modiloader | 0a88a5feca66ce14a5df509acd129ee18d1568c2901c670d7c2eaf9215a532d9

Analysis

max time kernel
148s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1aefe6756a4d57861c59fb9498270be5_JaffaCakes118.exe
Size

116KB
MD5

1aefe6756a4d57861c59fb9498270be5
SHA1

641525e347f140dd0cc3edd6413f0aa627c95c36
SHA256

0a88a5feca66ce14a5df509acd129ee18d1568c2901c670d7c2eaf9215a532d9
SHA512

3daa55edaac01196f662e9af51ebf67213f630cd3005cb0efce844216714b975c39fee93d190dcc0b8329f4abfe76109f6e9353160077d5481005ef62dd7c375
SSDEEP

3072:hGoy8j7VnNdrPHaSekwi+mW17CFahBout8:hm8jZ7rvaU3+mW1OYhBoS8

Score

10^/10

modiloader evasion persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

mstwain32.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

ModiLoader Second Stage 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1752-14-0x0000000000400000-0x0000000000454000-memory.dmp	modiloader_stage2
behavioral1/memory/2604-23-0x0000000075D80000-0x0000000075E70000-memory.dmp	modiloader_stage2
behavioral1/memory/2604-24-0x0000000000400000-0x0000000000454000-memory.dmp	modiloader_stage2
behavioral1/memory/2604-27-0x0000000000400000-0x0000000000454000-memory.dmp	modiloader_stage2
behavioral1/memory/2604-28-0x0000000000400000-0x0000000000454000-memory.dmp	modiloader_stage2
behavioral1/memory/2604-33-0x0000000000400000-0x0000000000454000-memory.dmp	modiloader_stage2
behavioral1/memory/2604-36-0x0000000000400000-0x0000000000454000-memory.dmp	modiloader_stage2
behavioral1/memory/2604-39-0x0000000000400000-0x0000000000454000-memory.dmp	modiloader_stage2
behavioral1/memory/2604-43-0x0000000000400000-0x0000000000454000-memory.dmp	modiloader_stage2
behavioral1/memory/2604-46-0x0000000000400000-0x0000000000454000-memory.dmp	modiloader_stage2
behavioral1/memory/2604-49-0x0000000000400000-0x0000000000454000-memory.dmp	modiloader_stage2
behavioral1/memory/2604-52-0x0000000000400000-0x0000000000454000-memory.dmp	modiloader_stage2
behavioral1/memory/2604-55-0x0000000000400000-0x0000000000454000-memory.dmp	modiloader_stage2
behavioral1/memory/2604-58-0x0000000000400000-0x0000000000454000-memory.dmp	modiloader_stage2
behavioral1/memory/2604-61-0x0000000000400000-0x0000000000454000-memory.dmp	modiloader_stage2
behavioral1/memory/2604-64-0x0000000000400000-0x0000000000454000-memory.dmp	modiloader_stage2
behavioral1/memory/2604-67-0x0000000000400000-0x0000000000454000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

Processes:

mstwain32.exe

pid process

2604 mstwain32.exe
Executes dropped EXE 1 IoCs

Processes:

mstwain32.exe

pid process

2604 mstwain32.exe

pid	process
2604	mstwain32.exe

pid	process
2604	mstwain32.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1752-0-0x0000000000400000-0x0000000000454000-memory.dmp	upx
C:\Windows\mstwain32.exe	upx
behavioral1/memory/2604-15-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/1752-14-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2604-23-0x0000000075D80000-0x0000000075E70000-memory.dmp	upx
behavioral1/memory/2604-24-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2604-27-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2604-28-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2604-33-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2604-36-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2604-39-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2604-43-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2604-46-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2604-49-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2604-52-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2604-55-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2604-58-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2604-61-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2604-64-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2604-67-0x0000000000400000-0x0000000000454000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

mstwain32.exe

description ioc process

Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe"	mstwain32.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

1aefe6756a4d57861c59fb9498270be5_JaffaCakes118.exemstwain32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1aefe6756a4d57861c59fb9498270be5_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mstwain32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

Drops file in Windows directory 4 IoCs

Processes:

1aefe6756a4d57861c59fb9498270be5_JaffaCakes118.exemstwain32.exe

description	ioc	process
File opened for modification	C:\Windows\mstwain32.exe	1aefe6756a4d57861c59fb9498270be5_JaffaCakes118.exe
File created	C:\Windows\ntdtcstp.dll	mstwain32.exe
File created	C:\Windows\cmsetac.dll	mstwain32.exe
File created	C:\Windows\mstwain32.exe	1aefe6756a4d57861c59fb9498270be5_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

1aefe6756a4d57861c59fb9498270be5_JaffaCakes118.exevssvc.exemstwain32.exe

description	pid	process
Token: SeDebugPrivilege	1752	1aefe6756a4d57861c59fb9498270be5_JaffaCakes118.exe
Token: SeBackupPrivilege	1988	vssvc.exe
Token: SeRestorePrivilege	1988	vssvc.exe
Token: SeAuditPrivilege	1988	vssvc.exe
Token: SeDebugPrivilege	2604	mstwain32.exe
Token: SeDebugPrivilege	2604	mstwain32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

mstwain32.exe

pid process

2604 mstwain32.exe
2604 mstwain32.exe

pid	process
2604	mstwain32.exe
2604	mstwain32.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1aefe6756a4d57861c59fb9498270be5_JaffaCakes118.exe

description	pid	process	target process
PID 1752 wrote to memory of 2604	1752	1aefe6756a4d57861c59fb9498270be5_JaffaCakes118.exe	mstwain32.exe
PID 1752 wrote to memory of 2604	1752	1aefe6756a4d57861c59fb9498270be5_JaffaCakes118.exe	mstwain32.exe
PID 1752 wrote to memory of 2604	1752	1aefe6756a4d57861c59fb9498270be5_JaffaCakes118.exe	mstwain32.exe
PID 1752 wrote to memory of 2604	1752	1aefe6756a4d57861c59fb9498270be5_JaffaCakes118.exe	mstwain32.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

mstwain32.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

C:\Users\Admin\AppData\Local\Temp\1aefe6756a4d57861c59fb9498270be5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1aefe6756a4d57861c59fb9498270be5_JaffaCakes118.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\mstwain32.exe
"C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\1aefe6756a4d57861c59fb9498270be5_JaffaCakes118.exe"
2⤵
- UAC bypass
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2604

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1988

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\mstwain32.exe
Filesize
116KB

MD5
1aefe6756a4d57861c59fb9498270be5

SHA1
641525e347f140dd0cc3edd6413f0aa627c95c36

SHA256
0a88a5feca66ce14a5df509acd129ee18d1568c2901c670d7c2eaf9215a532d9

SHA512
3daa55edaac01196f662e9af51ebf67213f630cd3005cb0efce844216714b975c39fee93d190dcc0b8329f4abfe76109f6e9353160077d5481005ef62dd7c375

Download Submit
memory/1752-12-0x0000000003710000-0x0000000003764000-memory.dmp

Filesize
336KB

Download
memory/1752-1-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1752-11-0x0000000002810000-0x0000000002820000-memory.dmp

Filesize
64KB

Download
memory/1752-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1752-14-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1752-13-0x0000000003710000-0x0000000003764000-memory.dmp

Filesize
336KB

Download
memory/2604-25-0x0000000000270000-0x0000000000278000-memory.dmp

Filesize
32KB

Download
memory/2604-32-0x0000000075D80000-0x0000000075E70000-memory.dmp

Filesize
960KB

Download
memory/2604-20-0x0000000000460000-0x000000000046E000-memory.dmp

Filesize
56KB

Download
memory/2604-23-0x0000000075D80000-0x0000000075E70000-memory.dmp

Filesize
960KB

Download
memory/2604-22-0x0000000075D90000-0x0000000075D91000-memory.dmp

Filesize
4KB

Download
memory/2604-24-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2604-26-0x0000000000460000-0x000000000046E000-memory.dmp

Filesize
56KB

Download
memory/2604-15-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2604-27-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2604-28-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2604-31-0x0000000075D80000-0x0000000075E70000-memory.dmp

Filesize
960KB

Download
memory/2604-19-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2604-33-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2604-36-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2604-39-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2604-43-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2604-46-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2604-49-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2604-52-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2604-55-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2604-58-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2604-61-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2604-64-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2604-67-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download