modiloader | 840c182dfa32350922d1faa06df0aa41855bce36e4000aa739556e28ece9c298

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 07:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe
Size

1.5MB
MD5

1955a32a8984766ebaaa5aa3cb9d3be5
SHA1

af1db1824a039de18e6be79266a7528d3f566892
SHA256

840c182dfa32350922d1faa06df0aa41855bce36e4000aa739556e28ece9c298
SHA512

174e4052387c46497820496c091afeb8a1a228dae0480a09ed49109fbc676ae2b1b520db48aaaf101ff71b33ff0cf4a2fc54cad0604dd4ea824dd3d2fdeedbf5
SSDEEP

24576:4Jyta4AzyEYt2jmkKUeJy9fQ102LbcL8bmx5Fg3gcviZlZ2ApjZL3vEAdhNDQjTx:iwacEBNLa28bm6gcvKrjZLfEAdhNDQjl

Score

10^/10

modiloader evasion persistence themida trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

mstwain32.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

ModiLoader Second Stage 16 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\serve.exe	modiloader_stage2
behavioral1/memory/2496-23-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-39-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-43-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-47-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-51-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-55-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-59-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-63-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-67-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-71-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-75-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-79-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-83-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-87-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-91-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2

Disables RegEdit via registry modification 1 IoCs
evasion

Processes:

reg.exe

description ioc process

Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" reg.exe
Disables Task Manager via registry modification
evasion
Executes dropped EXE 2 IoCs

Processes:

serve.exemstwain32.exe

pid process

2496 serve.exe
2880 mstwain32.exe
Loads dropped DLL 3 IoCs

Processes:

1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exeserve.exe

pid process

1904 1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe
1904 1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe
2496 serve.exe
Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
themida

Processes:

resource yara_rule

behavioral1/memory/1904-35-0x0000000000400000-0x0000000000530000-memory.dmp themida
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

mstwain32.exe

description ioc process

Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

pid	process
2496	serve.exe
2880	mstwain32.exe

pid	process
1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe
1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe
2496	serve.exe

resource	yara_rule
behavioral1/memory/1904-35-0x0000000000400000-0x0000000000530000-memory.dmp	themida

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe"	mstwain32.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

serve.exemstwain32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	serve.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mstwain32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

Drops file in Windows directory 4 IoCs

Processes:

serve.exemstwain32.exe

description	ioc	process
File created	C:\Windows\mstwain32.exe	serve.exe
File opened for modification	C:\Windows\mstwain32.exe	serve.exe
File created	C:\Windows\ntdtcstp.dll	mstwain32.exe
File created	C:\Windows\cmsetac.dll	mstwain32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 10 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

pid process

1184 reg.exe
1548 reg.exe
1484 reg.exe
1812 reg.exe
2104 reg.exe
2808 reg.exe
2804 reg.exe
2436 reg.exe
2484 reg.exe
1504 reg.exe

pid	process
1184	reg.exe
1548	reg.exe
1484	reg.exe
1812	reg.exe
2104	reg.exe
2808	reg.exe
2804	reg.exe
2436	reg.exe
2484	reg.exe
1504	reg.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

serve.exemstwain32.exe1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exeDllHost.exe

description	pid	process
Token: SeDebugPrivilege	2496	serve.exe
Token: SeDebugPrivilege	2880	mstwain32.exe
Token: SeDebugPrivilege	2880	mstwain32.exe
Token: SeDebugPrivilege	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe
Token: SeDebugPrivilege	2588	DllHost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

2588 DllHost.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exemstwain32.exe

pid process

1904 1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe
2880 mstwain32.exe
2880 mstwain32.exe

pid	process
2588	DllHost.exe

pid	process
1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe
2880	mstwain32.exe
2880	mstwain32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.execmd.execmd.execmd.exeserve.execmd.execmd.exe

description	pid	process	target process
PID 1904 wrote to memory of 2496	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	serve.exe
PID 1904 wrote to memory of 2496	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	serve.exe
PID 1904 wrote to memory of 2496	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	serve.exe
PID 1904 wrote to memory of 2496	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	serve.exe
PID 1904 wrote to memory of 2616	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 2616	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 2616	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 2616	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 2592	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 2592	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 2592	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 2592	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 2464	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 2464	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 2464	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 2464	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 2820	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 2820	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 2820	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 2820	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 1940	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 1940	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 1940	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 1940	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 2616 wrote to memory of 2484	2616	cmd.exe	reg.exe
PID 2616 wrote to memory of 2484	2616	cmd.exe	reg.exe
PID 2616 wrote to memory of 2484	2616	cmd.exe	reg.exe
PID 2616 wrote to memory of 2484	2616	cmd.exe	reg.exe
PID 2592 wrote to memory of 2436	2592	cmd.exe	reg.exe
PID 2592 wrote to memory of 2436	2592	cmd.exe	reg.exe
PID 2592 wrote to memory of 2436	2592	cmd.exe	reg.exe
PID 2592 wrote to memory of 2436	2592	cmd.exe	reg.exe
PID 2464 wrote to memory of 2804	2464	cmd.exe	reg.exe
PID 2464 wrote to memory of 2804	2464	cmd.exe	reg.exe
PID 2464 wrote to memory of 2804	2464	cmd.exe	reg.exe
PID 2464 wrote to memory of 2804	2464	cmd.exe	reg.exe
PID 2496 wrote to memory of 2880	2496	serve.exe	mstwain32.exe
PID 2496 wrote to memory of 2880	2496	serve.exe	mstwain32.exe
PID 2496 wrote to memory of 2880	2496	serve.exe	mstwain32.exe
PID 2496 wrote to memory of 2880	2496	serve.exe	mstwain32.exe
PID 2820 wrote to memory of 1504	2820	cmd.exe	reg.exe
PID 2820 wrote to memory of 1504	2820	cmd.exe	reg.exe
PID 2820 wrote to memory of 1504	2820	cmd.exe	reg.exe
PID 2820 wrote to memory of 1504	2820	cmd.exe	reg.exe
PID 1940 wrote to memory of 1484	1940	cmd.exe	reg.exe
PID 1940 wrote to memory of 1484	1940	cmd.exe	reg.exe
PID 1940 wrote to memory of 1484	1940	cmd.exe	reg.exe
PID 1940 wrote to memory of 1484	1940	cmd.exe	reg.exe
PID 1904 wrote to memory of 1816	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 1816	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 1816	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 1816	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 888	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 888	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 888	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 888	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 1584	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 1584	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 1584	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 1584	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 1832	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 1832	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 1832	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 1832	1904	1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe	cmd.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

mstwain32.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

C:\Users\Admin\AppData\Local\Temp\1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1955a32a8984766ebaaa5aa3cb9d3be5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904

C:\Users\Admin\AppData\Local\Temp\serve.exe
"C:\Users\Admin\AppData\Local\Temp\serve.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2496

C:\Windows\mstwain32.exe
"C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\serve.exe"
3⤵
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2880

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1
2⤵
- Suspicious use of WriteProcessMemory
PID:2616

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1
3⤵
- Modifies registry key
PID:2484

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1
2⤵
- Suspicious use of WriteProcessMemory
PID:2592

C:\Windows\SysWOW64\reg.exe
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1
3⤵
- Modifies registry key
PID:2436

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1
2⤵
- Suspicious use of WriteProcessMemory
PID:2464

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1
3⤵
- Disables RegEdit via registry modification
- Modifies registry key
PID:2804

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1
2⤵
- Suspicious use of WriteProcessMemory
PID:2820

C:\Windows\SysWOW64\reg.exe
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1
3⤵
- Modifies registry key
PID:1504

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore /v DisableRegistryTools /t REG_DWORD /d 1
2⤵
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore /v DisableRegistryTools /t REG_DWORD /d 1
3⤵
- Modifies registry key
PID:1484

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1
2⤵
PID:1816

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1
3⤵
- Modifies registry key
PID:1812

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1
2⤵
PID:888

C:\Windows\SysWOW64\reg.exe
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1
3⤵
- Modifies registry key
PID:2104

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1
2⤵
PID:1584

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1
3⤵
- Modifies registry key
PID:2808

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1
2⤵
PID:1832

C:\Windows\SysWOW64\reg.exe
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1
3⤵
- Modifies registry key
PID:1548

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore /v DisableRegistryTools /t REG_DWORD /d 1
2⤵
PID:276

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore /v DisableRegistryTools /t REG_DWORD /d 1
3⤵
- Modifies registry key
PID:1184

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2588

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Trade.jpg
Filesize
3KB

MD5
145c3797ff9fc84b5e429395e7230c7f

SHA1
9cb93ebd61bf296d2857fc051a0e16915bd303a2

SHA256
b9a82c954e5004ef9fb98ad344087fe4c54bc7b68bc53107c0d54bfbdc52731b

SHA512
f1407e4ced7d9c3b40a01bcf2668baf0bfb34fc41d3af6647f2eae315fe4d462e4eae14e8f4d325ace269ef92915637c7fc569c49d9259ac5e473ec9ae164b24

Download Submit
C:\Windows\cmsetac.dll
Filesize
33KB

MD5
18b1798c02ed62e6632a9b0187e9f2ff

SHA1
41dab79982c21b81ea0a5acd83c93f9bd3bd8a46

SHA256
61334ad4cd264eba115209e91c4ad6fa11a6b5454e3d2e13a575f72ef0bb8ab4

SHA512
498c0a6b565b863278dd00aabb3719e146a7d2887dd8536432116c98e24a2b6948e3cc7c9139d53fe38a8dbeaeec96435d0ab022e3fc9b128ccf7013eb41802e

Download Submit
\Users\Admin\AppData\Local\Temp\serve.exe
Filesize
270KB

MD5
447b84a2afefb6f30a9b45ca3bdd4317

SHA1
6f1ce70b183a7141820f7890bb18c9f4584eac63

SHA256
fa9ef0844a677f3800b21c790bd561de08f1af6d4d4fc8dd141b9fee66abb16b

SHA512
c42992cb276084d546c8879fb2b40f115b18b88a6f9b8729eba738f0e7634abe2c992f8adeac8ff69ca693114d35af708fffb5d8eaf3b59d6fad1b49d902f35e

Download Submit
memory/1904-37-0x0000000000401000-0x0000000000407000-memory.dmp

Filesize
24KB

Download
memory/1904-1-0x0000000000530000-0x0000000000613000-memory.dmp

Filesize
908KB

Download
memory/1904-4-0x0000000000401000-0x0000000000407000-memory.dmp

Filesize
24KB

Download
memory/1904-0-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1904-31-0x0000000005640000-0x000000000564E000-memory.dmp

Filesize
56KB

Download
memory/1904-33-0x0000000005FC0000-0x0000000005FC2000-memory.dmp

Filesize
8KB

Download
memory/1904-36-0x0000000005640000-0x000000000564E000-memory.dmp

Filesize
56KB

Download
memory/1904-35-0x0000000000400000-0x0000000000530000-memory.dmp

Filesize
1.2MB

Download
memory/2496-23-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2588-42-0x0000000000140000-0x000000000014E000-memory.dmp

Filesize
56KB

Download
memory/2588-34-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/2588-32-0x0000000000140000-0x000000000014E000-memory.dmp

Filesize
56KB

Download
memory/2880-51-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2880-63-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2880-41-0x0000000000790000-0x000000000079E000-memory.dmp

Filesize
56KB

Download
memory/2880-40-0x0000000000270000-0x0000000000278000-memory.dmp

Filesize
32KB

Download
memory/2880-43-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2880-47-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2880-39-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2880-55-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2880-59-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2880-28-0x0000000000790000-0x000000000079E000-memory.dmp

Filesize
56KB

Download
memory/2880-67-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2880-71-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2880-75-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2880-79-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2880-83-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2880-87-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2880-91-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download