modiloader | 0e7ab7acc0303aef0c0820c23167135ac35ad3a03e836f601059abe325bdfaf9

General

Target

00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe
Size

130KB
MD5

00b62b4528800a8009bed8bdd9ddf09e
SHA1

c4a37a12f8eb65b002db66d18c77b90dec97a1b9
SHA256

0e7ab7acc0303aef0c0820c23167135ac35ad3a03e836f601059abe325bdfaf9
SHA512

acc8a5f915745c3f1bdbbf53f2aa5b8e75f74c6b1b6aa80000215fd3489128f4c2d9afae7a0bd35aac13029e1bd673ea0346853139ee417521506851d5ca429b
SSDEEP

3072:J84G+rAP0gCvpBTnXi0QCrqFfQshCCIAn5bK2znUImPout:JfYPQvp5Xi0J2QQX+QUDoS

Score

10^/10

modiloader evasion trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

mvrsync.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mvrsync.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mvrsync.exe

ModiLoader Second Stage 16 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3152-12-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral2/memory/3188-29-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral2/memory/3188-33-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral2/memory/3188-35-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral2/memory/3188-38-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral2/memory/3188-42-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral2/memory/3188-45-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral2/memory/3188-50-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral2/memory/3188-53-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral2/memory/3188-57-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral2/memory/3188-60-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral2/memory/3188-64-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral2/memory/3188-67-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral2/memory/3188-71-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral2/memory/3188-74-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral2/memory/3188-78-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

mvrsync.exe

pid process

3188 mvrsync.exe
Executes dropped EXE 1 IoCs

Processes:

mvrsync.exe

pid process

3188 mvrsync.exe
Loads dropped DLL 4 IoCs

Processes:

mvrsync.exe

pid process

3188 mvrsync.exe
3188 mvrsync.exe
3188 mvrsync.exe
3188 mvrsync.exe

pid	process
3188	mvrsync.exe

pid	process
3188	mvrsync.exe

pid	process
3188	mvrsync.exe
3188	mvrsync.exe
3188	mvrsync.exe
3188	mvrsync.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3152-0-0x0000000000400000-0x0000000000555000-memory.dmp	upx
C:\Windows\mvrsync.exe	upx
behavioral2/memory/3188-13-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral2/memory/3152-12-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral2/memory/3188-29-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral2/memory/3188-33-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral2/memory/3188-35-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral2/memory/3188-38-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral2/memory/3188-42-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral2/memory/3188-45-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral2/memory/3188-50-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral2/memory/3188-53-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral2/memory/3188-57-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral2/memory/3188-60-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral2/memory/3188-64-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral2/memory/3188-67-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral2/memory/3188-71-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral2/memory/3188-74-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral2/memory/3188-78-0x0000000000400000-0x0000000000555000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exemvrsync.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mvrsync.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mvrsync.exe

Drops file in Windows directory 4 IoCs

Processes:

00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exemvrsync.exe

description	ioc	process
File created	C:\Windows\mvrsync.exe	00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe
File opened for modification	C:\Windows\mvrsync.exe	00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe
File created	C:\Windows\drvstore.dll	mvrsync.exe
File created	C:\Windows\bguiv32.dll	mvrsync.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exevssvc.exemvrsync.exe

description	pid	process
Token: SeDebugPrivilege	3152	00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe
Token: SeBackupPrivilege	4640	vssvc.exe
Token: SeRestorePrivilege	4640	vssvc.exe
Token: SeAuditPrivilege	4640	vssvc.exe
Token: SeDebugPrivilege	3188	mvrsync.exe
Token: SeDebugPrivilege	3188	mvrsync.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

mvrsync.exe

pid process

3188 mvrsync.exe
3188 mvrsync.exe

pid	process
3188	mvrsync.exe
3188	mvrsync.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe

description	pid	process	target process
PID 3152 wrote to memory of 3188	3152	00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe	mvrsync.exe
PID 3152 wrote to memory of 3188	3152	00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe	mvrsync.exe
PID 3152 wrote to memory of 3188	3152	00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe	mvrsync.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

mvrsync.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mvrsync.exe
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mvrsync.exe

C:\Users\Admin\AppData\Local\Temp\00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152

C:\Windows\mvrsync.exe
"C:\Windows\mvrsync.exe" \erit "C:\Users\Admin\AppData\Local\Temp\00b62b4528800a8009bed8bdd9ddf09e_JaffaCakes118.exe"
2⤵
- UAC bypass
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3188

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4640

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\bguiv32.dll
Filesize
33KB

MD5
fd752a870d943a183222e50a42e27b00

SHA1
0b4364dc6ecedded0b2e1251e1a78a63e7001675

SHA256
c0643798b8e0c4385ce6f1938fc2cdee4723a131fd59fd85258659a6845f97e3

SHA512
89dc2f0734f6b1c4a3c09921157f9afb3cefbe7e57ed7e8b0025d2bb0621e6e80ce767c480954e5dd0ff2e2b4d2aeef3d8742a75f3beab8f38c35d1f9d059c68

Download Submit
C:\Windows\drvstore.dll
Filesize
7KB

MD5
4e390e571995682798626a5e23d45629

SHA1
5986e1578878c1c3c7f0d9a224946b17fc2e7b0f

SHA256
fa00c11a01a9c4db01bbb76d0d80e12a69a5f9f45f5c295fed3d4210418f4940

SHA512
d2e11ac01d6348f6cf82995767d13f9c8e687a35b2715021568a366a7d81eb5fd25f1ca9d8cd1da63f79c6eda5c8ae396a09fdfae79e66c054e7404339953b9d

Download Submit
C:\Windows\mvrsync.exe
Filesize
130KB

MD5
00b62b4528800a8009bed8bdd9ddf09e

SHA1
c4a37a12f8eb65b002db66d18c77b90dec97a1b9

SHA256
0e7ab7acc0303aef0c0820c23167135ac35ad3a03e836f601059abe325bdfaf9

SHA512
acc8a5f915745c3f1bdbbf53f2aa5b8e75f74c6b1b6aa80000215fd3489128f4c2d9afae7a0bd35aac13029e1bd673ea0346853139ee417521506851d5ca429b

Download Submit
memory/3152-1-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/3152-0-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/3152-12-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/3188-29-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/3188-45-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/3188-26-0x00000000036C0000-0x00000000036CE000-memory.dmp

Filesize
56KB

Download
memory/3188-32-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/3188-31-0x00000000036C0000-0x00000000036CE000-memory.dmp

Filesize
56KB

Download
memory/3188-30-0x0000000002470000-0x0000000002478000-memory.dmp

Filesize
32KB

Download
memory/3188-13-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/3188-33-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/3188-35-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/3188-38-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/3188-42-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/3188-22-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/3188-50-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/3188-53-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/3188-57-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/3188-60-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/3188-64-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/3188-67-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/3188-71-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/3188-74-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/3188-78-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads