Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 18:44
Behavioral task
behavioral1
Sample
ebf86e06b3e60eb7989e8360c584637e_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ebf86e06b3e60eb7989e8360c584637e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ebf86e06b3e60eb7989e8360c584637e_JaffaCakes118.exe
-
Size
207KB
-
MD5
ebf86e06b3e60eb7989e8360c584637e
-
SHA1
2f314e2cc1c0584e6119c24550d1d90d253b4eba
-
SHA256
75427846d6a5f1318d86c73853dfd10398079b9953a7c430a2dde36d801c792b
-
SHA512
2ab0fa898a052b3983e13c8d8b9c8a0d40e8bc378ad4f9fae2d679eaf2eee98102d6a2288a5b98539135758044f5711935bc058758fa6177ac6fcb785dbbaa68
-
SSDEEP
3072:i1+MJKrUnFYY5z1i0Nmbi5fJBNPmUpQzkkoutn7:iIrPj0NmWtN3IoS
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 17 IoCs
resource yara_rule behavioral1/memory/1628-12-0x0000000000400000-0x0000000000480000-memory.dmp modiloader_stage2 behavioral1/memory/2948-20-0x00000000757B0000-0x00000000758A0000-memory.dmp modiloader_stage2 behavioral1/memory/2948-21-0x0000000000400000-0x0000000000480000-memory.dmp modiloader_stage2 behavioral1/memory/2948-23-0x0000000000400000-0x0000000000480000-memory.dmp modiloader_stage2 behavioral1/memory/2948-27-0x0000000000400000-0x0000000000480000-memory.dmp modiloader_stage2 behavioral1/memory/2948-30-0x0000000000400000-0x0000000000480000-memory.dmp modiloader_stage2 behavioral1/memory/2948-33-0x0000000000400000-0x0000000000480000-memory.dmp modiloader_stage2 behavioral1/memory/2948-36-0x0000000000400000-0x0000000000480000-memory.dmp modiloader_stage2 behavioral1/memory/2948-39-0x0000000000400000-0x0000000000480000-memory.dmp modiloader_stage2 behavioral1/memory/2948-42-0x0000000000400000-0x0000000000480000-memory.dmp modiloader_stage2 behavioral1/memory/2948-45-0x0000000000400000-0x0000000000480000-memory.dmp modiloader_stage2 behavioral1/memory/2948-48-0x0000000000400000-0x0000000000480000-memory.dmp modiloader_stage2 behavioral1/memory/2948-51-0x0000000000400000-0x0000000000480000-memory.dmp modiloader_stage2 behavioral1/memory/2948-54-0x0000000000400000-0x0000000000480000-memory.dmp modiloader_stage2 behavioral1/memory/2948-57-0x0000000000400000-0x0000000000480000-memory.dmp modiloader_stage2 behavioral1/memory/2948-60-0x0000000000400000-0x0000000000480000-memory.dmp modiloader_stage2 behavioral1/memory/2948-63-0x0000000000400000-0x0000000000480000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 2948 mstwain32.exe -
resource yara_rule behavioral1/memory/1628-0-0x0000000000400000-0x0000000000480000-memory.dmp upx behavioral1/memory/1628-12-0x0000000000400000-0x0000000000480000-memory.dmp upx behavioral1/files/0x0005000000011c2f-10.dat upx behavioral1/memory/2948-20-0x00000000757B0000-0x00000000758A0000-memory.dmp upx behavioral1/memory/2948-21-0x0000000000400000-0x0000000000480000-memory.dmp upx behavioral1/memory/2948-23-0x0000000000400000-0x0000000000480000-memory.dmp upx behavioral1/memory/2948-27-0x0000000000400000-0x0000000000480000-memory.dmp upx behavioral1/memory/2948-30-0x0000000000400000-0x0000000000480000-memory.dmp upx behavioral1/memory/2948-33-0x0000000000400000-0x0000000000480000-memory.dmp upx behavioral1/memory/2948-36-0x0000000000400000-0x0000000000480000-memory.dmp upx behavioral1/memory/2948-39-0x0000000000400000-0x0000000000480000-memory.dmp upx behavioral1/memory/2948-42-0x0000000000400000-0x0000000000480000-memory.dmp upx behavioral1/memory/2948-45-0x0000000000400000-0x0000000000480000-memory.dmp upx behavioral1/memory/2948-48-0x0000000000400000-0x0000000000480000-memory.dmp upx behavioral1/memory/2948-51-0x0000000000400000-0x0000000000480000-memory.dmp upx behavioral1/memory/2948-54-0x0000000000400000-0x0000000000480000-memory.dmp upx behavioral1/memory/2948-57-0x0000000000400000-0x0000000000480000-memory.dmp upx behavioral1/memory/2948-60-0x0000000000400000-0x0000000000480000-memory.dmp upx behavioral1/memory/2948-63-0x0000000000400000-0x0000000000480000-memory.dmp upx -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ebf86e06b3e60eb7989e8360c584637e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\mstwain32.exe ebf86e06b3e60eb7989e8360c584637e_JaffaCakes118.exe File created C:\Windows\ntdtcstp.dll mstwain32.exe File created C:\Windows\cmsetac.dll mstwain32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ebf86e06b3e60eb7989e8360c584637e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstwain32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1628 ebf86e06b3e60eb7989e8360c584637e_JaffaCakes118.exe Token: SeDebugPrivilege 2948 mstwain32.exe Token: SeDebugPrivilege 2948 mstwain32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1628 ebf86e06b3e60eb7989e8360c584637e_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2948 mstwain32.exe 2948 mstwain32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1628 wrote to memory of 2948 1628 ebf86e06b3e60eb7989e8360c584637e_JaffaCakes118.exe 30 PID 1628 wrote to memory of 2948 1628 ebf86e06b3e60eb7989e8360c584637e_JaffaCakes118.exe 30 PID 1628 wrote to memory of 2948 1628 ebf86e06b3e60eb7989e8360c584637e_JaffaCakes118.exe 30 PID 1628 wrote to memory of 2948 1628 ebf86e06b3e60eb7989e8360c584637e_JaffaCakes118.exe 30 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebf86e06b3e60eb7989e8360c584637e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ebf86e06b3e60eb7989e8360c584637e_JaffaCakes118.exe"1⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2948
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
207KB
MD5ebf86e06b3e60eb7989e8360c584637e
SHA12f314e2cc1c0584e6119c24550d1d90d253b4eba
SHA25675427846d6a5f1318d86c73853dfd10398079b9953a7c430a2dde36d801c792b
SHA5122ab0fa898a052b3983e13c8d8b9c8a0d40e8bc378ad4f9fae2d679eaf2eee98102d6a2288a5b98539135758044f5711935bc058758fa6177ac6fcb785dbbaa68