modiloader | d068ddf6ff4faff8822138c9245dd178663669be5a0243483b837ce5728e0fb8

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 08:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe
Size

856KB
MD5

1aa33e05b3da44a1137af63cb38b0c8b
SHA1

dd209ca1e39ba994cc317b04ae04b8abfba0e903
SHA256

d068ddf6ff4faff8822138c9245dd178663669be5a0243483b837ce5728e0fb8
SHA512

be55c66797d182cb6538b585e20351b25ad0d414d272506ba087e8f2159f334093a90cfb414641dd6c823116b1790818dfed32e87059175299d3b5f726d2c1de
SSDEEP

12288:cJjCWhgzbBG8PtV9m2YkA4UrCuMtfQBSo7n4fUT2a6A2QeTF0XhMdUyGtd:cJmmgPpPikA43xsr4Y2a6A2nChuUr

Score

10^/10

modiloader evasion persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

HM23Yh.exefhdion.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	HM23Yh.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	fhdion.exe

ModiLoader Second Stage 9 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3532-6-0x0000000000400000-0x0000000000420000-memory.dmp	modiloader_stage2
behavioral2/memory/2316-7-0x0000000000400000-0x000000000052D000-memory.dmp	modiloader_stage2
behavioral2/memory/2316-9-0x0000000000400000-0x000000000052D000-memory.dmp	modiloader_stage2
C:\Users\Admin\awhost.exe	modiloader_stage2
behavioral2/memory/3788-61-0x0000000000400000-0x000000000041F000-memory.dmp	modiloader_stage2
C:\Users\Admin\bwhost.exe	modiloader_stage2
behavioral2/memory/2316-75-0x0000000000400000-0x000000000052D000-memory.dmp	modiloader_stage2
behavioral2/memory/2832-71-0x0000000000400000-0x000000000041F000-memory.dmp	modiloader_stage2
behavioral2/memory/2316-118-0x0000000000400000-0x000000000052D000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exeHM23Yh.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	HM23Yh.exe

Executes dropped EXE 10 IoCs

Processes:

HM23Yh.exefhdion.exeawhost.exeawhost.exebwhost.exebwhost.execwhost.exedwhost.exeXewhost.exe

pid process

948 HM23Yh.exe
4624 fhdion.exe
3788 awhost.exe
3328 awhost.exe
2832 bwhost.exe
2296 bwhost.exe
4196 cwhost.exe
1668 dwhost.exe
3028 X
2412 ewhost.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2316-0-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/2316-5-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/2316-1-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/2316-7-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/2316-9-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/2296-67-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/2296-68-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/2296-74-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/2296-76-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/2296-73-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/2316-75-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/2316-118-0x0000000000400000-0x000000000052D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

HM23Yh.exefhdion.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /I"	HM23Yh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /i"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /Q"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /g"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /y"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /W"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /w"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /j"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /c"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /O"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /h"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /u"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /D"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /d"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /A"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /s"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /t"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /p"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /k"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /L"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /q"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /S"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /Y"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /n"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /e"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /G"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /l"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /N"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /a"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /b"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /J"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /f"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /H"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /C"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /V"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /R"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /K"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /T"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /m"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /I"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /o"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /U"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /x"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /X"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /E"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /v"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /M"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /F"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /P"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /Z"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /z"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /B"	fhdion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fhdion = "C:\\Users\\Admin\\fhdion.exe /r"	fhdion.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

awhost.exebwhost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	awhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	awhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	bwhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	bwhost.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exeawhost.exebwhost.exedwhost.exe

description	pid	process	target process
PID 3532 set thread context of 2316	3532	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe
PID 3788 set thread context of 3328	3788	awhost.exe	awhost.exe
PID 2832 set thread context of 2296	2832	bwhost.exe	bwhost.exe
PID 1668 set thread context of 2164	1668	dwhost.exe	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

3216 tasklist.exe
2004 tasklist.exe

pid	process
3216	tasklist.exe
2004	tasklist.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

HM23Yh.exefhdion.exeawhost.exebwhost.exeX

pid	process
948	HM23Yh.exe
948	HM23Yh.exe
948	HM23Yh.exe
948	HM23Yh.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
3328	awhost.exe
3328	awhost.exe
3328	awhost.exe
3328	awhost.exe
3328	awhost.exe
3328	awhost.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
2296	bwhost.exe
4624	fhdion.exe
2296	bwhost.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
3028	X
3028	X
3328	awhost.exe
3328	awhost.exe
3328	awhost.exe
3328	awhost.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
3328	awhost.exe
3328	awhost.exe
3328	awhost.exe
3328	awhost.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe
4624	fhdion.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

tasklist.exedwhost.exeExplorer.EXEtasklist.exe

description	pid	process
Token: SeDebugPrivilege	3216	tasklist.exe
Token: SeDebugPrivilege	1668	dwhost.exe
Token: SeShutdownPrivilege	3544	Explorer.EXE
Token: SeCreatePagefilePrivilege	3544	Explorer.EXE
Token: SeShutdownPrivilege	3544	Explorer.EXE
Token: SeCreatePagefilePrivilege	3544	Explorer.EXE
Token: SeDebugPrivilege	2004	tasklist.exe
Token: SeShutdownPrivilege	3544	Explorer.EXE
Token: SeCreatePagefilePrivilege	3544	Explorer.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exeHM23Yh.exefhdion.exeewhost.exe

pid process

2316 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe
948 HM23Yh.exe
4624 fhdion.exe
2412 ewhost.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3544 Explorer.EXE

pid	process
2316	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe
948	HM23Yh.exe
4624	fhdion.exe
2412	ewhost.exe

pid	process
3544	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exeHM23Yh.execmd.exeawhost.exebwhost.execwhost.exedwhost.exeX

description	pid	process	target process
PID 3532 wrote to memory of 2316	3532	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe
PID 3532 wrote to memory of 2316	3532	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe
PID 3532 wrote to memory of 2316	3532	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe
PID 3532 wrote to memory of 2316	3532	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe
PID 3532 wrote to memory of 2316	3532	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe
PID 3532 wrote to memory of 2316	3532	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe
PID 3532 wrote to memory of 2316	3532	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe
PID 3532 wrote to memory of 2316	3532	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe
PID 3532 wrote to memory of 2316	3532	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe
PID 2316 wrote to memory of 948	2316	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	HM23Yh.exe
PID 2316 wrote to memory of 948	2316	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	HM23Yh.exe
PID 2316 wrote to memory of 948	2316	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	HM23Yh.exe
PID 948 wrote to memory of 4624	948	HM23Yh.exe	fhdion.exe
PID 948 wrote to memory of 4624	948	HM23Yh.exe	fhdion.exe
PID 948 wrote to memory of 4624	948	HM23Yh.exe	fhdion.exe
PID 948 wrote to memory of 3604	948	HM23Yh.exe	cmd.exe
PID 948 wrote to memory of 3604	948	HM23Yh.exe	cmd.exe
PID 948 wrote to memory of 3604	948	HM23Yh.exe	cmd.exe
PID 3604 wrote to memory of 3216	3604	cmd.exe	tasklist.exe
PID 3604 wrote to memory of 3216	3604	cmd.exe	tasklist.exe
PID 3604 wrote to memory of 3216	3604	cmd.exe	tasklist.exe
PID 2316 wrote to memory of 3788	2316	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	awhost.exe
PID 2316 wrote to memory of 3788	2316	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	awhost.exe
PID 2316 wrote to memory of 3788	2316	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	awhost.exe
PID 3788 wrote to memory of 3328	3788	awhost.exe	awhost.exe
PID 3788 wrote to memory of 3328	3788	awhost.exe	awhost.exe
PID 3788 wrote to memory of 3328	3788	awhost.exe	awhost.exe
PID 3788 wrote to memory of 3328	3788	awhost.exe	awhost.exe
PID 3788 wrote to memory of 3328	3788	awhost.exe	awhost.exe
PID 3788 wrote to memory of 3328	3788	awhost.exe	awhost.exe
PID 3788 wrote to memory of 3328	3788	awhost.exe	awhost.exe
PID 3788 wrote to memory of 3328	3788	awhost.exe	awhost.exe
PID 3788 wrote to memory of 3328	3788	awhost.exe	awhost.exe
PID 3788 wrote to memory of 3328	3788	awhost.exe	awhost.exe
PID 3788 wrote to memory of 3328	3788	awhost.exe	awhost.exe
PID 2316 wrote to memory of 2832	2316	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	bwhost.exe
PID 2316 wrote to memory of 2832	2316	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	bwhost.exe
PID 2316 wrote to memory of 2832	2316	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	bwhost.exe
PID 2832 wrote to memory of 2296	2832	bwhost.exe	bwhost.exe
PID 2832 wrote to memory of 2296	2832	bwhost.exe	bwhost.exe
PID 2832 wrote to memory of 2296	2832	bwhost.exe	bwhost.exe
PID 2832 wrote to memory of 2296	2832	bwhost.exe	bwhost.exe
PID 2832 wrote to memory of 2296	2832	bwhost.exe	bwhost.exe
PID 2832 wrote to memory of 2296	2832	bwhost.exe	bwhost.exe
PID 2832 wrote to memory of 2296	2832	bwhost.exe	bwhost.exe
PID 2832 wrote to memory of 2296	2832	bwhost.exe	bwhost.exe
PID 2832 wrote to memory of 2296	2832	bwhost.exe	bwhost.exe
PID 2316 wrote to memory of 4196	2316	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	cwhost.exe
PID 2316 wrote to memory of 4196	2316	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	cwhost.exe
PID 2316 wrote to memory of 4196	2316	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	cwhost.exe
PID 4196 wrote to memory of 4300	4196	cwhost.exe	explorer.exe
PID 4196 wrote to memory of 4300	4196	cwhost.exe	explorer.exe
PID 4196 wrote to memory of 4300	4196	cwhost.exe	explorer.exe
PID 4196 wrote to memory of 4300	4196	cwhost.exe	explorer.exe
PID 2316 wrote to memory of 1668	2316	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	dwhost.exe
PID 2316 wrote to memory of 1668	2316	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	dwhost.exe
PID 2316 wrote to memory of 1668	2316	1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe	dwhost.exe
PID 1668 wrote to memory of 3028	1668	dwhost.exe	X
PID 1668 wrote to memory of 3028	1668	dwhost.exe	X
PID 3028 wrote to memory of 3544	3028	X	Explorer.EXE
PID 1668 wrote to memory of 2164	1668	dwhost.exe	cmd.exe
PID 1668 wrote to memory of 2164	1668	dwhost.exe	cmd.exe
PID 1668 wrote to memory of 2164	1668	dwhost.exe	cmd.exe
PID 1668 wrote to memory of 2164	1668	dwhost.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3544

C:\Users\Admin\AppData\Local\Temp\1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3532

C:\Users\Admin\AppData\Local\Temp\1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe
1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe
3⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316

C:\Users\Admin\HM23Yh.exe
C:\Users\Admin\HM23Yh.exe
4⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948

C:\Users\Admin\fhdion.exe
"C:\Users\Admin\fhdion.exe"
5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4624

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c tasklist&&del HM23Yh.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:3604

C:\Windows\SysWOW64\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3216

C:\Users\Admin\awhost.exe
C:\Users\Admin\awhost.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3788

C:\Users\Admin\awhost.exe
awhost.exe
5⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:3328

C:\Users\Admin\bwhost.exe
C:\Users\Admin\bwhost.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2832

C:\Users\Admin\bwhost.exe
bwhost.exe
5⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:2296

C:\Users\Admin\cwhost.exe
C:\Users\Admin\cwhost.exe
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196

C:\Windows\explorer.exe
000001D8*
5⤵
PID:4300

C:\Users\Admin\dwhost.exe
C:\Users\Admin\dwhost.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668

C:\Users\Admin\AppData\Local\51367675\X
193.105.154.210:80
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3028

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
5⤵
PID:2164

C:\Users\Admin\ewhost.exe
C:\Users\Admin\ewhost.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2412

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c tasklist&&del 1aa33e05b3da44a1137af63cb38b0c8b_JaffaCakes118.exe
4⤵
PID:2632

C:\Windows\SysWOW64\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2004

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\51367675\X
Filesize
41KB

MD5
686b479b0ee164cf1744a8be359ebb7d

SHA1
8615e8f967276a85110b198d575982a958581a07

SHA256
fcfbb4c648649f4825b66504b261f912227ba32cbaabcadf4689020a83fb201b

SHA512
7ed8022e2b09f232150b77fc3a25269365b624f19f0b50c46a4fdf744eeb23294c09c051452c4c9dbb34a274f1a0bfc54b3ff1987ec16ae2e54848e22a97ed64

Download Submit
C:\Users\Admin\HM23Yh.exe
Filesize
224KB

MD5
b9204dce58a6e81de3b3306eb6cb03e5

SHA1
ceb777de961f82c42b9b71dca67b8e56a31908a3

SHA256
438f71f74c972c3ed35a21bbc93cbc8dd1fb3cf17fd789ae730e60e53816b472

SHA512
f555f397416efd33bf9591dd08ad27a4dfed1d26cbfb9d73dc4c3ae130da8ce254d4bfc1e70406f3c92565d28e045469b3ba3b172bd5d19c5876708bb1aa37ed

Download Submit
C:\Users\Admin\awhost.exe
Filesize
270KB

MD5
5efdb148d618a6b6d2369fccd60f4212

SHA1
7e2045b55c33af87848088738215af2bf7ad0b9b

SHA256
db7e3eef1813f386579a2dd11587077c6888809ac9c9e33c7584eb301402203b

SHA512
e63d8d4caf1cc98bc9beb168302c89885b12175a5802e2e7f507d30bce04eb67ce1f81519f544da297bbb581f59c5baab8ed3fd9b3f7f911a884095603587a21

Download Submit
C:\Users\Admin\bwhost.exe
Filesize
157KB

MD5
2dd258fd2e5a7fccd81b8af93c08780b

SHA1
a5373acdb7f4684b032954e9e754593ddcc827b2

SHA256
00d8a5382bc4f61a6836bc2b22c05b57485bdf2550188c456f1a854d8a885ca9

SHA512
20048701859ed645bc678a3a45a3ef45cee1d31edfba2ab6cc8edbb03bad6174b541694ac09f4dc58c58241a93d592deb049c33d22ef3cc9f0a6eaac925111df

Download Submit
C:\Users\Admin\cwhost.exe
Filesize
150KB

MD5
d91ada984db5e7adbf2b80c2284c12f6

SHA1
31e9b27095ac041687b016006f41ea6e5222202d

SHA256
8cbabd93630154a79f8f0c52964f330b44b427631403c3eef4b6c6fc87649948

SHA512
8a0eea5b8ffc4c8d4bdf1e551e6c11e8d188f2209666e2f4b6a74bed99105264510a612a7a1e72f7142584386891ab4aa95946110b8fe623d5b2035494da0748

Download Submit
C:\Users\Admin\dwhost.exe
Filesize
333KB

MD5
1aceb282a6d05fcc08f3f74f5483bf0a

SHA1
778e34df0c35fee3ab8b7f1af14b2b4ce948ea7b

SHA256
d62b7050a4ada5513bb9f24c79cf782a8675122ef7833bc8c91cb107fe71fc6d

SHA512
5f2c02faa69f1f3f32affc898773d92738a9944a59ad2a28cebe192b0ad1089363c8e3bbc1d202097b160c1b2dada71fc0f03a1a0744dbc2c72cc3273a4629f8

Download Submit
C:\Users\Admin\ewhost.exe
Filesize
36KB

MD5
4bcd12fdaa17197a658a5113af9120ec

SHA1
3ac79b0b793e390cf1dea82c1754ec34aab1ea46

SHA256
e781bf0233fb732b4b6935255af5cf33b7f0a58bad54b70408c347d2e83dbf96

SHA512
dab61b32fc43b2f55a197ebdf1b8c5709ed97e99530fb31a33ec077c25812f075733ff5e97cc5eebe01d8b83cd29ba104caba02b7a8cdf7e13f43e18432ccbdd

Download Submit
C:\Users\Admin\fhdion.exe
Filesize
224KB

MD5
0bc12c8fc8b59b1d3215de0b8b040b23

SHA1
23bceb960ed9e814a93394c48eb795740eaa519f

SHA256
ebb1187aa0def6ebd2d79f5b45da65ca99abf3ccfe5ccbee62672fbfc5df7fc2

SHA512
3bea7efd686d16e8276570abcb03044ed1873093c9513a0600767e9e1446fb7d5b133dd001acfb18f6805b4bd35536d7abbf40f8e78e47a8b3686723d790daf2

Download Submit
memory/1668-101-0x0000000000400000-0x0000000000462FF0-memory.dmp

Filesize
395KB

Download
memory/1668-96-0x0000000000400000-0x0000000000462FF0-memory.dmp

Filesize
395KB

Download
memory/2296-67-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2296-68-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2296-73-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2296-76-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2296-74-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2316-75-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2316-9-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2316-118-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2316-5-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2316-1-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2316-0-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2316-7-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2832-71-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3328-93-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3328-55-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3328-57-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3328-56-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3328-62-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3328-58-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3532-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3788-61-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4196-79-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4196-83-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download