modiloader | 08e677ece4b8d365e3432d674b0dd79da5d06f124a6026081bd5387bd2b56d99

Analysis

max time kernel
150s
max time network
131s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe
Size

844KB
MD5

1a5712df2cbbd760eebc329d48dd1fca
SHA1

717ffc7dfd9dfc5961d286efcc643e1551c63831
SHA256

08e677ece4b8d365e3432d674b0dd79da5d06f124a6026081bd5387bd2b56d99
SHA512

9b51882fc483c2f4bab576d79bd76e76d832ada8cefd3672689c17ebdaddf60093f20ec9866a36306a358ff1df017b33efc8cb01ae28ae50a3da08548f2cbe5e
SSDEEP

24576:fvX0CqJm7lpD2KXQztsFvKlH0jmr5WisTzjle5U5TIDV+DwLQk9Qd:3X05Jm7sAKF0GELm8IDVGqQV

Score

10^/10

modiloader evasion persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\4f1bbd8f\\X"	Explorer.EXE

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

srRTMxaDv9.exewaounak.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	srRTMxaDv9.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	waounak.exe

ModiLoader Second Stage 2 IoCs

Processes:

resource yara_rule

\Users\Admin\amhost.exe modiloader_stage2
behavioral1/memory/2832-46-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1556 cmd.exe
Executes dropped EXE 10 IoCs

Processes:

srRTMxaDv9.exewaounak.exeamhost.exeamhost.exebmhost.execsrss.execmhost.exeXExplorer.EXEdmhost.exe

pid process

1412 srRTMxaDv9.exe
2696 waounak.exe
2832 amhost.exe
2512 amhost.exe
2436 bmhost.exe
336 csrss.exe
2012 cmhost.exe
2036 X
1356 Explorer.EXE
2468 dmhost.exe

resource	yara_rule
\Users\Admin\amhost.exe	modiloader_stage2
behavioral1/memory/2832-46-0x0000000000400000-0x0000000000417000-memory.dmp	modiloader_stage2

pid	process
1556	cmd.exe

Loads dropped DLL 16 IoCs

Processes:

1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exesrRTMxaDv9.execmhost.exeX

pid	process
2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe
2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe
1412	srRTMxaDv9.exe
1412	srRTMxaDv9.exe
2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe
2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe
2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe
2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe
2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe
2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe
2012	cmhost.exe
2012	cmhost.exe
2012	cmhost.exe
2036	X
2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe
2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2512-38-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2512-47-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2512-40-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2512-50-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2512-52-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2512-51-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

waounak.exesrRTMxaDv9.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /r"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /G"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /U"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /l"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /F"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /J"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /e"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /t"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /q"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /S"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /X"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /Z"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /h"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /m"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /T"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /I"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /p"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /P"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /K"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /M"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /b"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /u"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /V"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /Q"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /o"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /H"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /s"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /U"	srRTMxaDv9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /w"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /E"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /f"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /a"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /n"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /C"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /i"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /v"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /O"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /g"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /y"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /D"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /j"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /d"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /W"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /R"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /A"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /c"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /N"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /x"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /z"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /Y"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /B"	waounak.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\waounak = "C:\\Users\\Admin\\waounak.exe /k"	waounak.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

csrss.exe

description ioc process

File created \systemroot\assembly\GAC_64\Desktop.ini csrss.exe
File created \systemroot\assembly\GAC_32\Desktop.ini csrss.exe

description	ioc	process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

amhost.exebmhost.execmhost.exe

description	pid	process	target process
PID 2832 set thread context of 2512	2832	amhost.exe	amhost.exe
PID 2436 set thread context of 1100	2436	bmhost.exe	cmd.exe
PID 2012 set thread context of 2916	2012	cmhost.exe	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

1124 tasklist.exe
2888 tasklist.exe

pid	process
1124	tasklist.exe
2888	tasklist.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

srRTMxaDv9.exeamhost.exewaounak.exebmhost.exeX

pid	process
1412	srRTMxaDv9.exe
1412	srRTMxaDv9.exe
2512	amhost.exe
2696	waounak.exe
2436	bmhost.exe
2436	bmhost.exe
2436	bmhost.exe
2436	bmhost.exe
2696	waounak.exe
2696	waounak.exe
2036	X
2696	waounak.exe
2512	amhost.exe
2696	waounak.exe
2696	waounak.exe
2696	waounak.exe
2696	waounak.exe
2512	amhost.exe
2512	amhost.exe
2512	amhost.exe
2696	waounak.exe
2696	waounak.exe
2696	waounak.exe
2512	amhost.exe
2696	waounak.exe
2512	amhost.exe
2696	waounak.exe
2512	amhost.exe
2696	waounak.exe
2696	waounak.exe
2512	amhost.exe
2696	waounak.exe
2512	amhost.exe
2696	waounak.exe
2512	amhost.exe
2512	amhost.exe
2512	amhost.exe
2696	waounak.exe
2696	waounak.exe
2512	amhost.exe
2696	waounak.exe
2512	amhost.exe
2512	amhost.exe
2696	waounak.exe
2696	waounak.exe
2512	amhost.exe
2512	amhost.exe
2696	waounak.exe
2512	amhost.exe
2512	amhost.exe
2696	waounak.exe
2512	amhost.exe
2696	waounak.exe
2696	waounak.exe
2512	amhost.exe
2512	amhost.exe
2696	waounak.exe
2512	amhost.exe
2512	amhost.exe
2512	amhost.exe
2696	waounak.exe
2512	amhost.exe
2696	waounak.exe
2696	waounak.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

tasklist.exebmhost.exetasklist.exe

description pid process

Token: SeDebugPrivilege 2888 tasklist.exe
Token: SeDebugPrivilege 2436 bmhost.exe
Token: SeDebugPrivilege 2436 bmhost.exe
Token: SeDebugPrivilege 1124 tasklist.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1356 Explorer.EXE
1356 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1356 Explorer.EXE
1356 Explorer.EXE
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exesrRTMxaDv9.exewaounak.exedmhost.exe

pid process

2952 1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe
1412 srRTMxaDv9.exe
2696 waounak.exe
2468 dmhost.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

csrss.exe

pid process

336 csrss.exe

description	pid	process
Token: SeDebugPrivilege	2888	tasklist.exe
Token: SeDebugPrivilege	2436	bmhost.exe
Token: SeDebugPrivilege	2436	bmhost.exe
Token: SeDebugPrivilege	1124	tasklist.exe

pid	process
1356	Explorer.EXE
1356	Explorer.EXE

pid	process
1356	Explorer.EXE
1356	Explorer.EXE

pid	process
336	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exesrRTMxaDv9.execmd.exeamhost.exebmhost.execmhost.exeXcsrss.exe

description	pid	process	target process
PID 2952 wrote to memory of 1412	2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	srRTMxaDv9.exe
PID 2952 wrote to memory of 1412	2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	srRTMxaDv9.exe
PID 2952 wrote to memory of 1412	2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	srRTMxaDv9.exe
PID 2952 wrote to memory of 1412	2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	srRTMxaDv9.exe
PID 1412 wrote to memory of 2696	1412	srRTMxaDv9.exe	waounak.exe
PID 1412 wrote to memory of 2696	1412	srRTMxaDv9.exe	waounak.exe
PID 1412 wrote to memory of 2696	1412	srRTMxaDv9.exe	waounak.exe
PID 1412 wrote to memory of 2696	1412	srRTMxaDv9.exe	waounak.exe
PID 1412 wrote to memory of 2664	1412	srRTMxaDv9.exe	cmd.exe
PID 1412 wrote to memory of 2664	1412	srRTMxaDv9.exe	cmd.exe
PID 1412 wrote to memory of 2664	1412	srRTMxaDv9.exe	cmd.exe
PID 1412 wrote to memory of 2664	1412	srRTMxaDv9.exe	cmd.exe
PID 2664 wrote to memory of 2888	2664	cmd.exe	tasklist.exe
PID 2664 wrote to memory of 2888	2664	cmd.exe	tasklist.exe
PID 2664 wrote to memory of 2888	2664	cmd.exe	tasklist.exe
PID 2664 wrote to memory of 2888	2664	cmd.exe	tasklist.exe
PID 2952 wrote to memory of 2832	2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	amhost.exe
PID 2952 wrote to memory of 2832	2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	amhost.exe
PID 2952 wrote to memory of 2832	2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	amhost.exe
PID 2952 wrote to memory of 2832	2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	amhost.exe
PID 2832 wrote to memory of 2512	2832	amhost.exe	amhost.exe
PID 2832 wrote to memory of 2512	2832	amhost.exe	amhost.exe
PID 2832 wrote to memory of 2512	2832	amhost.exe	amhost.exe
PID 2832 wrote to memory of 2512	2832	amhost.exe	amhost.exe
PID 2832 wrote to memory of 2512	2832	amhost.exe	amhost.exe
PID 2832 wrote to memory of 2512	2832	amhost.exe	amhost.exe
PID 2832 wrote to memory of 2512	2832	amhost.exe	amhost.exe
PID 2832 wrote to memory of 2512	2832	amhost.exe	amhost.exe
PID 2952 wrote to memory of 2436	2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	bmhost.exe
PID 2952 wrote to memory of 2436	2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	bmhost.exe
PID 2952 wrote to memory of 2436	2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	bmhost.exe
PID 2952 wrote to memory of 2436	2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	bmhost.exe
PID 2436 wrote to memory of 1356	2436	bmhost.exe	Explorer.EXE
PID 2436 wrote to memory of 336	2436	bmhost.exe	csrss.exe
PID 2436 wrote to memory of 1100	2436	bmhost.exe	cmd.exe
PID 2436 wrote to memory of 1100	2436	bmhost.exe	cmd.exe
PID 2436 wrote to memory of 1100	2436	bmhost.exe	cmd.exe
PID 2436 wrote to memory of 1100	2436	bmhost.exe	cmd.exe
PID 2436 wrote to memory of 1100	2436	bmhost.exe	cmd.exe
PID 2952 wrote to memory of 2012	2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	cmhost.exe
PID 2952 wrote to memory of 2012	2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	cmhost.exe
PID 2952 wrote to memory of 2012	2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	cmhost.exe
PID 2952 wrote to memory of 2012	2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	cmhost.exe
PID 2012 wrote to memory of 2036	2012	cmhost.exe	X
PID 2012 wrote to memory of 2036	2012	cmhost.exe	X
PID 2012 wrote to memory of 2036	2012	cmhost.exe	X
PID 2012 wrote to memory of 2036	2012	cmhost.exe	X
PID 2036 wrote to memory of 1356	2036	X	Explorer.EXE
PID 2012 wrote to memory of 2916	2012	cmhost.exe	cmd.exe
PID 2012 wrote to memory of 2916	2012	cmhost.exe	cmd.exe
PID 2012 wrote to memory of 2916	2012	cmhost.exe	cmd.exe
PID 2012 wrote to memory of 2916	2012	cmhost.exe	cmd.exe
PID 2012 wrote to memory of 2916	2012	cmhost.exe	cmd.exe
PID 2952 wrote to memory of 2468	2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	dmhost.exe
PID 2952 wrote to memory of 2468	2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	dmhost.exe
PID 2952 wrote to memory of 2468	2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	dmhost.exe
PID 2952 wrote to memory of 2468	2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	dmhost.exe
PID 336 wrote to memory of 896	336	csrss.exe	WMIADAP.EXE
PID 336 wrote to memory of 896	336	csrss.exe	WMIADAP.EXE
PID 336 wrote to memory of 1532	336	csrss.exe	wmiprvse.exe
PID 336 wrote to memory of 1532	336	csrss.exe	wmiprvse.exe
PID 2952 wrote to memory of 1556	2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	cmd.exe
PID 2952 wrote to memory of 1556	2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	cmd.exe
PID 2952 wrote to memory of 1556	2952	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	cmd.exe

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:848

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
2⤵
PID:896

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1356

C:\Users\Admin\AppData\Local\Temp\1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952

C:\Users\Admin\srRTMxaDv9.exe
C:\Users\Admin\srRTMxaDv9.exe
3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1412

C:\Users\Admin\waounak.exe
"C:\Users\Admin\waounak.exe"
4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2696

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c tasklist&&del srRTMxaDv9.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:2664

C:\Windows\SysWOW64\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2888

C:\Users\Admin\amhost.exe
C:\Users\Admin\amhost.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2832

C:\Users\Admin\amhost.exe
amhost.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2512

C:\Users\Admin\bmhost.exe
C:\Users\Admin\bmhost.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2436

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
4⤵
PID:1100

C:\Users\Admin\cmhost.exe
C:\Users\Admin\cmhost.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2012

C:\Users\Admin\AppData\Local\4f1bbd8f\X
176.53.17.24:80
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
4⤵
PID:2916

C:\Users\Admin\dmhost.exe
C:\Users\Admin\dmhost.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2468

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c tasklist&&del 1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe
3⤵
- Deletes itself
PID:1556

C:\Windows\SysWOW64\tasklist.exe
tasklist
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1124

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:1532

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\4f1bbd8f\@
Filesize
2KB

MD5
f5e66a93bc297ba83db0e7b5564ced3f

SHA1
863c519546cfba7531b8ecbf10ae5bede6d2193d

SHA256
94257ae4c040d8487cb44bc23030193944c72c12678dcd8b80684a3721b21231

SHA512
b7ee82bdc3057df90eed61a9d0d6d52420fb8baf6cc8f12f30144ecdd1f298f13d89e14bfa474ea939bd734440f185d7bba72d1140080a3ef975253191adaea3

Download Submit
C:\Windows\system32\consrv.dll
Filesize
53KB

MD5
4d7cde615a0f534bd5e359951829554b

SHA1
c885d00d9000f2a5dbc78f6193a052b36f4fe968

SHA256
414fdf9bdcae5136c1295d6d24740c50a484acd81f1f7d0fb5d5c138607cb80a

SHA512
33d632f9fbb694440a1ca568c90518784278efd1dc9ee2b57028149d56ebe1f7346d5b59dcfafee2eeaa10091dda05f48958e909d6bfc891e037ae1cfbd048d4

Download Submit
\??\globalroot\systemroot\assembly\temp\@
Filesize
2KB

MD5
754d8c519e8559614a8c2c7fd32ca7c2

SHA1
d80c54215877235ecd7e01faede76a6ed8487e9b

SHA256
d4c2f644b97bd21ba5a104b7ed7d7c6d442e5a35f51175369cced4edb5bf1134

SHA512
8fb8e201577108d11e28548efd45235b00603ff3d861b7f3f32bf251dcd89c64180e0515ca50c3a0e60dbc705f4ca1c301873bd23ffdceefe8a2d38ccaaff9f7

Download Submit
\Users\Admin\AppData\Local\4f1bbd8f\X
Filesize
41KB

MD5
be40a2578e862f1cecc9b9194f524201

SHA1
0c379f375f9bcfab2e8d86161cec07fe4a7dbc12

SHA256
2c0f19272baa42d1af85a395fe8cd687c50e91450abc5911f6806c317a25b6a6

SHA512
25fbee1dce99c0ca80cd11bbe0d9fceaa07bf8a8b9b3ebc04e55645c0a733dafc83a7922975c31bc9fdff6f413257ac8b9ff72628c78b48a5b7ab669eab369f8

Download Submit
\Users\Admin\amhost.exe
Filesize
80KB

MD5
8ccbe4f27f9710f3e7f75e1d1de57e49

SHA1
272e95e476477cd4a1715ee0bcf32318e0351718

SHA256
3d36ee15c25b2308f8552e121d885c26b46b4e7fc6dbb41a684bec53e0ae3b5d

SHA512
334f56b5158839f521513aff9de334536c86da633bf1a3b78592529275457973ed67fd55a54bef8f88ce918c2863c365cababfbd0ef888a27272906e281105d0

Download Submit
\Users\Admin\bmhost.exe
Filesize
258KB

MD5
2da0070a7c50f3a078b73b4fb7ee7c02

SHA1
999b4860a80b908622fadfc8fae27db66b200932

SHA256
f8a0f1b5b3f320f01173f151305dc780eac51bf78e7405fd2c0b9b3ba58945bf

SHA512
2d488508e785d92c5cf9f0abee8153d984d8dd8f1d59880643764f499e151fccc9572a9ad1fe0a82412b8ed230d25bd849a0beeded12325dc21839ed53512630

Download Submit
\Users\Admin\cmhost.exe
Filesize
358KB

MD5
03102e4338eb16e0c4dfe106830557e3

SHA1
4fdb5baf0900e44e95acdeee1c947be3b0518b39

SHA256
7dd28bddc46daddc8f7e14906f50ef991d3d7f1ffb785388fb5c42be9e162139

SHA512
c7d4b4b3766c0b4cdc3d16f56effe1b36cacd4a48f728cf1a33360eb6c48362587186dc0be45f098cd3117bc10c7113d51262939bfe018c6f963b36d59cd97c9

Download Submit
\Users\Admin\dmhost.exe
Filesize
32KB

MD5
574970eca916740493590d746221fefb

SHA1
8b7665e18a767e836ce88d133bbdfe0a53db7406

SHA256
4cb837a6986e2c729dd0917eac6126341be207ad1f4b0a9a77260143e9c69fea

SHA512
aa5025ac8759dd5eba551c7d2a761f5b91f9629cb22e1a80546b8677382ba2643bfff8d4039f9462addebed311a88b644ab5f5155738bd68ecd1bb74a1fb12c2

Download Submit
\Users\Admin\srRTMxaDv9.exe
Filesize
344KB

MD5
57a5743f47b3a874773041195600909c

SHA1
74f5c16a6ca03baea7c684e40d351f1ec484a70d

SHA256
eecfb7541cf571d34882ebeb19c3c396ed53243e23060d45e1f1b033e061da90

SHA512
66c4621663db921b7a18b843197ea6611e9473abca6b2a653d1f228146129434a7f643f598e0fdfbe300f2ea91168135de59a69f02f52245c71f12e4364e2954

Download Submit
\Users\Admin\waounak.exe
Filesize
344KB

MD5
a0af76bc3255b2f4d609b59728dc60f2

SHA1
d40a9fd1002f35f002262fe1c3d3da20e129befd

SHA256
237e26916d2d71f720e065a9d1233693e873a53da799a615c732562d15698559

SHA512
bcb9f7c8ec3714c85c98e80fd4a11e50fc49abfc36fee645388acc4d3ab19678045b4e82932d3a94af1d777d0c1cd260422077b0cf80ca8763175d76f9e88228

Download Submit
\Windows\assembly\GAC_32\Desktop.ini
Filesize
4KB

MD5
878f9b6da85cb98fcbdf6abd1730a32f

SHA1
343007e658ea541f4680b4edf4513e69e1cc18a6

SHA256
75b5a460ed6f47fca8ec1bcd8a11b22f24fb33de4d5f307b851ad20c7f831b7d

SHA512
5425844e34ad5e717b08830020526f5c9465f654f3e9e29967b2983d5cb8dc225be2b89cd29a8e4cc99fcfc99e05556f66eefa0539283ab4569e603413a37293

Download Submit
\Windows\assembly\GAC_64\Desktop.ini
Filesize
5KB

MD5
9d7ec1e355ac35cbe6991721ef5ae3b8

SHA1
c35a00bd35c6e4a7516b93947be08ead966347e8

SHA256
68a3cec42215323100398a8eb2cbb37da7d58fe0fa9c6312e954e0f50a95ca98

SHA512
b7c4be28d8e179974672205a50e72fa1ec9e2e8170b3b8ee763e1751a3397c35afec7a72c88f0a79a8566749b2af1ff054660a96c3a6d6508c545d316a035dc0

Download Submit
memory/336-87-0x0000000000E50000-0x0000000000E62000-memory.dmp

Filesize
72KB

Download
memory/1356-81-0x0000000002A10000-0x0000000002A16000-memory.dmp

Filesize
24KB

Download
memory/1356-112-0x0000000002A30000-0x0000000002A3B000-memory.dmp

Filesize
44KB

Download
memory/1356-121-0x0000000002A40000-0x0000000002A4B000-memory.dmp

Filesize
44KB

Download
memory/1356-115-0x0000000002A30000-0x0000000002A3B000-memory.dmp

Filesize
44KB

Download
memory/1356-120-0x0000000002A30000-0x0000000002A3B000-memory.dmp

Filesize
44KB

Download
memory/1356-73-0x0000000002A10000-0x0000000002A16000-memory.dmp

Filesize
24KB

Download
memory/1356-77-0x0000000002A10000-0x0000000002A16000-memory.dmp

Filesize
24KB

Download
memory/2012-128-0x0000000000400000-0x0000000000465C48-memory.dmp

Filesize
407KB

Download
memory/2012-135-0x0000000000400000-0x0000000000465C48-memory.dmp

Filesize
407KB

Download
memory/2436-64-0x0000000000450000-0x0000000000491000-memory.dmp

Filesize
260KB

Download
memory/2436-60-0x0000000000450000-0x0000000000491000-memory.dmp

Filesize
260KB

Download
memory/2436-91-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2436-72-0x0000000000450000-0x0000000000491000-memory.dmp

Filesize
260KB

Download
memory/2436-69-0x0000000000450000-0x0000000000491000-memory.dmp

Filesize
260KB

Download
memory/2436-68-0x0000000000450000-0x0000000000491000-memory.dmp

Filesize
260KB

Download
memory/2436-70-0x0000000000450000-0x0000000000491000-memory.dmp

Filesize
260KB

Download
memory/2512-43-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2512-40-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2512-52-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2512-47-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2512-51-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2512-50-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2512-38-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2512-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2832-46-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download