Analysis
-
max time kernel
148s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 14:13
Static task
static1
Behavioral task
behavioral1
Sample
1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe
-
Size
136KB
-
MD5
1b99615b7735dd154f46f0d20abb21ef
-
SHA1
2eddace2205a858cb7639b50d994a8e216a00dfe
-
SHA256
34133845d0fd86afe76b46e8385dd360a606b0eb5191bbdd3ebc40dfa83dc411
-
SHA512
871a1f51650212b684eae32458233173eab5b16b7387a9053eba0c064cdcf25733f34f3abc200965c1e85323eae106823518c3628b25c04d965813bf0e9b7e63
-
SSDEEP
3072:0sdUYgVqo7S8M8D77BCzurSE0fUolN+BEzDiT:02stPM8lCzurSE0VMB4c
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
ModiLoader Second Stage 19 IoCs
Processes:
resource yara_rule behavioral1/memory/1256-17-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1256-16-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1256-28-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2936-46-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2936-47-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2936-48-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2936-59-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2936-62-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2936-63-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2936-68-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2936-71-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2936-74-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2936-78-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2936-81-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2936-84-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2936-87-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2936-90-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2936-93-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2936-96-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
Processes:
svchost.exesvchost.exepid process 2888 svchost.exe 2936 svchost.exe -
Processes:
resource yara_rule behavioral1/memory/1256-7-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1256-10-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1256-6-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1256-12-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1256-13-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1256-17-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1256-16-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1256-28-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2936-44-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2936-45-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2936-46-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2936-47-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2936-48-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2936-59-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2936-62-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2936-63-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2936-68-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2936-71-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2936-74-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2936-78-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2936-81-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2936-84-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2936-87-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2936-90-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2936-93-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2936-96-0x0000000000400000-0x0000000000450000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\svchost.exe" svchost.exe -
Processes:
1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exesvchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exesvchost.exedescription pid process target process PID 1196 set thread context of 1256 1196 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe PID 2888 set thread context of 2936 2888 svchost.exe svchost.exe -
Drops file in Windows directory 4 IoCs
Processes:
1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exesvchost.exedescription ioc process File created C:\Windows\svchost.exe 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe File opened for modification C:\Windows\svchost.exe 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe File created C:\Windows\ntdtcstp.dll svchost.exe File created C:\Windows\cmsetac.dll svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exevssvc.exesvchost.exedescription pid process Token: SeDebugPrivilege 1256 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe Token: SeBackupPrivilege 2620 vssvc.exe Token: SeRestorePrivilege 2620 vssvc.exe Token: SeAuditPrivilege 2620 vssvc.exe Token: SeDebugPrivilege 2936 svchost.exe Token: SeDebugPrivilege 2936 svchost.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exesvchost.exesvchost.exepid process 1196 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe 2888 svchost.exe 2936 svchost.exe 2936 svchost.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exesvchost.exedescription pid process target process PID 1196 wrote to memory of 1256 1196 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe PID 1196 wrote to memory of 1256 1196 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe PID 1196 wrote to memory of 1256 1196 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe PID 1196 wrote to memory of 1256 1196 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe PID 1196 wrote to memory of 1256 1196 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe PID 1196 wrote to memory of 1256 1196 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe PID 1196 wrote to memory of 1256 1196 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe PID 1196 wrote to memory of 1256 1196 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe PID 1256 wrote to memory of 2888 1256 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe svchost.exe PID 1256 wrote to memory of 2888 1256 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe svchost.exe PID 1256 wrote to memory of 2888 1256 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe svchost.exe PID 1256 wrote to memory of 2888 1256 1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe svchost.exe PID 2888 wrote to memory of 2936 2888 svchost.exe svchost.exe PID 2888 wrote to memory of 2936 2888 svchost.exe svchost.exe PID 2888 wrote to memory of 2936 2888 svchost.exe svchost.exe PID 2888 wrote to memory of 2936 2888 svchost.exe svchost.exe PID 2888 wrote to memory of 2936 2888 svchost.exe svchost.exe PID 2888 wrote to memory of 2936 2888 svchost.exe svchost.exe PID 2888 wrote to memory of 2936 2888 svchost.exe svchost.exe PID 2888 wrote to memory of 2936 2888 svchost.exe svchost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe"2⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" \melt "C:\Users\Admin\AppData\Local\Temp\1b99615b7735dd154f46f0d20abb21ef_JaffaCakes118.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"4⤵
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1298544033-3225604241-2703760938-1000\699c4b9cdebca7aaea5193cae8a50098_e3fd1d67-4513-4809-a7f1-bf54bd53bdbcFilesize
50B
MD55b63d4dd8c04c88c0e30e494ec6a609a
SHA1884d5a8bdc25fe794dc22ef9518009dcf0069d09
SHA2564d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd
SHA51215ff8551ac6b9de978050569bcdc26f44dfc06a0eaf445ac70fd45453a21bdafa3e4c8b4857d6a1c3226f4102a639682bdfb71d7b255062fb81a51c9126896cb
-
C:\Windows\svchost.exeFilesize
136KB
MD51b99615b7735dd154f46f0d20abb21ef
SHA12eddace2205a858cb7639b50d994a8e216a00dfe
SHA25634133845d0fd86afe76b46e8385dd360a606b0eb5191bbdd3ebc40dfa83dc411
SHA512871a1f51650212b684eae32458233173eab5b16b7387a9053eba0c064cdcf25733f34f3abc200965c1e85323eae106823518c3628b25c04d965813bf0e9b7e63
-
memory/1196-15-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1196-0-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1256-17-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1256-28-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1256-12-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1256-13-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1256-6-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1256-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1256-16-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1256-18-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/1256-10-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1256-27-0x00000000036F0000-0x00000000036F6000-memory.dmpFilesize
24KB
-
memory/1256-4-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1256-7-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2888-54-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/2888-43-0x0000000000230000-0x0000000000236000-memory.dmpFilesize
24KB
-
memory/2936-52-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/2936-63-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2936-47-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2936-48-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2936-45-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2936-44-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2936-55-0x0000000000510000-0x000000000051E000-memory.dmpFilesize
56KB
-
memory/2936-58-0x0000000077000000-0x00000000770F0000-memory.dmpFilesize
960KB
-
memory/2936-57-0x0000000077010000-0x0000000077011000-memory.dmpFilesize
4KB
-
memory/2936-59-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2936-60-0x00000000002F0000-0x00000000002F8000-memory.dmpFilesize
32KB
-
memory/2936-61-0x0000000000510000-0x000000000051E000-memory.dmpFilesize
56KB
-
memory/2936-62-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2936-46-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2936-66-0x0000000077000000-0x00000000770F0000-memory.dmpFilesize
960KB
-
memory/2936-67-0x0000000077000000-0x00000000770F0000-memory.dmpFilesize
960KB
-
memory/2936-68-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2936-71-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2936-74-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2936-78-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2936-81-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2936-84-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2936-87-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2936-90-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2936-93-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2936-96-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB