Analysis
- max time kernel
146s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240319-en - resource tags
- submitted
08/04/2024, 09:41
General
- Target e729dde1686d998ec6543343be4b50a8_JaffaCakes118.exe
- Size 601KB
- Sample240408-ln6q7aeb33
- SHA256 e51643e4363098a8228bce9ee14eeb9439f04f975912d56ae60798706d341fbc
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 4 IoCs
- Executes dropped EXE 1 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 3 IoCs
- Program crash 2 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e729dde1686d998ec6543343be4b50a8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e729dde1686d998ec6543343be4b50a8_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\ctefmon.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\ctefmon.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\system32\mstsc.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 244⤵
- Program crash
-
-
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 6883⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat""2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3704 -ip 37041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2836 -ip 28361⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=2260,i,3739451884007376837,4900555371550671478,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DelSvel.bat
ctefmon.exe
memory/2836-58-0x0000000000400000-0x00000000005A5000-memory.dmp
memory/2836-82-0x0000000003450000-0x0000000003550000-memory.dmp
memory/2836-129-0x0000000000400000-0x00000000005A5000-memory.dmp
memory/3516-42-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-45-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-3-0x0000000002590000-0x0000000002591000-memory.dmp
memory/3516-5-0x0000000002570000-0x0000000002571000-memory.dmp
memory/3516-25-0x0000000003550000-0x0000000003551000-memory.dmp
memory/3516-23-0x0000000003550000-0x0000000003551000-memory.dmp
memory/3516-22-0x0000000003550000-0x0000000003551000-memory.dmp
memory/3516-21-0x0000000003550000-0x0000000003551000-memory.dmp
memory/3516-20-0x0000000003550000-0x0000000003551000-memory.dmp
memory/3516-19-0x0000000003550000-0x0000000003551000-memory.dmp
memory/3516-18-0x0000000003550000-0x0000000003551000-memory.dmp
memory/3516-17-0x0000000003550000-0x0000000003551000-memory.dmp
memory/3516-27-0x0000000000400000-0x00000000005A5000-memory.dmp
memory/3516-28-0x0000000003550000-0x0000000003551000-memory.dmp
memory/3516-26-0x0000000003550000-0x0000000003551000-memory.dmp
memory/3516-16-0x0000000003550000-0x0000000003551000-memory.dmp
memory/3516-15-0x0000000003550000-0x0000000003551000-memory.dmp
memory/3516-44-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-13-0x0000000003560000-0x0000000003561000-memory.dmp
memory/3516-12-0x0000000003560000-0x0000000003561000-memory.dmp
memory/3516-11-0x0000000003560000-0x0000000003561000-memory.dmp
memory/3516-10-0x0000000002580000-0x0000000002581000-memory.dmp
memory/3516-9-0x00000000025F0000-0x00000000025F1000-memory.dmp
memory/3516-8-0x00000000025C0000-0x00000000025C1000-memory.dmp
memory/3516-7-0x00000000025D0000-0x00000000025D1000-memory.dmp
memory/3516-6-0x0000000002560000-0x0000000002561000-memory.dmp
memory/3516-24-0x0000000003550000-0x0000000003551000-memory.dmp
memory/3516-4-0x00000000025E0000-0x00000000025E1000-memory.dmp
memory/3516-29-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-40-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-41-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-1-0x00000000023B0000-0x0000000002404000-memory.dmp
memory/3516-2-0x00000000025B0000-0x00000000025B1000-memory.dmp
memory/3516-43-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-14-0x0000000003560000-0x0000000003561000-memory.dmp
memory/3516-46-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-47-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-48-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-49-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-50-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-53-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-56-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-55-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-59-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-62-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-63-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-57-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-65-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-67-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-69-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-68-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-70-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-71-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-72-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-73-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-74-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-75-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-76-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-77-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-79-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-78-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-80-0x0000000003550000-0x0000000003650000-memory.dmp
memory/3516-81-0x0000000002550000-0x0000000002551000-memory.dmp
memory/3516-0-0x0000000000400000-0x00000000005A5000-memory.dmp
memory/3516-126-0x0000000000400000-0x00000000005A5000-memory.dmp
memory/3704-64-0x0000000000400000-0x00000000005A5000-memory.dmp