modiloader | 08e677ece4b8d365e3432d674b0dd79da5d06f124a6026081bd5387bd2b56d99

Analysis

max time kernel
150s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe
Size

844KB
MD5

1a5712df2cbbd760eebc329d48dd1fca
SHA1

717ffc7dfd9dfc5961d286efcc643e1551c63831
SHA256

08e677ece4b8d365e3432d674b0dd79da5d06f124a6026081bd5387bd2b56d99
SHA512

9b51882fc483c2f4bab576d79bd76e76d832ada8cefd3672689c17ebdaddf60093f20ec9866a36306a358ff1df017b33efc8cb01ae28ae50a3da08548f2cbe5e
SSDEEP

24576:fvX0CqJm7lpD2KXQztsFvKlH0jmr5WisTzjle5U5TIDV+DwLQk9Qd:3X05Jm7sAKF0GELm8IDVGqQV

Score

10^/10

modiloader evasion persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

srRTMxaDv9.exetioozit.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	srRTMxaDv9.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	tioozit.exe

ModiLoader Second Stage 2 IoCs

Processes:

resource yara_rule

C:\Users\Admin\amhost.exe modiloader_stage2
behavioral2/memory/2144-50-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2

resource	yara_rule
C:\Users\Admin\amhost.exe	modiloader_stage2
behavioral2/memory/2144-50-0x0000000000400000-0x0000000000417000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

srRTMxaDv9.exe1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	srRTMxaDv9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe

Executes dropped EXE 8 IoCs

Processes:

srRTMxaDv9.exeamhost.exetioozit.exeamhost.exebmhost.execmhost.exeXdmhost.exe

pid process

4712 srRTMxaDv9.exe
2144 amhost.exe
2792 tioozit.exe
3668 amhost.exe
1984 bmhost.exe
952 cmhost.exe
1112 X
3324 dmhost.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3668-45-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/3668-46-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/3668-51-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/3668-52-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/3668-53-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

tioozit.exesrRTMxaDv9.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /w"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /m"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /z"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /t"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /A"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /v"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /f"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /a"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /U"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /u"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /S"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /h"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /D"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /n"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /X"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /B"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /o"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /L"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /g"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /r"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /Y"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /l"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /k"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /Z"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /L"	srRTMxaDv9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /J"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /i"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /V"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /d"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /N"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /c"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /j"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /O"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /p"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /x"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /y"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /b"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /s"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /H"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /E"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /R"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /e"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /G"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /I"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /q"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /W"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /Q"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /C"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /F"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /T"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /P"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /K"	tioozit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tioozit = "C:\\Users\\Admin\\tioozit.exe /M"	tioozit.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

amhost.exebmhost.execmhost.exe

description	pid	process	target process
PID 2144 set thread context of 3668	2144	amhost.exe	amhost.exe
PID 1984 set thread context of 1788	1984	bmhost.exe	cmd.exe
PID 952 set thread context of 5052	952	cmhost.exe	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

4004 tasklist.exe
4676 tasklist.exe
Modifies registry class 1 IoCs

Processes:

explorer.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings explorer.exe

pid	process
4004	tasklist.exe
4676	tasklist.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

srRTMxaDv9.exeamhost.exetioozit.exeX

pid	process
4712	srRTMxaDv9.exe
4712	srRTMxaDv9.exe
4712	srRTMxaDv9.exe
4712	srRTMxaDv9.exe
3668	amhost.exe
3668	amhost.exe
2792	tioozit.exe
2792	tioozit.exe
2792	tioozit.exe
2792	tioozit.exe
2792	tioozit.exe
2792	tioozit.exe
3668	amhost.exe
3668	amhost.exe
2792	tioozit.exe
2792	tioozit.exe
1112	X
1112	X
2792	tioozit.exe
2792	tioozit.exe
2792	tioozit.exe
2792	tioozit.exe
2792	tioozit.exe
2792	tioozit.exe
2792	tioozit.exe
2792	tioozit.exe
3668	amhost.exe
3668	amhost.exe
2792	tioozit.exe
2792	tioozit.exe
3668	amhost.exe
3668	amhost.exe
3668	amhost.exe
3668	amhost.exe
2792	tioozit.exe
2792	tioozit.exe
2792	tioozit.exe
2792	tioozit.exe
2792	tioozit.exe
2792	tioozit.exe
3668	amhost.exe
3668	amhost.exe
2792	tioozit.exe
2792	tioozit.exe
3668	amhost.exe
3668	amhost.exe
3668	amhost.exe
3668	amhost.exe
2792	tioozit.exe
2792	tioozit.exe
2792	tioozit.exe
2792	tioozit.exe
2792	tioozit.exe
2792	tioozit.exe
3668	amhost.exe
3668	amhost.exe
3668	amhost.exe
3668	amhost.exe
2792	tioozit.exe
2792	tioozit.exe
3668	amhost.exe
3668	amhost.exe
2792	tioozit.exe
2792	tioozit.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

tasklist.exebmhost.execmhost.exetasklist.exe

description pid process

Token: SeDebugPrivilege 4004 tasklist.exe
Token: SeDebugPrivilege 1984 bmhost.exe
Token: SeDebugPrivilege 952 cmhost.exe
Token: SeDebugPrivilege 4676 tasklist.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exesrRTMxaDv9.exetioozit.exedmhost.exe

pid process

1368 1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe
4712 srRTMxaDv9.exe
2792 tioozit.exe
3324 dmhost.exe

description	pid	process
Token: SeDebugPrivilege	4004	tasklist.exe
Token: SeDebugPrivilege	1984	bmhost.exe
Token: SeDebugPrivilege	952	cmhost.exe
Token: SeDebugPrivilege	4676	tasklist.exe

pid	process
1368	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe
4712	srRTMxaDv9.exe
2792	tioozit.exe
3324	dmhost.exe

Suspicious use of WriteProcessMemory 51 IoCs

Processes:

1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exesrRTMxaDv9.execmd.exeamhost.exebmhost.execmhost.exeXcmd.exe

description	pid	process	target process
PID 1368 wrote to memory of 4712	1368	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	srRTMxaDv9.exe
PID 1368 wrote to memory of 4712	1368	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	srRTMxaDv9.exe
PID 1368 wrote to memory of 4712	1368	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	srRTMxaDv9.exe
PID 1368 wrote to memory of 2144	1368	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	amhost.exe
PID 1368 wrote to memory of 2144	1368	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	amhost.exe
PID 1368 wrote to memory of 2144	1368	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	amhost.exe
PID 4712 wrote to memory of 2792	4712	srRTMxaDv9.exe	tioozit.exe
PID 4712 wrote to memory of 2792	4712	srRTMxaDv9.exe	tioozit.exe
PID 4712 wrote to memory of 2792	4712	srRTMxaDv9.exe	tioozit.exe
PID 4712 wrote to memory of 1312	4712	srRTMxaDv9.exe	cmd.exe
PID 4712 wrote to memory of 1312	4712	srRTMxaDv9.exe	cmd.exe
PID 4712 wrote to memory of 1312	4712	srRTMxaDv9.exe	cmd.exe
PID 1312 wrote to memory of 4004	1312	cmd.exe	tasklist.exe
PID 1312 wrote to memory of 4004	1312	cmd.exe	tasklist.exe
PID 1312 wrote to memory of 4004	1312	cmd.exe	tasklist.exe
PID 2144 wrote to memory of 3668	2144	amhost.exe	amhost.exe
PID 2144 wrote to memory of 3668	2144	amhost.exe	amhost.exe
PID 2144 wrote to memory of 3668	2144	amhost.exe	amhost.exe
PID 2144 wrote to memory of 3668	2144	amhost.exe	amhost.exe
PID 2144 wrote to memory of 3668	2144	amhost.exe	amhost.exe
PID 2144 wrote to memory of 3668	2144	amhost.exe	amhost.exe
PID 2144 wrote to memory of 3668	2144	amhost.exe	amhost.exe
PID 2144 wrote to memory of 3668	2144	amhost.exe	amhost.exe
PID 1368 wrote to memory of 1984	1368	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	bmhost.exe
PID 1368 wrote to memory of 1984	1368	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	bmhost.exe
PID 1368 wrote to memory of 1984	1368	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	bmhost.exe
PID 1984 wrote to memory of 1788	1984	bmhost.exe	cmd.exe
PID 1984 wrote to memory of 1788	1984	bmhost.exe	cmd.exe
PID 1984 wrote to memory of 1788	1984	bmhost.exe	cmd.exe
PID 1984 wrote to memory of 1788	1984	bmhost.exe	cmd.exe
PID 1368 wrote to memory of 952	1368	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	cmhost.exe
PID 1368 wrote to memory of 952	1368	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	cmhost.exe
PID 1368 wrote to memory of 952	1368	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	cmhost.exe
PID 952 wrote to memory of 1112	952	cmhost.exe	X
PID 952 wrote to memory of 1112	952	cmhost.exe	X
PID 1112 wrote to memory of 2476	1112	X	explorer.exe
PID 1112 wrote to memory of 2476	1112	X	explorer.exe
PID 1112 wrote to memory of 2476	1112	X	explorer.exe
PID 952 wrote to memory of 5052	952	cmhost.exe	cmd.exe
PID 952 wrote to memory of 5052	952	cmhost.exe	cmd.exe
PID 952 wrote to memory of 5052	952	cmhost.exe	cmd.exe
PID 952 wrote to memory of 5052	952	cmhost.exe	cmd.exe
PID 1368 wrote to memory of 3324	1368	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	dmhost.exe
PID 1368 wrote to memory of 3324	1368	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	dmhost.exe
PID 1368 wrote to memory of 3324	1368	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	dmhost.exe
PID 1368 wrote to memory of 1604	1368	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	cmd.exe
PID 1368 wrote to memory of 1604	1368	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	cmd.exe
PID 1368 wrote to memory of 1604	1368	1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe	cmd.exe
PID 1604 wrote to memory of 4676	1604	cmd.exe	tasklist.exe
PID 1604 wrote to memory of 4676	1604	cmd.exe	tasklist.exe
PID 1604 wrote to memory of 4676	1604	cmd.exe	tasklist.exe

C:\Users\Admin\AppData\Local\Temp\1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368

C:\Users\Admin\srRTMxaDv9.exe
C:\Users\Admin\srRTMxaDv9.exe
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712

C:\Users\Admin\tioozit.exe
"C:\Users\Admin\tioozit.exe"
3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2792

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c tasklist&&del srRTMxaDv9.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\SysWOW64\tasklist.exe
tasklist
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4004

C:\Users\Admin\amhost.exe
C:\Users\Admin\amhost.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2144

C:\Users\Admin\amhost.exe
amhost.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3668

C:\Users\Admin\bmhost.exe
C:\Users\Admin\bmhost.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
PID:1788

C:\Users\Admin\cmhost.exe
C:\Users\Admin\cmhost.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952

C:\Users\Admin\AppData\Local\a1709a76\X
176.53.17.24:80
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1112

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
4⤵
- Modifies registry class
PID:2476

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
PID:5052

C:\Users\Admin\dmhost.exe
C:\Users\Admin\dmhost.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3324

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c tasklist&&del 1a5712df2cbbd760eebc329d48dd1fca_JaffaCakes118.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1604

C:\Windows\SysWOW64\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4676

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\a1709a76\X
Filesize
41KB

MD5
be40a2578e862f1cecc9b9194f524201

SHA1
0c379f375f9bcfab2e8d86161cec07fe4a7dbc12

SHA256
2c0f19272baa42d1af85a395fe8cd687c50e91450abc5911f6806c317a25b6a6

SHA512
25fbee1dce99c0ca80cd11bbe0d9fceaa07bf8a8b9b3ebc04e55645c0a733dafc83a7922975c31bc9fdff6f413257ac8b9ff72628c78b48a5b7ab669eab369f8

Download Submit
C:\Users\Admin\amhost.exe
Filesize
80KB

MD5
8ccbe4f27f9710f3e7f75e1d1de57e49

SHA1
272e95e476477cd4a1715ee0bcf32318e0351718

SHA256
3d36ee15c25b2308f8552e121d885c26b46b4e7fc6dbb41a684bec53e0ae3b5d

SHA512
334f56b5158839f521513aff9de334536c86da633bf1a3b78592529275457973ed67fd55a54bef8f88ce918c2863c365cababfbd0ef888a27272906e281105d0

Download Submit
C:\Users\Admin\bmhost.exe
Filesize
258KB

MD5
2da0070a7c50f3a078b73b4fb7ee7c02

SHA1
999b4860a80b908622fadfc8fae27db66b200932

SHA256
f8a0f1b5b3f320f01173f151305dc780eac51bf78e7405fd2c0b9b3ba58945bf

SHA512
2d488508e785d92c5cf9f0abee8153d984d8dd8f1d59880643764f499e151fccc9572a9ad1fe0a82412b8ed230d25bd849a0beeded12325dc21839ed53512630

Download Submit
C:\Users\Admin\cmhost.exe
Filesize
358KB

MD5
03102e4338eb16e0c4dfe106830557e3

SHA1
4fdb5baf0900e44e95acdeee1c947be3b0518b39

SHA256
7dd28bddc46daddc8f7e14906f50ef991d3d7f1ffb785388fb5c42be9e162139

SHA512
c7d4b4b3766c0b4cdc3d16f56effe1b36cacd4a48f728cf1a33360eb6c48362587186dc0be45f098cd3117bc10c7113d51262939bfe018c6f963b36d59cd97c9

Download Submit
C:\Users\Admin\dmhost.exe
Filesize
32KB

MD5
574970eca916740493590d746221fefb

SHA1
8b7665e18a767e836ce88d133bbdfe0a53db7406

SHA256
4cb837a6986e2c729dd0917eac6126341be207ad1f4b0a9a77260143e9c69fea

SHA512
aa5025ac8759dd5eba551c7d2a761f5b91f9629cb22e1a80546b8677382ba2643bfff8d4039f9462addebed311a88b644ab5f5155738bd68ecd1bb74a1fb12c2

Download Submit
C:\Users\Admin\srRTMxaDv9.exe
Filesize
344KB

MD5
57a5743f47b3a874773041195600909c

SHA1
74f5c16a6ca03baea7c684e40d351f1ec484a70d

SHA256
eecfb7541cf571d34882ebeb19c3c396ed53243e23060d45e1f1b033e061da90

SHA512
66c4621663db921b7a18b843197ea6611e9473abca6b2a653d1f228146129434a7f643f598e0fdfbe300f2ea91168135de59a69f02f52245c71f12e4364e2954

Download Submit
C:\Users\Admin\tioozit.exe
Filesize
344KB

MD5
d80aba8439d6c3a15158bdca632eb8b9

SHA1
70fdb3c6edd7712ca5f48daac2318b7be5e42dce

SHA256
148ee4880e0895ca4a59cc897983f2930e4c1768d6f611ec26bb69fcea2432ca

SHA512
949f9b80ba39b49fa862e00813e037dbe1b808c2f369bed43622c4fbe6cdb37b470c7c616941cef80d5b1163348008458715261c2e96694c57b465662360be70

Download Submit
memory/952-80-0x0000000000400000-0x0000000000465C48-memory.dmp

Filesize
407KB

Download
memory/952-73-0x0000000000400000-0x0000000000465C48-memory.dmp

Filesize
407KB

Download
memory/1984-57-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2144-50-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3668-46-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3668-53-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3668-52-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3668-51-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3668-45-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download