modiloader | 024afd4289044e96b3acecf2cf5419ab9d28754a4e8df05b3331d5d258795ace

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-12-2024 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e096a022d5932e00fc12caa25fc60725_JaffaCakes118.exe
Size

886KB
MD5

e096a022d5932e00fc12caa25fc60725
SHA1

297ec6b316fdca7a580bd3cde735e1a9a1ebe4d5
SHA256

024afd4289044e96b3acecf2cf5419ab9d28754a4e8df05b3331d5d258795ace
SHA512

12aaf6a504a7219ba6f1855b7e47c8e4c81e83e016285af5ffcc6849f01fdd5cbb0d872e1afb9984d193a201b9ee190142d6e5ee5b27e3d1c8ada27cfb61d5f0
SSDEEP

24576:vv4UxG7Ynif3t7GRqjEUm3fKXoIigYXSt:3n1sdaRqf3XcXSt

Score

10^/10

modiloader discovery evasion persistence themida trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 4 IoCs

resource	yara_rule
behavioral1/memory/2440-14-0x0000000020001000-0x0000000020003000-memory.dmp	modiloader_stage2
behavioral1/memory/2440-32-0x0000000020000000-0x00000000201A6000-memory.dmp	modiloader_stage2
behavioral1/memory/3036-43-0x0000000020000000-0x00000000201A6000-memory.dmp	modiloader_stage2
behavioral1/memory/2896-78-0x0000000020000000-0x00000000201A6000-memory.dmp	modiloader_stage2

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00060000000195c4-44.dat	acprotect

Executes dropped EXE 4 IoCs

pid	Process
2440	Server2.exe
2752	Server2.exe
2896	Server2.exe
1652	Server2.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine	Server2.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine	Server2.exe

Loads dropped DLL 16 IoCs

pid	Process
3036	e096a022d5932e00fc12caa25fc60725_JaffaCakes118.exe
3036	e096a022d5932e00fc12caa25fc60725_JaffaCakes118.exe
2440	Server2.exe
2440	Server2.exe
3036	e096a022d5932e00fc12caa25fc60725_JaffaCakes118.exe
2752	Server2.exe
3036	e096a022d5932e00fc12caa25fc60725_JaffaCakes118.exe
2752	Server2.exe
2752	Server2.exe
2896	Server2.exe
2752	Server2.exe
2896	Server2.exe
1652	Server2.exe
1652	Server2.exe
1652	Server2.exe
1652	Server2.exe

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x00080000000195c2-2.dat	themida
behavioral1/memory/3036-8-0x0000000020000000-0x00000000201A6000-memory.dmp	themida
behavioral1/memory/2440-32-0x0000000020000000-0x00000000201A6000-memory.dmp	themida
behavioral1/memory/2896-52-0x0000000020000000-0x00000000201A6000-memory.dmp	themida
behavioral1/memory/2896-78-0x0000000020000000-0x00000000201A6000-memory.dmp	themida

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e096a022d5932e00fc12caa25fc60725_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\Update = "C:\\WINDOWS\\SYSTEM32\\Server2.exe"	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\Update = "C:\\WINDOWS\\SYSTEM32\\Server2.exe"	Server2.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\MSWINSCK.OCX	Server2.exe
File opened for modification	C:\Windows\SysWOW64\Server2.exe	Server2.exe
File created	C:\Windows\SysWOW64\DIjpg.dll	Server2.exe
File opened for modification	C:\Windows\SysWOW64\MSWINSCK.OCX	Server2.exe
File created	C:\Windows\SysWOW64\MSWINSCK.OCX	Server2.exe
File opened for modification	C:\Windows\SysWOW64\Server2.exe	Server2.exe
File opened for modification	C:\Windows\SysWOW64\MSWINSCK.OCX	Server2.exe
File opened for modification	C:\Windows\SysWOW64\DIjpg.dll	Server2.exe
File created	C:\Windows\SysWOW64\Server2.exe	Server2.exe
File opened for modification	C:\Windows\SysWOW64\DIjpg.dll	Server2.exe
File created	C:\Windows\SysWOW64\DIjpg.dll	Server2.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2440	Server2.exe
2896	Server2.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2440 set thread context of 2752	2440	Server2.exe	31
PID 2896 set thread context of 1652	2896	Server2.exe	33

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2752-55-0x0000000010000000-0x000000001006B000-memory.dmp	upx
behavioral1/files/0x00060000000195c4-44.dat	upx
behavioral1/memory/1652-90-0x0000000010000000-0x000000001006B000-memory.dmp	upx
behavioral1/memory/1652-100-0x0000000010000000-0x000000001006B000-memory.dmp	upx
behavioral1/memory/2752-101-0x0000000010000000-0x000000001006B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e096a022d5932e00fc12caa25fc60725_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server2.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0"	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX"	Server2.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	Server2.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0"	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX, 1"	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0"	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX"	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock"	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1\ = "132497"	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	Server2.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR\	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0"	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX"	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}	Server2.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID	Server2.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version	Server2.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1\ = "132497"	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS\ = "2"	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX"	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment"	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment"	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	Server2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1	Server2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	Server2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2440	Server2.exe
2896	Server2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2752	Server2.exe
1652	Server2.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2440	3036	e096a022d5932e00fc12caa25fc60725_JaffaCakes118.exe	30
PID 3036 wrote to memory of 2440	3036	e096a022d5932e00fc12caa25fc60725_JaffaCakes118.exe	30
PID 3036 wrote to memory of 2440	3036	e096a022d5932e00fc12caa25fc60725_JaffaCakes118.exe	30
PID 3036 wrote to memory of 2440	3036	e096a022d5932e00fc12caa25fc60725_JaffaCakes118.exe	30
PID 3036 wrote to memory of 2440	3036	e096a022d5932e00fc12caa25fc60725_JaffaCakes118.exe	30
PID 3036 wrote to memory of 2440	3036	e096a022d5932e00fc12caa25fc60725_JaffaCakes118.exe	30
PID 3036 wrote to memory of 2440	3036	e096a022d5932e00fc12caa25fc60725_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2752	2440	Server2.exe	31
PID 2440 wrote to memory of 2752	2440	Server2.exe	31
PID 2440 wrote to memory of 2752	2440	Server2.exe	31
PID 2440 wrote to memory of 2752	2440	Server2.exe	31
PID 2440 wrote to memory of 2752	2440	Server2.exe	31
PID 2440 wrote to memory of 2752	2440	Server2.exe	31
PID 2440 wrote to memory of 2752	2440	Server2.exe	31
PID 2440 wrote to memory of 2752	2440	Server2.exe	31
PID 2440 wrote to memory of 2752	2440	Server2.exe	31
PID 3036 wrote to memory of 2896	3036	e096a022d5932e00fc12caa25fc60725_JaffaCakes118.exe	32
PID 3036 wrote to memory of 2896	3036	e096a022d5932e00fc12caa25fc60725_JaffaCakes118.exe	32
PID 3036 wrote to memory of 2896	3036	e096a022d5932e00fc12caa25fc60725_JaffaCakes118.exe	32
PID 3036 wrote to memory of 2896	3036	e096a022d5932e00fc12caa25fc60725_JaffaCakes118.exe	32
PID 3036 wrote to memory of 2896	3036	e096a022d5932e00fc12caa25fc60725_JaffaCakes118.exe	32
PID 3036 wrote to memory of 2896	3036	e096a022d5932e00fc12caa25fc60725_JaffaCakes118.exe	32
PID 3036 wrote to memory of 2896	3036	e096a022d5932e00fc12caa25fc60725_JaffaCakes118.exe	32
PID 2896 wrote to memory of 1652	2896	Server2.exe	33
PID 2896 wrote to memory of 1652	2896	Server2.exe	33
PID 2896 wrote to memory of 1652	2896	Server2.exe	33
PID 2896 wrote to memory of 1652	2896	Server2.exe	33
PID 2896 wrote to memory of 1652	2896	Server2.exe	33
PID 2896 wrote to memory of 1652	2896	Server2.exe	33
PID 2896 wrote to memory of 1652	2896	Server2.exe	33
PID 2896 wrote to memory of 1652	2896	Server2.exe	33
PID 2896 wrote to memory of 1652	2896	Server2.exe	33

C:\Users\Admin\AppData\Local\Temp\e096a022d5932e00fc12caa25fc60725_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e096a022d5932e00fc12caa25fc60725_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Server2.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Server2.exe
  2⤵
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Server2.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Server2.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:2752
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Server2.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Server2.exe
  2⤵
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Server2.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Server2.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\IXP000.TMP\Server2.exe

Filesize
834KB

MD5
a8d385347daaed294dbeb9129ab7bc5d

SHA1
49750012be4bf7d437393a1846be0016ac868a8e

SHA256
ed697e2b1ae5b9a5f93eb263ed52c68a0e745a6d5b5b3735762395963c62007e

SHA512
9eeddc8b7adc0fccb21effdbf844624d52716f61920de76bb737660f54d9c7da977e3fc7bd644e789779071eea6e99f1d618d9307f5ab601f5ad859d773075bb

Download Submit
\Windows\SysWOW64\DIjpg.dll

Filesize
92KB

MD5
4c6de95c11fd8357ad59ffb2a2d20d85

SHA1
ff1c781c04bab111b6133fe49c38c5b221861594

SHA256
a7135298ce1f9d4f84d70441ee0d3fb9aee7bf6e16e8cd336ef9be3a51fa6b96

SHA512
56b2cc356bdb5e6fb06d4e96439dbcf52409a5d2dc4c8219a7c0db5f5b8a667beffda18edd3245c68e7cf10234e29d5e4f3bc9d68e815769ed0e171c0113177c

Download Submit
\Windows\SysWOW64\MSWINSCK.OCX

Filesize
106KB

MD5
3d8fd62d17a44221e07d5c535950449b

SHA1
6c9d2ecdd7c2d1b9660d342e2b95a82229486d27

SHA256
eba048e3a9cb11671d0e3c5a0b243b304d421762361fe24fd5ea08cb66704b09

SHA512
501e22a0f99e18f6405356184506bc5849adc2c1df3bdee71f2b4514ab0e3e36673b4aecbd615d24ebb4be5a28570b2a6f80bd52331edb658f7a5f5a9d686d10

Download Submit
memory/1652-90-0x0000000010000000-0x000000001006B000-memory.dmp

Filesize
428KB

Download
memory/1652-100-0x0000000010000000-0x000000001006B000-memory.dmp

Filesize
428KB

Download
memory/1652-89-0x0000000000D10000-0x0000000000EB6000-memory.dmp

Filesize
1.6MB

Download
memory/2440-14-0x0000000020001000-0x0000000020003000-memory.dmp

Filesize
8KB

Download
memory/2440-32-0x0000000020000000-0x00000000201A6000-memory.dmp

Filesize
1.6MB

Download
memory/2440-13-0x0000000000930000-0x0000000000AD6000-memory.dmp

Filesize
1.6MB

Download
memory/2440-15-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/2752-50-0x0000000000C70000-0x0000000000E16000-memory.dmp

Filesize
1.6MB

Download
memory/2752-24-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2752-101-0x0000000010000000-0x000000001006B000-memory.dmp

Filesize
428KB

Download
memory/2752-39-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2752-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2752-27-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2752-97-0x0000000000C70000-0x0000000000E16000-memory.dmp

Filesize
1.6MB

Download
memory/2752-37-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2752-35-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2752-55-0x0000000010000000-0x000000001006B000-memory.dmp

Filesize
428KB

Download
memory/2896-53-0x0000000000A20000-0x0000000000BC6000-memory.dmp

Filesize
1.6MB

Download
memory/2896-78-0x0000000020000000-0x00000000201A6000-memory.dmp

Filesize
1.6MB

Download
memory/2896-52-0x0000000020000000-0x00000000201A6000-memory.dmp

Filesize
1.6MB

Download
memory/3036-8-0x0000000020000000-0x00000000201A6000-memory.dmp

Filesize
1.6MB

Download
memory/3036-9-0x0000000020000000-0x00000000201A6000-memory.dmp

Filesize
1.6MB

Download
memory/3036-43-0x0000000020000000-0x00000000201A6000-memory.dmp

Filesize
1.6MB

Download
memory/3036-54-0x0000000020000000-0x00000000201A6000-memory.dmp

Filesize
1.6MB

Download