Analysis
-
max time kernel
144s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 22:27
Static task
static1
Behavioral task
behavioral1
Sample
fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe
-
Size
252KB
-
MD5
fd5d63f230d8b475e37185980c200e32
-
SHA1
c0a1fcf744ba9a573808a2b3ccfdc0b603df1e82
-
SHA256
c981ccd9205cad12b579ec2013d4607bf3991599dae9e3f6252b8f0062289c0e
-
SHA512
d180e2860ac355a4261d616c704506688dbb3b3f47b1b7b4bfa6d2e6a6c20c2108406bcfb7880631240311f4b7a7f41a756764e4d82dd09fba375b37c4f8e702
-
SSDEEP
3072:UtaNyG3P2zKb1iPk/6mUUczdZeo3IFeAmQSEPll+WwnYAo7RDwHMJBdIENT0r:V7R6mkMoYFRmqWWP7tcCT
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 24 IoCs
resource yara_rule behavioral2/memory/5104-6-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/5104-18-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/5104-22-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4540-29-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4540-30-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4540-31-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4540-38-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4540-44-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4540-45-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4540-46-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4540-49-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4540-50-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4540-53-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4540-56-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4540-59-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4540-62-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4540-65-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4540-68-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4540-71-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4540-74-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4540-77-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4540-80-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4540-83-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4540-86-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
pid Process 2280 mstwain32.exe 4540 mstwain32.exe -
Loads dropped DLL 4 IoCs
pid Process 4540 mstwain32.exe 4540 mstwain32.exe 4540 mstwain32.exe 4540 mstwain32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4048 set thread context of 5104 4048 fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe 83 PID 2280 set thread context of 4540 2280 mstwain32.exe 88 -
resource yara_rule behavioral2/memory/5104-2-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/5104-4-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/5104-5-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/5104-6-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/5104-18-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/5104-22-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4540-28-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4540-29-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4540-30-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4540-31-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4540-38-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4540-44-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4540-45-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4540-46-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4540-49-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4540-50-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4540-53-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4540-56-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4540-59-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4540-62-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4540-65-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4540-68-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4540-71-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4540-74-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4540-77-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4540-80-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4540-83-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4540-86-0x0000000000400000-0x0000000000450000-memory.dmp upx -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\mstwain32.exe fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe File opened for modification C:\Windows\mstwain32.exe fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe File created C:\Windows\ntdtcstp.dll mstwain32.exe File created C:\Windows\cmsetac.dll mstwain32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstwain32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstwain32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 5104 fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe Token: SeBackupPrivilege 3416 vssvc.exe Token: SeRestorePrivilege 3416 vssvc.exe Token: SeAuditPrivilege 3416 vssvc.exe Token: SeDebugPrivilege 4540 mstwain32.exe Token: SeDebugPrivilege 4540 mstwain32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4048 fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe 2280 mstwain32.exe 4540 mstwain32.exe 4540 mstwain32.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4048 wrote to memory of 5104 4048 fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe 83 PID 4048 wrote to memory of 5104 4048 fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe 83 PID 4048 wrote to memory of 5104 4048 fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe 83 PID 4048 wrote to memory of 5104 4048 fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe 83 PID 4048 wrote to memory of 5104 4048 fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe 83 PID 4048 wrote to memory of 5104 4048 fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe 83 PID 4048 wrote to memory of 5104 4048 fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe 83 PID 4048 wrote to memory of 5104 4048 fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe 83 PID 5104 wrote to memory of 2280 5104 fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe 87 PID 5104 wrote to memory of 2280 5104 fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe 87 PID 5104 wrote to memory of 2280 5104 fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe 87 PID 2280 wrote to memory of 4540 2280 mstwain32.exe 88 PID 2280 wrote to memory of 4540 2280 mstwain32.exe 88 PID 2280 wrote to memory of 4540 2280 mstwain32.exe 88 PID 2280 wrote to memory of 4540 2280 mstwain32.exe 88 PID 2280 wrote to memory of 4540 2280 mstwain32.exe 88 PID 2280 wrote to memory of 4540 2280 mstwain32.exe 88 PID 2280 wrote to memory of 4540 2280 mstwain32.exe 88 PID 2280 wrote to memory of 4540 2280 mstwain32.exe 88 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe2⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\fd5d63f230d8b475e37185980c200e32_JaffaCakes118.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\mstwain32.exeC:\Windows\mstwain32.exe4⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4540
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3416
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD52e7e406205378faa85fcdbf7d2d2d506
SHA1070797d2c41da08ec39f2e9f794e97376c0101dd
SHA256283a5451fd551a2bda5ab598afa45560267d2f4619676a7dbe47077ffe276cf5
SHA512f2720588f3f1355d843041a53aec89c944ae99032ae44431b73b98a8dc8367dc61c4ae8a21ac0458e2e52cbf0fe986d9f877a6dca62fd40162db9359a0eaf467
-
Filesize
252KB
MD5fd5d63f230d8b475e37185980c200e32
SHA1c0a1fcf744ba9a573808a2b3ccfdc0b603df1e82
SHA256c981ccd9205cad12b579ec2013d4607bf3991599dae9e3f6252b8f0062289c0e
SHA512d180e2860ac355a4261d616c704506688dbb3b3f47b1b7b4bfa6d2e6a6c20c2108406bcfb7880631240311f4b7a7f41a756764e4d82dd09fba375b37c4f8e702
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350