Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-11-2024 07:21
Behavioral task
behavioral1
Sample
8fe1972a8ab4e35c4e22c8ba51027d1e_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8fe1972a8ab4e35c4e22c8ba51027d1e_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
8fe1972a8ab4e35c4e22c8ba51027d1e_JaffaCakes118.exe
-
Size
854KB
-
MD5
8fe1972a8ab4e35c4e22c8ba51027d1e
-
SHA1
1019755801ba2c54c9265c3aa76bcc84333e50b9
-
SHA256
eedf06877f8747be097cd1aad9530501d93a8f7ba39b24ffdf91e1846324ad98
-
SHA512
94897cb5af89dca6e0edb7fa6395bbc6973c1e93548d45975a59aaaf487c72efefeb344ec3f4e46e37d0a91e01f3d58ff3bcbadf3b20e4ca4c5e0ca8e8630586
-
SSDEEP
24576:d7oO9NM/eTUpPriI/YmF3XLOiZKn+ETG5aX:t19WWTUp3YmF3XtZjKGY
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral2/memory/1888-22-0x0000000000400000-0x00000000004DD000-memory.dmp modiloader_stage2 -
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000a000000023c73-32.dat acprotect behavioral2/files/0x0008000000023c79-55.dat acprotect -
resource yara_rule behavioral2/files/0x0007000000023c76-15.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation 8fe1972a8ab4e35c4e22c8ba51027d1e_JaffaCakes118.exe -
Executes dropped EXE 3 IoCs
pid Process 3340 syscopt.exe 2636 britsl8ides.exe 4576 Windows:SD_service.bat -
Loads dropped DLL 4 IoCs
pid Process 3340 syscopt.exe 2964 regsvr32.exe 3340 syscopt.exe 4576 Windows:SD_service.bat -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows:SD_service.bat Key deleted \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows:SD_service.bat Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cvfmon = "C:\\Windows:SD_service.bat" Windows:SD_service.bat Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\devldr23 = "C:\\Windows:SD_service.bat" Windows:SD_service.bat -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\britsl8ides.exe 8fe1972a8ab4e35c4e22c8ba51027d1e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\jpg.dll syscopt.exe File opened for modification C:\Windows\SysWOW64\zlib.dll Windows:SD_service.bat File opened for modification C:\Windows\SysWOW64\mswinsck.ocx Windows:SD_service.bat File created C:\Windows\SysWOW64\syscopt.exe 8fe1972a8ab4e35c4e22c8ba51027d1e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\zlib.dll syscopt.exe File opened for modification C:\Windows\SysWOW64\mswinsck.ocx syscopt.exe File opened for modification C:\Windows\SysWOW64\jpg.dll Windows:SD_service.bat File opened for modification C:\Windows\SysWOW64\syscopt.exe syscopt.exe -
resource yara_rule behavioral2/files/0x000c000000023b8c-4.dat upx behavioral2/memory/3340-16-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral2/files/0x000a000000023c73-32.dat upx behavioral2/memory/3340-34-0x0000000010000000-0x0000000010014000-memory.dmp upx behavioral2/memory/4576-49-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral2/memory/3340-53-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral2/memory/4576-59-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral2/memory/4576-61-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral2/memory/4576-63-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral2/memory/4576-65-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral2/memory/4576-67-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral2/memory/4576-69-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral2/memory/4576-71-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral2/memory/4576-73-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral2/memory/4576-75-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral2/memory/4576-77-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral2/memory/4576-79-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral2/memory/4576-81-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral2/memory/4576-83-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral2/memory/4576-85-0x0000000000400000-0x0000000000461000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windows:SD_service.bat Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8fe1972a8ab4e35c4e22c8ba51027d1e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language syscopt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language britsl8ides.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1\ = "132497" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\ = "Winsock General Property Page Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS\ = "2" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} regsvr32.exe -
NTFS ADS 3 IoCs
description ioc Process File created C:\Windows:SD_service.bat syscopt.exe File opened for modification C:\Windows:SD_service.bat Windows:SD_service.bat File opened for modification C:\Windows:SD_service.bat syscopt.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3340 syscopt.exe 3340 syscopt.exe 3340 syscopt.exe 3340 syscopt.exe 3340 syscopt.exe 3340 syscopt.exe 3340 syscopt.exe 3340 syscopt.exe 3340 syscopt.exe 3340 syscopt.exe 4576 Windows:SD_service.bat 4576 Windows:SD_service.bat 4576 Windows:SD_service.bat 4576 Windows:SD_service.bat 4576 Windows:SD_service.bat 4576 Windows:SD_service.bat 4576 Windows:SD_service.bat 4576 Windows:SD_service.bat 4576 Windows:SD_service.bat 4576 Windows:SD_service.bat -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3340 syscopt.exe 4576 Windows:SD_service.bat -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1888 wrote to memory of 3340 1888 8fe1972a8ab4e35c4e22c8ba51027d1e_JaffaCakes118.exe 84 PID 1888 wrote to memory of 3340 1888 8fe1972a8ab4e35c4e22c8ba51027d1e_JaffaCakes118.exe 84 PID 1888 wrote to memory of 3340 1888 8fe1972a8ab4e35c4e22c8ba51027d1e_JaffaCakes118.exe 84 PID 1888 wrote to memory of 2636 1888 8fe1972a8ab4e35c4e22c8ba51027d1e_JaffaCakes118.exe 85 PID 1888 wrote to memory of 2636 1888 8fe1972a8ab4e35c4e22c8ba51027d1e_JaffaCakes118.exe 85 PID 1888 wrote to memory of 2636 1888 8fe1972a8ab4e35c4e22c8ba51027d1e_JaffaCakes118.exe 85 PID 3340 wrote to memory of 2964 3340 syscopt.exe 88 PID 3340 wrote to memory of 2964 3340 syscopt.exe 88 PID 3340 wrote to memory of 2964 3340 syscopt.exe 88 PID 3340 wrote to memory of 2632 3340 syscopt.exe 90 PID 3340 wrote to memory of 2632 3340 syscopt.exe 90 PID 3340 wrote to memory of 2632 3340 syscopt.exe 90 PID 3340 wrote to memory of 4576 3340 syscopt.exe 91 PID 3340 wrote to memory of 4576 3340 syscopt.exe 91 PID 3340 wrote to memory of 4576 3340 syscopt.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fe1972a8ab4e35c4e22c8ba51027d1e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8fe1972a8ab4e35c4e22c8ba51027d1e_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\syscopt.exe"C:\Windows\System32\syscopt.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\system32\mswinsck.ocx"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2964
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\1.bat3⤵
- System Location Discovery: System Language Discovery
PID:2632
-
-
C:\Windows:SD_service.batC:\Windows:SD_service.bat3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4576
-
-
-
C:\Windows\SysWOW64\britsl8ides.exe"C:\Windows\System32\britsl8ides.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2636
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
103B
MD5bbfee53b377c2f0778ed7cad1d84b0f2
SHA14e5b842215e95be2af761d944d11b956dc033189
SHA256d4386e84a00a711cea9e6fbe258612ea06e768941dbacd38966d9795358e6792
SHA512a219f1168556278dc12207c5f61c8815f5c2d6c3278673005bbc964507132a587502a47c97196d441c3822b485eb6cd06315e2038e8d05f56833ee454a06a07b
-
Filesize
615KB
MD512f6a5f14f986001c46ba1444d49f909
SHA1b29defe13ea18ff4f3119b8d70ddcb8e339a8da5
SHA2560ea8be70067b7c47e829e5d7484c52baa7d28b0ff45f2009bbc054a819fa916c
SHA512fe2822ba4efa17c7a1e3ee64027c6310ca4a396186aa3ce8f0d420966a8da25fe9588e431bf7503a30e32a0bb15c08f31ef873e2a347e8e625b422419dc9b044
-
Filesize
51KB
MD54eda362e326609a0a80e2736b67607ab
SHA164aa572d16f7cd6e6bd2296f2c96ad1604c713d1
SHA256061e9f721af9a538dcfd96d13cb3deef1479b5785f566818c34c3faa585d650a
SHA512f23f6a5c362808aef98516dcf12e3eeefd8498c812c27f96820d7d086694641cb4eefc7970b4750a0e4a5a0be1f90ac8981fc2f028e7085d50bd44bd4880c51d
-
Filesize
105KB
MD59484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
-
Filesize
200KB
MD584e8f6bc491ee2039ce911609fb2dcf5
SHA1c91317db79d1e26f98b4f3f237098fac1d8223ba
SHA2563a3d9f280e89e375b2e2f28c80c20b87cd8827c330c6facb03991ef3f086927e
SHA51204233c9cf3cabfa9a2b1751f22182df1e8b75e16853d83e0fd6278bb4b697c6d0f6fcf1f3cd8b31caead0b2af768affb1b8c480192a0dc642fd500bd07801f3f
-
Filesize
27KB
MD5200d52d81e9b4b05fa58ce5fbe511dba
SHA1c0d809ee93816d87388ed4e7fd6fca93d70294d2
SHA256d4fe89dc2e7775f4ef0dfc70ed6999b8f09635326e05e08a274d464d1814c617
SHA5127b1df70d76855d65cf246051e7b9f7119720a695d41ace1eb00e45e93e6de80d083b953269166bdee7137dbd9f3e5681e36bb036f151cea383c10d82957f39c5