Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 13:38
Static task
static1
Behavioral task
behavioral1
Sample
1a53f732245b2804cc6c1619b2dd71bd_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1a53f732245b2804cc6c1619b2dd71bd_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
1a53f732245b2804cc6c1619b2dd71bd_JaffaCakes118.exe
-
Size
243KB
-
MD5
1a53f732245b2804cc6c1619b2dd71bd
-
SHA1
49d52cd86d4afaaf3bd1c49e25302a5a69635359
-
SHA256
39c121da842e51e9dd114bd36badbf3b2d818bc7072416d112f475d9320019c8
-
SHA512
1611b4d533ab2433d38ce37793f027172f32e377326a8f86b17f7f395b99f3d669bf98ddcae6f31bb61fbb949fad30d7c6065f9348fc10cbff7fee5c71f99e12
-
SSDEEP
3072:iiBMdny04ybHTvtH0LLr79N2m+HueNd7DSKKZ6ufZr7UM3PhkvsaOYUgDGnkphw1:im8jZ7rvaU3+mW7NroSdp
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Processes:
mstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 16 IoCs
Processes:
resource yara_rule behavioral2/memory/2184-89-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral2/memory/2184-93-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral2/memory/3068-108-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral2/memory/3068-111-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral2/memory/3068-114-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral2/memory/3068-115-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral2/memory/3068-118-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral2/memory/3068-121-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral2/memory/3068-124-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral2/memory/3068-127-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral2/memory/3068-130-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral2/memory/3068-133-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral2/memory/3068-136-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral2/memory/3068-139-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral2/memory/3068-142-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral2/memory/3068-145-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1a53f732245b2804cc6c1619b2dd71bd_JaffaCakes118.exep.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 1a53f732245b2804cc6c1619b2dd71bd_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation p.exe -
Executes dropped EXE 2 IoCs
Processes:
p.exemstwain32.exepid process 2184 p.exe 3068 mstwain32.exe -
Loads dropped DLL 4 IoCs
Processes:
mstwain32.exepid process 3068 mstwain32.exe 3068 mstwain32.exe 3068 mstwain32.exe 3068 mstwain32.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\p.exe upx behavioral2/memory/2184-51-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/2184-89-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3068-91-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/2184-93-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3068-108-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3068-111-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3068-114-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3068-115-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3068-118-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3068-121-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3068-124-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3068-127-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3068-130-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3068-133-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3068-136-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3068-139-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3068-142-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3068-145-0x0000000000400000-0x0000000000451000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
mstwain32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
Processes:
mstwain32.exep.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA p.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe -
Drops file in Windows directory 4 IoCs
Processes:
p.exemstwain32.exedescription ioc process File opened for modification C:\Windows\mstwain32.exe p.exe File created C:\Windows\ntdtcstp.dll mstwain32.exe File created C:\Windows\cmsetac.dll mstwain32.exe File created C:\Windows\mstwain32.exe p.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
p.exevssvc.exemstwain32.exedescription pid process Token: SeDebugPrivilege 2184 p.exe Token: SeBackupPrivilege 1676 vssvc.exe Token: SeRestorePrivilege 1676 vssvc.exe Token: SeAuditPrivilege 1676 vssvc.exe Token: SeDebugPrivilege 3068 mstwain32.exe Token: SeDebugPrivilege 3068 mstwain32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
mstwain32.exepid process 3068 mstwain32.exe 3068 mstwain32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
1a53f732245b2804cc6c1619b2dd71bd_JaffaCakes118.exep.exedescription pid process target process PID 2548 wrote to memory of 2184 2548 1a53f732245b2804cc6c1619b2dd71bd_JaffaCakes118.exe p.exe PID 2548 wrote to memory of 2184 2548 1a53f732245b2804cc6c1619b2dd71bd_JaffaCakes118.exe p.exe PID 2548 wrote to memory of 2184 2548 1a53f732245b2804cc6c1619b2dd71bd_JaffaCakes118.exe p.exe PID 2184 wrote to memory of 3068 2184 p.exe mstwain32.exe PID 2184 wrote to memory of 3068 2184 p.exe mstwain32.exe PID 2184 wrote to memory of 3068 2184 p.exe mstwain32.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
mstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a53f732245b2804cc6c1619b2dd71bd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a53f732245b2804cc6c1619b2dd71bd_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\p.exe"C:\Users\Admin\AppData\Local\Temp\p.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AVSCAN-20111130-120438-6D52CEE6.exeFilesize
15KB
MD529be14c53687eb758bf29ae0d61957ab
SHA1757ec8087e01b18a59a38afe1d67ed7595e1d584
SHA25673256eb5de9d1b31f00c5b66f01dee42de536b6a66afd0168cffd63fd7d414df
SHA512d4df28e6849fda5dfaee90ec202e211542ca3f96610f7b8a74d466f733c9794c687a77c5c979d9a5e0e03d5dc43d60307a06ee0bfc3f2aa80a1a69bd9fc1a2a9
-
C:\Users\Admin\AppData\Local\Temp\p.exeFilesize
111KB
MD5d417c2433ba065ec886c9f6a3d4584cb
SHA1a61cc10599ea5048087bb83be95fdce9686a0562
SHA2567ba8b5433cdf259563342d9e3f651610d276cc73fffe7788d43a5f715e27eaeb
SHA512d116265414c684b17fb9d2adc1a68a9240e789cf45d86762f398b6ad805ed15c75d0ba47982aef3c3c89091d5106cc92b8d470d20c5109353533b1e658aff2cd
-
C:\Windows\cmsetac.dllFilesize
33KB
MD5562ff86a49c0fa6b9c0f9db2dda35bf3
SHA1fda7969f4083584a70d88c3b77eee65aedcbd04e
SHA2566c93ba445c632738db40735e46dd417de14b0af6d18478334e0f8342d6a0b978
SHA5122336b459f46919430bab8d3a26ddacc159283bbe6a072c785e923d9f699ccb1cee7d911bd62d952e38bd1191dbf6f6276f27fa145a4f08091bb3a39838d0696e
-
C:\Windows\ntdtcstp.dllFilesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
memory/2184-51-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2184-89-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2184-93-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3068-110-0x00000000030F0000-0x00000000030FE000-memory.dmpFilesize
56KB
-
memory/3068-118-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3068-105-0x00000000030F0000-0x00000000030FE000-memory.dmpFilesize
56KB
-
memory/3068-108-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3068-109-0x0000000000710000-0x0000000000718000-memory.dmpFilesize
32KB
-
memory/3068-91-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3068-111-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3068-114-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3068-115-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3068-101-0x0000000000700000-0x0000000000701000-memory.dmpFilesize
4KB
-
memory/3068-121-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3068-124-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3068-127-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3068-130-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3068-133-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3068-136-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3068-139-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3068-142-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3068-145-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB