Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 22:36
Behavioral task
behavioral1
Sample
1cc1b6fc2ec89fe4ec20ddaf4cc59c4f_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1cc1b6fc2ec89fe4ec20ddaf4cc59c4f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1cc1b6fc2ec89fe4ec20ddaf4cc59c4f_JaffaCakes118.exe
-
Size
113KB
-
MD5
1cc1b6fc2ec89fe4ec20ddaf4cc59c4f
-
SHA1
70fcf8017e8b529f3c0112c09756ac0b6396398d
-
SHA256
534a87cd1da6e9bcc0795b99c5f52f436093072fa582f08a3e9869bc9e37e4d3
-
SHA512
4f9f73b97bb1c33238c485496f991ab33f050596df317283d6c54c6a06ed72b6280a7f23faa9ef8e920691d3cd99a095e2bc51befaad8cc9dc2f80b33787a789
-
SSDEEP
3072:Aoy8j7VnNdrPHaSekwi+mWSL4UfEK72out:w8jZ7rvaU3+mWSsUctoS
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Processes:
mstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 16 IoCs
Processes:
resource yara_rule behavioral1/memory/1708-11-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/2936-21-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/2936-24-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/2936-25-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/2936-30-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/2936-33-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/2936-36-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/2936-40-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/2936-43-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/2936-46-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/2936-49-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/2936-52-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/2936-55-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/2936-58-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/2936-61-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/2936-64-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
mstwain32.exepid process 2936 mstwain32.exe -
Processes:
resource yara_rule behavioral1/memory/1708-0-0x0000000000400000-0x0000000000451000-memory.dmp upx C:\Windows\mstwain32.exe upx behavioral1/memory/2936-12-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1708-11-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/2936-21-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/2936-24-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/2936-25-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/2936-30-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/2936-33-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/2936-36-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/2936-40-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/2936-43-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/2936-46-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/2936-49-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/2936-52-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/2936-55-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/2936-58-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/2936-61-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/2936-64-0x0000000000400000-0x0000000000451000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
mstwain32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
Processes:
1cc1b6fc2ec89fe4ec20ddaf4cc59c4f_JaffaCakes118.exemstwain32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1cc1b6fc2ec89fe4ec20ddaf4cc59c4f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Drops file in Windows directory 4 IoCs
Processes:
mstwain32.exe1cc1b6fc2ec89fe4ec20ddaf4cc59c4f_JaffaCakes118.exedescription ioc process File created C:\Windows\cmsetac.dll mstwain32.exe File created C:\Windows\mstwain32.exe 1cc1b6fc2ec89fe4ec20ddaf4cc59c4f_JaffaCakes118.exe File opened for modification C:\Windows\mstwain32.exe 1cc1b6fc2ec89fe4ec20ddaf4cc59c4f_JaffaCakes118.exe File created C:\Windows\ntdtcstp.dll mstwain32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
1cc1b6fc2ec89fe4ec20ddaf4cc59c4f_JaffaCakes118.exevssvc.exemstwain32.exedescription pid process Token: SeDebugPrivilege 1708 1cc1b6fc2ec89fe4ec20ddaf4cc59c4f_JaffaCakes118.exe Token: SeBackupPrivilege 2860 vssvc.exe Token: SeRestorePrivilege 2860 vssvc.exe Token: SeAuditPrivilege 2860 vssvc.exe Token: SeDebugPrivilege 2936 mstwain32.exe Token: SeDebugPrivilege 2936 mstwain32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
mstwain32.exepid process 2936 mstwain32.exe 2936 mstwain32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
1cc1b6fc2ec89fe4ec20ddaf4cc59c4f_JaffaCakes118.exedescription pid process target process PID 1708 wrote to memory of 2936 1708 1cc1b6fc2ec89fe4ec20ddaf4cc59c4f_JaffaCakes118.exe mstwain32.exe PID 1708 wrote to memory of 2936 1708 1cc1b6fc2ec89fe4ec20ddaf4cc59c4f_JaffaCakes118.exe mstwain32.exe PID 1708 wrote to memory of 2936 1708 1cc1b6fc2ec89fe4ec20ddaf4cc59c4f_JaffaCakes118.exe mstwain32.exe PID 1708 wrote to memory of 2936 1708 1cc1b6fc2ec89fe4ec20ddaf4cc59c4f_JaffaCakes118.exe mstwain32.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
mstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cc1b6fc2ec89fe4ec20ddaf4cc59c4f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1cc1b6fc2ec89fe4ec20ddaf4cc59c4f_JaffaCakes118.exe"1⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\mstwain32.exeFilesize
113KB
MD51cc1b6fc2ec89fe4ec20ddaf4cc59c4f
SHA170fcf8017e8b529f3c0112c09756ac0b6396398d
SHA256534a87cd1da6e9bcc0795b99c5f52f436093072fa582f08a3e9869bc9e37e4d3
SHA5124f9f73b97bb1c33238c485496f991ab33f050596df317283d6c54c6a06ed72b6280a7f23faa9ef8e920691d3cd99a095e2bc51befaad8cc9dc2f80b33787a789
-
memory/1708-11-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1708-4-0x00000000005B0000-0x00000000005C0000-memory.dmpFilesize
64KB
-
memory/1708-0-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2936-28-0x00000000753C0000-0x00000000754B0000-memory.dmpFilesize
960KB
-
memory/2936-29-0x00000000753C0000-0x00000000754B0000-memory.dmpFilesize
960KB
-
memory/2936-17-0x0000000002480000-0x000000000248E000-memory.dmpFilesize
56KB
-
memory/2936-19-0x00000000753D0000-0x00000000753D1000-memory.dmpFilesize
4KB
-
memory/2936-20-0x00000000753C0000-0x00000000754B0000-memory.dmpFilesize
960KB
-
memory/2936-21-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2936-22-0x00000000004E0000-0x00000000004E8000-memory.dmpFilesize
32KB
-
memory/2936-23-0x0000000002480000-0x000000000248E000-memory.dmpFilesize
56KB
-
memory/2936-24-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2936-25-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2936-12-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2936-16-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/2936-30-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2936-33-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2936-36-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2936-40-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2936-43-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2936-46-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2936-49-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2936-52-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2936-55-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2936-58-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2936-61-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2936-64-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB