modiloader | 0e7ab7acc0303aef0c0820c23167135ac35ad3a03e836f601059abe325bdfaf9

General

Target

00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe
Size

130KB
MD5

00b62b4528800a8009bed8bdd9ddf09e
SHA1

c4a37a12f8eb65b002db66d18c77b90dec97a1b9
SHA256

0e7ab7acc0303aef0c0820c23167135ac35ad3a03e836f601059abe325bdfaf9
SHA512

acc8a5f915745c3f1bdbbf53f2aa5b8e75f74c6b1b6aa80000215fd3489128f4c2d9afae7a0bd35aac13029e1bd673ea0346853139ee417521506851d5ca429b
SSDEEP

3072:J84G+rAP0gCvpBTnXi0QCrqFfQshCCIAn5bK2znUImPout:JfYPQvp5Xi0J2QQX+QUDoS

Score

10^/10

modiloader evasion trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

mvrsync.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mvrsync.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mvrsync.exe

ModiLoader Second Stage 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2432-14-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral1/memory/1572-16-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral1/memory/1572-29-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral1/memory/1572-34-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral1/memory/1572-37-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral1/memory/1572-40-0x0000000075A20000-0x0000000075B10000-memory.dmp	modiloader_stage2
behavioral1/memory/1572-43-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral1/memory/1572-47-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral1/memory/1572-51-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral1/memory/1572-57-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral1/memory/1572-60-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral1/memory/1572-64-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral1/memory/1572-67-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral1/memory/1572-71-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral1/memory/1572-75-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral1/memory/1572-79-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral1/memory/1572-82-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral1/memory/1572-86-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

Processes:

mvrsync.exe

pid process

1572 mvrsync.exe
Executes dropped EXE 1 IoCs

Processes:

mvrsync.exe

pid process

1572 mvrsync.exe

pid	process
1572	mvrsync.exe

pid	process
1572	mvrsync.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2432-0-0x0000000000400000-0x0000000000555000-memory.dmp	upx
C:\Windows\mvrsync.exe	upx
behavioral1/memory/2432-14-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral1/memory/1572-16-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral1/memory/1572-29-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral1/memory/1572-34-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral1/memory/1572-37-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral1/memory/1572-40-0x0000000075A20000-0x0000000075B10000-memory.dmp	upx
behavioral1/memory/1572-43-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral1/memory/1572-47-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral1/memory/1572-51-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral1/memory/1572-57-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral1/memory/1572-60-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral1/memory/1572-64-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral1/memory/1572-67-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral1/memory/1572-71-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral1/memory/1572-75-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral1/memory/1572-79-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral1/memory/1572-82-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral1/memory/1572-86-0x0000000000400000-0x0000000000555000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exemvrsync.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mvrsync.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mvrsync.exe

Drops file in Windows directory 4 IoCs

Processes:

00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exemvrsync.exe

description	ioc	process
File created	C:\Windows\mvrsync.exe	00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe
File opened for modification	C:\Windows\mvrsync.exe	00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe
File created	C:\Windows\drvstore.dll	mvrsync.exe
File created	C:\Windows\bguiv32.dll	mvrsync.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exevssvc.exemvrsync.exe

description	pid	process
Token: SeDebugPrivilege	2432	00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe
Token: SeBackupPrivilege	3064	vssvc.exe
Token: SeRestorePrivilege	3064	vssvc.exe
Token: SeAuditPrivilege	3064	vssvc.exe
Token: SeDebugPrivilege	1572	mvrsync.exe
Token: SeDebugPrivilege	1572	mvrsync.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe

pid process

2432 00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

mvrsync.exe

pid process

1572 mvrsync.exe
1572 mvrsync.exe

pid	process
2432	00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe

pid	process
1572	mvrsync.exe
1572	mvrsync.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe

description	pid	process	target process
PID 2432 wrote to memory of 1572	2432	00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe	mvrsync.exe
PID 2432 wrote to memory of 1572	2432	00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe	mvrsync.exe
PID 2432 wrote to memory of 1572	2432	00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe	mvrsync.exe
PID 2432 wrote to memory of 1572	2432	00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe	mvrsync.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

mvrsync.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mvrsync.exe
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mvrsync.exe

C:\Users\Admin\AppData\Local\Temp\00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2432

C:\Windows\mvrsync.exe
"C:\Windows\mvrsync.exe" \erit "C:\Users\Admin\AppData\Local\Temp\00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe"
2⤵
- UAC bypass
- Deletes itself
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1572

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3064

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\mvrsync.lnk
Filesize
770B

MD5
ea8e2602e9cbfd8197beb1552b53eef6

SHA1
8010cc3d4e013b157cb8f67ba86733befe627a79

SHA256
c9a173586b89c3fb3d3948c7b17156403d497fe711692807eca5aa93887a09ea

SHA512
79dde9d8227a4bb8a7bd52cc508554fff49c19039feb2770b76c0ffe466a53794fc4dc2dd9dfedbb73f458c3a69b1d192a3a8229296cf7ac6b2b900cb18d526f

Download Submit
C:\Windows\mvrsync.exe
Filesize
130KB

MD5
00b62b4528800a8009bed8bdd9ddf09e

SHA1
c4a37a12f8eb65b002db66d18c77b90dec97a1b9

SHA256
0e7ab7acc0303aef0c0820c23167135ac35ad3a03e836f601059abe325bdfaf9

SHA512
acc8a5f915745c3f1bdbbf53f2aa5b8e75f74c6b1b6aa80000215fd3489128f4c2d9afae7a0bd35aac13029e1bd673ea0346853139ee417521506851d5ca429b

Download Submit
memory/1572-35-0x0000000002350000-0x0000000002360000-memory.dmp

Filesize
64KB

Download
memory/1572-82-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/1572-86-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/1572-37-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/1572-16-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/1572-79-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/1572-22-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/1572-21-0x0000000002350000-0x0000000002360000-memory.dmp

Filesize
64KB

Download
memory/1572-75-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/1572-26-0x0000000075A30000-0x0000000075A31000-memory.dmp

Filesize
4KB

Download
memory/1572-27-0x0000000075A20000-0x0000000075B10000-memory.dmp

Filesize
960KB

Download
memory/1572-28-0x0000000075A20000-0x0000000075B10000-memory.dmp

Filesize
960KB

Download
memory/1572-29-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/1572-32-0x0000000075A20000-0x0000000075B10000-memory.dmp

Filesize
960KB

Download
memory/1572-31-0x0000000002F20000-0x0000000002F2E000-memory.dmp

Filesize
56KB

Download
memory/1572-30-0x0000000000740000-0x0000000000748000-memory.dmp

Filesize
32KB

Download
memory/1572-71-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/1572-34-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/1572-24-0x0000000002F20000-0x0000000002F2E000-memory.dmp

Filesize
56KB

Download
memory/1572-74-0x00000000022D0000-0x00000000022E0000-memory.dmp

Filesize
64KB

Download
memory/1572-47-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/1572-41-0x0000000075A20000-0x0000000075B10000-memory.dmp

Filesize
960KB

Download
memory/1572-40-0x0000000075A20000-0x0000000075B10000-memory.dmp

Filesize
960KB

Download
memory/1572-43-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/1572-50-0x0000000003040000-0x0000000003050000-memory.dmp

Filesize
64KB

Download
memory/1572-42-0x0000000003000000-0x0000000003010000-memory.dmp

Filesize
64KB

Download
memory/1572-51-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/1572-57-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/1572-60-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/1572-67-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/1572-64-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/2432-1-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2432-7-0x0000000003F50000-0x0000000003F60000-memory.dmp

Filesize
64KB

Download
memory/2432-33-0x0000000003F50000-0x00000000040A5000-memory.dmp

Filesize
1.3MB

Download
memory/2432-0-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/2432-15-0x0000000003F50000-0x00000000040A5000-memory.dmp

Filesize
1.3MB

Download
memory/2432-14-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/2432-2-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads