Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 05:54
Behavioral task
behavioral1
Sample
92e4af16e475a6301aea40decf930965_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
92e4af16e475a6301aea40decf930965_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
92e4af16e475a6301aea40decf930965_JaffaCakes118.exe
-
Size
349KB
-
MD5
92e4af16e475a6301aea40decf930965
-
SHA1
096d24f2e5e5925ba4197565f20fb86a6a786d47
-
SHA256
f34392b29b9bd39501c0c8364873d48fddf65a655d3246827c439ab69eeae047
-
SHA512
fd0dbc89857f0d7acb732acafdfc61fb4cd0c6da08af274365063b87d35c28f2fa7776c273dbb3f543d2caf10e99b7a2221ffeea4216c8ab4d566739c2d736b2
-
SSDEEP
6144:kljq8bQCQN9b0syvR8r6PkJeBJejsKs6EPJId6LBtiMdeYv8rGYf14tpOLKRNLtI:18MCQDWQ0KOPDCModKYt474KDL8D
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 16 IoCs
resource yara_rule behavioral2/files/0x0007000000023c8a-23.dat modiloader_stage2 behavioral2/memory/2712-36-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4456-50-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4456-53-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4456-56-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4456-59-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4456-62-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4456-65-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4456-68-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4456-71-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4456-74-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4456-77-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4456-80-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4456-83-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4456-86-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4456-89-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Crypted by L1ghti.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Decrypted.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation 92e4af16e475a6301aea40decf930965_JaffaCakes118.exe -
Executes dropped EXE 3 IoCs
pid Process 4984 Crypted by L1ghti.exe 2712 Decrypted.exe 4456 mstwain32.exe -
Loads dropped DLL 4 IoCs
pid Process 4456 mstwain32.exe 4456 mstwain32.exe 4456 mstwain32.exe 4456 mstwain32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Decrypted.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
resource yara_rule behavioral2/memory/4252-0-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/4252-16-0x0000000000400000-0x000000000040D000-memory.dmp upx -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\mstwain32.exe Decrypted.exe File opened for modification C:\Windows\mstwain32.exe Decrypted.exe File created C:\Windows\ntdtcstp.dll mstwain32.exe File created C:\Windows\cmsetac.dll mstwain32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92e4af16e475a6301aea40decf930965_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Crypted by L1ghti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Decrypted.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstwain32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2712 Decrypted.exe Token: SeDebugPrivilege 4456 mstwain32.exe Token: SeDebugPrivilege 4456 mstwain32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4984 Crypted by L1ghti.exe 4456 mstwain32.exe 4456 mstwain32.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4252 wrote to memory of 4984 4252 92e4af16e475a6301aea40decf930965_JaffaCakes118.exe 83 PID 4252 wrote to memory of 4984 4252 92e4af16e475a6301aea40decf930965_JaffaCakes118.exe 83 PID 4252 wrote to memory of 4984 4252 92e4af16e475a6301aea40decf930965_JaffaCakes118.exe 83 PID 4984 wrote to memory of 2712 4984 Crypted by L1ghti.exe 84 PID 4984 wrote to memory of 2712 4984 Crypted by L1ghti.exe 84 PID 4984 wrote to memory of 2712 4984 Crypted by L1ghti.exe 84 PID 2712 wrote to memory of 4456 2712 Decrypted.exe 85 PID 2712 wrote to memory of 4456 2712 Decrypted.exe 85 PID 2712 wrote to memory of 4456 2712 Decrypted.exe 85 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\92e4af16e475a6301aea40decf930965_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\92e4af16e475a6301aea40decf930965_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\Crypted by L1ghti.exe"C:\Users\Admin\AppData\Local\Temp\Crypted by L1ghti.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\Decrypted.exe"C:\Users\Admin\AppData\Local\Temp\Decrypted.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"4⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4456
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
291KB
MD5d6694475b71593c24ab2963b4e262935
SHA164e6494029c0fc4c2910c49d30acb2fe6d63d439
SHA256b6f138597ce5371e8c41a12b4f8c94a6e9f771cb1c072824b7579ea23458dfee
SHA5125ec68f97f919454d449b249b403a73b0720bc27329dc4645df184e0136224be9594233490926186f324768476d178667e51cee6e61e6c88889e83af73409025d
-
Filesize
271KB
MD53da683a3b0deb6eb5374e9b8151abd04
SHA195d4d99bf6a1f4739f528be1393b28d7e23a70cf
SHA25605d3dd97bcca5c691c87171a6138c8e62e4c088b597d0fe1d53445215d24ab3f
SHA512cb25fdcc70b825917f6d621ba30a97e75e68902bf6f662b32772c6c5a6959c3c969e18963045d5210e728e5782bf8c792ae49cf7c93e751fabc81c1ef0865ecd
-
Filesize
33KB
MD51fd3a458b233acbf49d39b6a9ba38c31
SHA1226905e672824ea74d184e57b883950229fd75a9
SHA25657f00899b43fcb331866c344d517cd46ba2d63d56581f1de69803dd4adf47c70
SHA5122e18df9b61c51f9531752accfa9f1caf84b94852d62640fcdb1af99534275f8a974b199e5fecaa838f405a9196bebdd1053991b2d086b3fece7464e2acc3c06e
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350