Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 13:38
Static task
static1
Behavioral task
behavioral1
Sample
1a53f732245b2804cc6c1619b2dd71bd_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1a53f732245b2804cc6c1619b2dd71bd_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
1a53f732245b2804cc6c1619b2dd71bd_JaffaCakes118.exe
-
Size
243KB
-
MD5
1a53f732245b2804cc6c1619b2dd71bd
-
SHA1
49d52cd86d4afaaf3bd1c49e25302a5a69635359
-
SHA256
39c121da842e51e9dd114bd36badbf3b2d818bc7072416d112f475d9320019c8
-
SHA512
1611b4d533ab2433d38ce37793f027172f32e377326a8f86b17f7f395b99f3d669bf98ddcae6f31bb61fbb949fad30d7c6065f9348fc10cbff7fee5c71f99e12
-
SSDEEP
3072:iiBMdny04ybHTvtH0LLr79N2m+HueNd7DSKKZ6ufZr7UM3PhkvsaOYUgDGnkphw1:im8jZ7rvaU3+mW7NroSdp
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Processes:
mstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 15 IoCs
Processes:
resource yara_rule behavioral1/memory/2044-47-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1156-54-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1156-57-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1156-60-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1156-63-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1156-66-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1156-70-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1156-73-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1156-76-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1156-79-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1156-82-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1156-85-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1156-88-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1156-91-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1156-94-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
Processes:
p.exemstwain32.exepid process 2044 p.exe 1156 mstwain32.exe -
Loads dropped DLL 3 IoCs
Processes:
1a53f732245b2804cc6c1619b2dd71bd_JaffaCakes118.exep.exepid process 3032 1a53f732245b2804cc6c1619b2dd71bd_JaffaCakes118.exe 3032 1a53f732245b2804cc6c1619b2dd71bd_JaffaCakes118.exe 2044 p.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\p.exe upx behavioral1/memory/2044-25-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1156-48-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/2044-47-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1156-54-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1156-57-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1156-60-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1156-63-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1156-66-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1156-70-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1156-73-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1156-76-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1156-79-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1156-82-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1156-85-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1156-88-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1156-91-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1156-94-0x0000000000400000-0x0000000000451000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
mstwain32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
Processes:
p.exemstwain32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA p.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Drops file in Windows directory 4 IoCs
Processes:
p.exemstwain32.exedescription ioc process File created C:\Windows\mstwain32.exe p.exe File opened for modification C:\Windows\mstwain32.exe p.exe File created C:\Windows\ntdtcstp.dll mstwain32.exe File created C:\Windows\cmsetac.dll mstwain32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
p.exevssvc.exemstwain32.exedescription pid process Token: SeDebugPrivilege 2044 p.exe Token: SeBackupPrivilege 2584 vssvc.exe Token: SeRestorePrivilege 2584 vssvc.exe Token: SeAuditPrivilege 2584 vssvc.exe Token: SeDebugPrivilege 1156 mstwain32.exe Token: SeDebugPrivilege 1156 mstwain32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
mstwain32.exepid process 1156 mstwain32.exe 1156 mstwain32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
1a53f732245b2804cc6c1619b2dd71bd_JaffaCakes118.exep.exedescription pid process target process PID 3032 wrote to memory of 2044 3032 1a53f732245b2804cc6c1619b2dd71bd_JaffaCakes118.exe p.exe PID 3032 wrote to memory of 2044 3032 1a53f732245b2804cc6c1619b2dd71bd_JaffaCakes118.exe p.exe PID 3032 wrote to memory of 2044 3032 1a53f732245b2804cc6c1619b2dd71bd_JaffaCakes118.exe p.exe PID 3032 wrote to memory of 2044 3032 1a53f732245b2804cc6c1619b2dd71bd_JaffaCakes118.exe p.exe PID 2044 wrote to memory of 1156 2044 p.exe mstwain32.exe PID 2044 wrote to memory of 1156 2044 p.exe mstwain32.exe PID 2044 wrote to memory of 1156 2044 p.exe mstwain32.exe PID 2044 wrote to memory of 1156 2044 p.exe mstwain32.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
mstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a53f732245b2804cc6c1619b2dd71bd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a53f732245b2804cc6c1619b2dd71bd_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\p.exe"C:\Users\Admin\AppData\Local\Temp\p.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AVSCAN-20111130-120438-6D52CEE6.exeFilesize
15KB
MD529be14c53687eb758bf29ae0d61957ab
SHA1757ec8087e01b18a59a38afe1d67ed7595e1d584
SHA25673256eb5de9d1b31f00c5b66f01dee42de536b6a66afd0168cffd63fd7d414df
SHA512d4df28e6849fda5dfaee90ec202e211542ca3f96610f7b8a74d466f733c9794c687a77c5c979d9a5e0e03d5dc43d60307a06ee0bfc3f2aa80a1a69bd9fc1a2a9
-
\Users\Admin\AppData\Local\Temp\p.exeFilesize
111KB
MD5d417c2433ba065ec886c9f6a3d4584cb
SHA1a61cc10599ea5048087bb83be95fdce9686a0562
SHA2567ba8b5433cdf259563342d9e3f651610d276cc73fffe7788d43a5f715e27eaeb
SHA512d116265414c684b17fb9d2adc1a68a9240e789cf45d86762f398b6ad805ed15c75d0ba47982aef3c3c89091d5106cc92b8d470d20c5109353533b1e658aff2cd
-
memory/1156-79-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1156-57-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1156-63-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1156-48-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1156-88-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1156-52-0x00000000007A0000-0x00000000007AE000-memory.dmpFilesize
56KB
-
memory/1156-55-0x00000000002C0000-0x00000000002C8000-memory.dmpFilesize
32KB
-
memory/1156-56-0x00000000007A0000-0x00000000007AE000-memory.dmpFilesize
56KB
-
memory/1156-66-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1156-91-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1156-94-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1156-85-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1156-54-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1156-70-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1156-73-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1156-76-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1156-60-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1156-82-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2044-25-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2044-47-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3032-23-0x00000000024B0000-0x0000000002501000-memory.dmpFilesize
324KB
-
memory/3032-24-0x00000000024B0000-0x0000000002501000-memory.dmpFilesize
324KB