Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2024 22:23

General

  • Target

    09c85491ac1f04ddd9af3153b1b0c176_JaffaCakes118.exe

  • Size

    1.3MB

  • MD5

    09c85491ac1f04ddd9af3153b1b0c176

  • SHA1

    810d7c8d3d50fa00b48a40b7583bc343075fb1b4

  • SHA256

    e7a90472880c7dc6596332555888e72ebc7cf41e21917a47d20c4bec398e7b84

  • SHA512

    117bc618e885aa10c414ba4dd74d73c3c39f72957dc8a82e785156b1055ccae09e88d03fbc524d00dae499c4ed489071ae190812d7efef5bcf74def551ad2d99

  • SSDEEP

    24576:NaHMv6Corjqny/Qj5lZz5yEeY597/Fv3JbxEiv4A7WJ0:N1vqjd/QNzEEeG97/Fv3fEEMJ0

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • UAC bypass 3 TTPs 1 IoCs
  • ModiLoader Second Stage 20 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • System policy modification 1 TTPs 1 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\09c85491ac1f04ddd9af3153b1b0c176_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\09c85491ac1f04ddd9af3153b1b0c176_JaffaCakes118.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3024
    • C:\Users\Admin\AppData\Local\Temp\09c85491ac1f04ddd9af3153b1b0c176_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\09c85491ac1f04ddd9af3153b1b0c176_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • Checks whether UAC is enabled
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3236
      • C:\Windows\mstwain32.exe
        "C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\09c85491ac1f04ddd9af3153b1b0c176_JaffaCakes118.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4380
        • C:\Windows\mstwain32.exe
          "C:\Windows\mstwain32.exe"
          4⤵
          • UAC bypass
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:2568
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4872
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4196,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:8
    1⤵
      PID:3768

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\cmsetac.dll

      Filesize

      32KB

      MD5

      99c177072f4a033242ea7c92f8ea6890

      SHA1

      c3dbcf2c1132fa0a6c896bfc7b690e1496e5b603

      SHA256

      9e6bd63e66630bfe6464952000b6d27b4aff090e0e9c9923bb0a6027fde93ec0

      SHA512

      f35fd7b9e54ddf2466f3a25dcd74b889ad61d4963b9044b2d2366a937d5ae31c9cb0b6e4c160f8b5db53361ea29bd2fbd47e4db42b4bf49e4d4c56d40a3bb5b4

    • C:\Windows\mstwain32.exe

      Filesize

      1.3MB

      MD5

      09c85491ac1f04ddd9af3153b1b0c176

      SHA1

      810d7c8d3d50fa00b48a40b7583bc343075fb1b4

      SHA256

      e7a90472880c7dc6596332555888e72ebc7cf41e21917a47d20c4bec398e7b84

      SHA512

      117bc618e885aa10c414ba4dd74d73c3c39f72957dc8a82e785156b1055ccae09e88d03fbc524d00dae499c4ed489071ae190812d7efef5bcf74def551ad2d99

    • C:\Windows\ntdtcstp.dll

      Filesize

      7KB

      MD5

      67587e25a971a141628d7f07bd40ffa0

      SHA1

      76fcd014539a3bb247cc0b761225f68bd6055f6b

      SHA256

      e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

      SHA512

      6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

    • memory/2568-38-0x0000000000A50000-0x0000000000A58000-memory.dmp

      Filesize

      32KB

    • memory/2568-58-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/2568-76-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/2568-73-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/2568-24-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/2568-25-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/2568-23-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/2568-70-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/2568-67-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/2568-35-0x00000000033D0000-0x00000000033DE000-memory.dmp

      Filesize

      56KB

    • memory/2568-37-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/2568-64-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/2568-39-0x00000000033D0000-0x00000000033DE000-memory.dmp

      Filesize

      56KB

    • memory/2568-40-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/2568-43-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/2568-46-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/2568-49-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/2568-52-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/2568-55-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/2568-61-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/3236-4-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/3236-0-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/3236-2-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/3236-3-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/3236-21-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/3236-1-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB