1ffb785388fb5c42be9e162139

SHA512
c7d4b4b3766c0b4cdc3d16f56effe1b36cacd4a48f728cf1a33360eb6c48362587186dc0be45f098cd3117bc10c7113d51262939bfe018c6f963b36d59cd97c9

Download Submit
\Users\Admin\dmhost.exe

Filesize
32KB

MD5
09cba8ecb0687ad5dae9fa00fea80c9d

SHA1
f5d4f11e20ecf4f5cbd7b98417197f0c5e0399ff

SHA256
458cb23faab8f02e635aa163a276dd076b85514383931aae17e3396280b1b86f

SHA512
294119473fa790b3a7f97455109797e5de93a86b4846d7a3072bc9d0202cc6f6529e7bc46d0a195925f84d65d20da8017d031a7a6bdf8b852a05382bb7525fc1

Download Submit
\Users\Admin\srRTMxaDv9.exe

Filesize
344KB

MD5
57a5743f47b3a874773041195600909c

SHA1
74f5c16a6ca03baea7c684e40d351f1ec484a70d

SHA256
eecfb7541cf571d34882ebeb19c3c396ed53243e23060d45e1f1b033e061da90

SHA512
66c4621663db921b7a18b843197ea6611e9473abca6b2a653d1f228146129434a7f643f598e0fdfbe300f2ea91168135de59a69f02f52245c71f12e4364e2954

Download Submit
\Users\Admin\zkzuay.exe

Filesize
344KB

MD5
8be0444377847d046e3c47154c9c3572

SHA1
09b6d998000afd5b5f48b1ce908bc9992118dbec

SHA256
3d6947de33ec2604eeac53015ad66799c0f810a6dcc180ec77e6b4d132fee1bb

SHA512
2c2d12b69a72040f8d72b34c1886cc8160bd6add71b67e0f1d0cc9aaf98d282c117deffaf8cb6eac458016bd192fa4830d8f8cd653bac8e64baccbe3e78c7e0f

Download Submit
\Windows\assembly\GAC_32\Desktop.ini

Filesize
4KB

MD5
878f9b6da85cb98fcbdf6abd1730a32f

SHA1
343007e658ea541f4680b4edf4513e69e1cc18a6

SHA256
75b5a460ed6f47fca8ec1bcd8a11b22f24fb33de4d5f307b851ad20c7f831b7d

SHA512
5425844e34ad5e717b08830020526f5c9465f654f3e9e29967b2983d5cb8dc225be2b89cd29a8e4cc99fcfc99e05556f66eefa0539283ab4569e603413a37293

Download Submit
\Windows\assembly\GAC_64\Desktop.ini

Filesize
5KB

MD5
9d7ec1e355ac35cbe6991721ef5ae3b8

SHA1
c35a00bd35c6e4a7516b93947be08ead966347e8

SHA256
68a3cec42215323100398a8eb2cbb37da7d58fe0fa9c6312e954e0f50a95ca98

SHA512
b7c4be28d8e179974672205a50e72fa1ec9e2e8170b3b8ee763e1751a3397c35afec7a72c88f0a79a8566749b2af1ff054660a96c3a6d6508c545d316a035dc0

Download Submit
memory/332-87-0x0000000002470000-0x0000000002482000-memory.dmp

Filesize
72KB

Download
memory/1220-81-0x00000000025E0000-0x00000000025E6000-memory.dmp

Filesize
24KB

Download
memory/1220-111-0x0000000002A50000-0x0000000002A5B000-memory.dmp

Filesize
44KB

Download
memory/1220-115-0x0000000002A50000-0x0000000002A5B000-memory.dmp

Filesize
44KB

Download
memory/1220-120-0x0000000002A50000-0x0000000002A5B000-memory.dmp

Filesize
44KB

Download
memory/1220-121-0x0000000002A60000-0x0000000002A6B000-memory.dmp

Filesize
44KB

Download
memory/1220-73-0x00000000025E0000-0x00000000025E6000-memory.dmp

Filesize
24KB

Download
memory/1220-77-0x00000000025E0000-0x00000000025E6000-memory.dmp

Filesize
24KB

Download
memory/2580-64-0x0000000000540000-0x0000000000581000-memory.dmp

Filesize
260KB

Download
memory/2580-72-0x0000000000540000-0x0000000000581000-memory.dmp

Filesize
260KB

Download
memory/2580-70-0x0000000000540000-0x0000000000581000-memory.dmp

Filesize
260KB

Download
memory/2580-69-0x0000000000540000-0x0000000000581000-memory.dmp

Filesize
260KB

Download
memory/2580-91-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2580-68-0x0000000000540000-0x0000000000581000-memory.dmp

Filesize
260KB

Download
memory/2580-60-0x0000000000540000-0x0000000000581000-memory.dmp

Filesize
260KB

Download
memory/2656-136-0x0000000000400000-0x0000000000465C48-memory.dmp

Filesize
407KB

Download
memory/2656-128-0x0000000000400000-0x0000000000465C48-memory.dmp

Filesize
407KB

Download
memory/2904-50-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2904-51-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2904-43-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2904-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2904-38-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2904-52-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2904-48-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2904-40-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2908-46-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download