Analysis

  • max time kernel
    145s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 19:44

General

  • Target

    0931569294082db5bc50e4d2c857ebe6_JaffaCakes118.exe

  • Size

    905KB

  • MD5

    0931569294082db5bc50e4d2c857ebe6

  • SHA1

    d0b899ac729cd721cfbd1c854d0bccad121a221c

  • SHA256

    b7b69122f524005c5466759233911deb0397d1922b6c9ac77041f0190c5ed9cb

  • SHA512

    dc507e8fb96fff66fe88a2757dbd2753a97815b57e33fa97dc420d8aa3acd9326b5fdfcfa61d9d5bdb4d33b7253f66a7b51690578482401687b1e5f56da03dce

  • SSDEEP

    24576:YKwQrsiK3Sr0ckHCb2/xg348uS8o2wYyGv:YKl83VckHLf8uLoLGv

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • UAC bypass 3 TTPs 1 IoCs
  • ModiLoader Second Stage 20 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • System policy modification 1 TTPs 1 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0931569294082db5bc50e4d2c857ebe6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0931569294082db5bc50e4d2c857ebe6_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Users\Admin\AppData\Local\Temp\0931569294082db5bc50e4d2c857ebe6_JaffaCakes118.EXE
      0931569294082db5bc50e4d2c857ebe6_JaffaCakes118.EXE
      2⤵
      • Checks whether UAC is enabled
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2644
      • C:\Windows\mstwain32.exe
        "C:\Windows\mstwain32.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3064
        • C:\Windows\mstwain32.EXE
          mstwain32.EXE
          4⤵
          • UAC bypass
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:2064
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2728

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\mstwain32.exe

    Filesize

    905KB

    MD5

    0931569294082db5bc50e4d2c857ebe6

    SHA1

    d0b899ac729cd721cfbd1c854d0bccad121a221c

    SHA256

    b7b69122f524005c5466759233911deb0397d1922b6c9ac77041f0190c5ed9cb

    SHA512

    dc507e8fb96fff66fe88a2757dbd2753a97815b57e33fa97dc420d8aa3acd9326b5fdfcfa61d9d5bdb4d33b7253f66a7b51690578482401687b1e5f56da03dce

  • \??\c:\users\admin\appdata\local\temp\00000000

    Filesize

    14B

    MD5

    abece9ec8be09ae8f847e3d6fbf65c43

    SHA1

    0fdb8d6ab3b43f40454e525130a6301258281054

    SHA256

    bbe64c2160ae5ed6ed7593d6bb1b2def1483f8a471f4449ed7beb24e326412a2

    SHA512

    915ce12b768a84c85935c581c9b949928c07cecb7336317f55eedf053ed2cca867725ab7b6e96b0a8a6847d35cc67a388015c223127fa5793bec40cc18721d29

  • memory/2064-68-0x0000000001EF0000-0x0000000001EFE000-memory.dmp

    Filesize

    56KB

  • memory/2064-66-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2064-75-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2064-72-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2064-69-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2064-67-0x00000000002B0000-0x00000000002B8000-memory.dmp

    Filesize

    32KB

  • memory/2064-82-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2064-78-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2064-58-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2064-65-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2064-63-0x0000000001EF0000-0x0000000001EFE000-memory.dmp

    Filesize

    56KB

  • memory/2064-85-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2064-59-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2240-21-0x0000000000400000-0x00000000007AC01A-memory.dmp

    Filesize

    3.7MB

  • memory/2644-9-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2644-5-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2644-8-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2644-34-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2644-23-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2644-22-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2644-20-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2644-32-0x0000000000720000-0x00000000008A1000-memory.dmp

    Filesize

    1.5MB

  • memory/2644-3-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2644-11-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2644-13-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2644-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2644-19-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2644-15-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/3064-57-0x0000000000400000-0x00000000007AC01A-memory.dmp

    Filesize

    3.7MB