Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 22:23

General

  • Target

    09c85491ac1f04ddd9af3153b1b0c176_JaffaCakes118.exe

  • Size

    1.3MB

  • MD5

    09c85491ac1f04ddd9af3153b1b0c176

  • SHA1

    810d7c8d3d50fa00b48a40b7583bc343075fb1b4

  • SHA256

    e7a90472880c7dc6596332555888e72ebc7cf41e21917a47d20c4bec398e7b84

  • SHA512

    117bc618e885aa10c414ba4dd74d73c3c39f72957dc8a82e785156b1055ccae09e88d03fbc524d00dae499c4ed489071ae190812d7efef5bcf74def551ad2d99

  • SSDEEP

    24576:NaHMv6Corjqny/Qj5lZz5yEeY597/Fv3JbxEiv4A7WJ0:N1vqjd/QNzEEeG97/Fv3fEEMJ0

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • UAC bypass 3 TTPs 1 IoCs
  • ModiLoader Second Stage 23 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • System policy modification 1 TTPs 1 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\09c85491ac1f04ddd9af3153b1b0c176_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\09c85491ac1f04ddd9af3153b1b0c176_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1644
    • C:\Users\Admin\AppData\Local\Temp\09c85491ac1f04ddd9af3153b1b0c176_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\09c85491ac1f04ddd9af3153b1b0c176_JaffaCakes118.exe"
      2⤵
      • Checks whether UAC is enabled
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:324
      • C:\Windows\mstwain32.exe
        "C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\09c85491ac1f04ddd9af3153b1b0c176_JaffaCakes118.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2916
        • C:\Windows\mstwain32.exe
          "C:\Windows\mstwain32.exe"
          4⤵
          • UAC bypass
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:1948
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2636

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\mstwain32.exe

    Filesize

    1.3MB

    MD5

    09c85491ac1f04ddd9af3153b1b0c176

    SHA1

    810d7c8d3d50fa00b48a40b7583bc343075fb1b4

    SHA256

    e7a90472880c7dc6596332555888e72ebc7cf41e21917a47d20c4bec398e7b84

    SHA512

    117bc618e885aa10c414ba4dd74d73c3c39f72957dc8a82e785156b1055ccae09e88d03fbc524d00dae499c4ed489071ae190812d7efef5bcf74def551ad2d99

  • memory/324-10-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/324-6-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/324-3-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/324-8-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/324-9-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/324-0-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/324-12-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/324-11-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/324-13-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/324-14-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/324-4-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/324-24-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1948-37-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1948-55-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1948-34-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1948-36-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1948-41-0x0000000000280000-0x000000000028E000-memory.dmp

    Filesize

    56KB

  • memory/1948-43-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1948-45-0x0000000000280000-0x000000000028E000-memory.dmp

    Filesize

    56KB

  • memory/1948-44-0x0000000000220000-0x0000000000228000-memory.dmp

    Filesize

    32KB

  • memory/1948-46-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1948-49-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1948-52-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1948-35-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1948-59-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1948-62-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1948-65-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1948-68-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1948-71-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1948-74-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1948-77-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1948-80-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1948-83-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB