Analysis
-
max time kernel
145s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-05-2024 20:33
Behavioral task
behavioral1
Sample
42f491944de28a22641978b4e94b1a45_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
42f491944de28a22641978b4e94b1a45_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
42f491944de28a22641978b4e94b1a45_JaffaCakes118.exe
-
Size
308KB
-
MD5
42f491944de28a22641978b4e94b1a45
-
SHA1
806c3c7c72c2f3adbdf724d54fca89a291a06a85
-
SHA256
f1316532c633dddc4f42156ec50e019b755c9a128e0d7a788946d8e0b9e31adc
-
SHA512
2f049f11e72d439303106290799e27a8545125c0af1ae416e03f444753cbf5521979c9aa8e839186e408ba7dbd88884eb5c23a51529c98d61bc567d4b6888a6d
-
SSDEEP
6144:w1G377xS2Vp2CeiorXhwTBOdeWIY4Afm53wpcCJJvH:wYr7xS2Vp6FwTnWIYzTbJJvH
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Processes:
mstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 16 IoCs
Processes:
resource yara_rule behavioral1/memory/1084-0-0x0000000000400000-0x0000000000455000-memory.dmp modiloader_stage2 C:\Windows\mstwain32.exe modiloader_stage2 behavioral1/memory/1084-10-0x0000000000400000-0x0000000000455000-memory.dmp modiloader_stage2 behavioral1/memory/2228-20-0x0000000000400000-0x0000000000455000-memory.dmp modiloader_stage2 behavioral1/memory/2228-23-0x0000000000400000-0x0000000000455000-memory.dmp modiloader_stage2 behavioral1/memory/2228-27-0x0000000000400000-0x0000000000455000-memory.dmp modiloader_stage2 behavioral1/memory/2228-30-0x0000000000400000-0x0000000000455000-memory.dmp modiloader_stage2 behavioral1/memory/2228-34-0x0000000000400000-0x0000000000455000-memory.dmp modiloader_stage2 behavioral1/memory/2228-37-0x0000000000400000-0x0000000000455000-memory.dmp modiloader_stage2 behavioral1/memory/2228-40-0x0000000000400000-0x0000000000455000-memory.dmp modiloader_stage2 behavioral1/memory/2228-43-0x0000000000400000-0x0000000000455000-memory.dmp modiloader_stage2 behavioral1/memory/2228-46-0x0000000000400000-0x0000000000455000-memory.dmp modiloader_stage2 behavioral1/memory/2228-49-0x0000000000400000-0x0000000000455000-memory.dmp modiloader_stage2 behavioral1/memory/2228-52-0x0000000000400000-0x0000000000455000-memory.dmp modiloader_stage2 behavioral1/memory/2228-55-0x0000000000400000-0x0000000000455000-memory.dmp modiloader_stage2 behavioral1/memory/2228-58-0x0000000000400000-0x0000000000455000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
mstwain32.exepid process 2228 mstwain32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
mstwain32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
Processes:
mstwain32.exe42f491944de28a22641978b4e94b1a45_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 42f491944de28a22641978b4e94b1a45_JaffaCakes118.exe -
Drops file in Windows directory 4 IoCs
Processes:
42f491944de28a22641978b4e94b1a45_JaffaCakes118.exemstwain32.exedescription ioc process File created C:\Windows\mstwain32.exe 42f491944de28a22641978b4e94b1a45_JaffaCakes118.exe File opened for modification C:\Windows\mstwain32.exe 42f491944de28a22641978b4e94b1a45_JaffaCakes118.exe File created C:\Windows\ntdtcstp.dll mstwain32.exe File created C:\Windows\cmsetac.dll mstwain32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
42f491944de28a22641978b4e94b1a45_JaffaCakes118.exevssvc.exemstwain32.exedescription pid process Token: SeDebugPrivilege 1084 42f491944de28a22641978b4e94b1a45_JaffaCakes118.exe Token: SeBackupPrivilege 1096 vssvc.exe Token: SeRestorePrivilege 1096 vssvc.exe Token: SeAuditPrivilege 1096 vssvc.exe Token: SeDebugPrivilege 2228 mstwain32.exe Token: SeDebugPrivilege 2228 mstwain32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
mstwain32.exepid process 2228 mstwain32.exe 2228 mstwain32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
42f491944de28a22641978b4e94b1a45_JaffaCakes118.exedescription pid process target process PID 1084 wrote to memory of 2228 1084 42f491944de28a22641978b4e94b1a45_JaffaCakes118.exe mstwain32.exe PID 1084 wrote to memory of 2228 1084 42f491944de28a22641978b4e94b1a45_JaffaCakes118.exe mstwain32.exe PID 1084 wrote to memory of 2228 1084 42f491944de28a22641978b4e94b1a45_JaffaCakes118.exe mstwain32.exe PID 1084 wrote to memory of 2228 1084 42f491944de28a22641978b4e94b1a45_JaffaCakes118.exe mstwain32.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
mstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\42f491944de28a22641978b4e94b1a45_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\42f491944de28a22641978b4e94b1a45_JaffaCakes118.exe"1⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\mstwain32.exeFilesize
308KB
MD542f491944de28a22641978b4e94b1a45
SHA1806c3c7c72c2f3adbdf724d54fca89a291a06a85
SHA256f1316532c633dddc4f42156ec50e019b755c9a128e0d7a788946d8e0b9e31adc
SHA5122f049f11e72d439303106290799e27a8545125c0af1ae416e03f444753cbf5521979c9aa8e839186e408ba7dbd88884eb5c23a51529c98d61bc567d4b6888a6d
-
memory/1084-0-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1084-1-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1084-10-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2228-23-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2228-30-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2228-17-0x0000000075970000-0x0000000075971000-memory.dmpFilesize
4KB
-
memory/2228-18-0x0000000075960000-0x0000000075A50000-memory.dmpFilesize
960KB
-
memory/2228-19-0x0000000075960000-0x0000000075A50000-memory.dmpFilesize
960KB
-
memory/2228-20-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2228-22-0x00000000008A0000-0x00000000008AE000-memory.dmpFilesize
56KB
-
memory/2228-21-0x0000000000320000-0x0000000000328000-memory.dmpFilesize
32KB
-
memory/2228-14-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/2228-26-0x0000000075960000-0x0000000075A50000-memory.dmpFilesize
960KB
-
memory/2228-27-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2228-15-0x00000000008A0000-0x00000000008AE000-memory.dmpFilesize
56KB
-
memory/2228-34-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2228-37-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2228-40-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2228-43-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2228-46-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2228-49-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2228-52-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2228-55-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2228-58-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB