Analysis

  • max time kernel
    31s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    20-04-2024 05:20

General

  • Target

    fc03dd697d1e1e6a3854b08b6495aff9_JaffaCakes118.exe

  • Size

    719KB

  • MD5

    fc03dd697d1e1e6a3854b08b6495aff9

  • SHA1

    8bcbeaab1428a488403a383984ea908a52ff568d

  • SHA256

    bb41dddfefc9a6129c46645fcfaba2ea90cf4f55f6f54df2702c7c553ba61952

  • SHA512

    e9a4328be43e6221537e595f26f69b4a66b8b242ad16576c48f3dd9f3e6f239ad746b2b16a69e12ab657c87c536ccc97c8d0fe0bd0a2f4a84f99e82d77307b81

  • SSDEEP

    12288:6XgPVmsO7H+JeYkZQors8sEyMGXxe/lX4EEPSwDfAmgBJbf8AwnBrRm8dZ/X:AoZ3J78GQX4bEmCb+rRvZ/X

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • ModiLoader Second Stage 2 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 18 IoCs
  • Adds Run key to start application 2 TTPs 30 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fc03dd697d1e1e6a3854b08b6495aff9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fc03dd697d1e1e6a3854b08b6495aff9_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Users\Admin\B85EgtCQKi4p6Z9Kt2.exe
      B85EgtCQKi4p6Z9Kt2.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3008
      • C:\Users\Admin\xhjic.exe
        "C:\Users\Admin\xhjic.exe"
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1140
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del B85EgtCQKi4p6Z9Kt2.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1696
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:1904
    • C:\Users\Admin\cod.exe
      cod.exe
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of AdjustPrivilegeToken
      PID:2628
    • C:\Users\Admin\cof.exe
      cof.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2588
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\KBDE1406.dll",Startup
        3⤵
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2044
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\KBDE1406.dll",iep
          4⤵
          • Loads dropped DLL
          PID:472
    • C:\Users\Admin\cog.exe
      cog.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2680
      • C:\Users\Admin\cog.exe
        cog.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:2164
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c del fc03dd697d1e1e6a3854b08b6495aff9_JaffaCakes118.exe
      2⤵
      • Deletes itself
      PID:2732

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Modify Registry

2
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Discovery

System Information Discovery

1
T1082

Process Discovery

1
T1057

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\KBDE1406.dll
    Filesize

    103KB

    MD5

    be60099ceffb0aece0bc0c52998e9d65

    SHA1

    6ff11181390b5eccfb9a832ea5311d58bcc7a3a3

    SHA256

    e41f195954abff7c7bdc150773ad9f0b4029a883386ac179c1aa9d44f9ab6e4a

    SHA512

    c4beef5b86370a959b624041cc2db1de2da07a15df17077d728ea74036398fd1e62b6e7e147c53ea944606d751d0934f423b70193ad570a8cba097a823facdc0

  • C:\Users\Admin\cof.exe
    Filesize

    103KB

    MD5

    d15f3d9213e5972e1e2c069448d6f228

    SHA1

    224f67d7bcb15f1921211d68df19a072dc84ccfe

    SHA256

    9c0e3fcd2615c0a3678e77583970c5d9401ea223db3e517d048453db6427214d

    SHA512

    3e53dde211235f50f7507839f4f0e8ef6c0456f4f92b40e3a9d57eb64c1ee17774698858213e1cdefb8e87803648ff97001b2a00ad2c2c6b0c896774b1e785e3

  • C:\Users\Admin\cog.exe
    Filesize

    145KB

    MD5

    262a039229f90ba2461f2e810ad74447

    SHA1

    9dfe5040a3d6ea8262313953c02a1e6ae39c6916

    SHA256

    e20729c3095a40a637efb304bdf57902cd4948f22406138e0dbdf28f034cedb3

    SHA512

    d7612cdbc38aea73462aa7851ab3078dfb89a1b4c96414f5d8144c456f694971f08a79bbb1a738ffeb273f99122432b1009cbf4bd483884dd50ca115a64ef641

  • \Users\Admin\B85EgtCQKi4p6Z9Kt2.exe
    Filesize

    152KB

    MD5

    72e9d71fe7ad21610b846614566d6e2f

    SHA1

    35071ef247823ff6fa675449c6506caa2f5b145f

    SHA256

    4dc0b35a38321c71c24289acf43c102e6aa875307f830900d39f25491c83cda9

    SHA512

    14431710838e2eea0fdb3a7b73743b6d101ec6a4ceebdf0716e2855e845bd2b1722e5178d310a24ce7e5754076a9dc0e62f351c1518c391c6db8533af35203f3

  • \Users\Admin\cod.exe
    Filesize

    176KB

    MD5

    dbadc5fadb7497f5761537c06026ff47

    SHA1

    c8bd7319e170bd5966a73bae6f34cee4782b4f97

    SHA256

    b8fdc5c5f8aa378ef3ba8ee5172550a8f7ca295bebe858dab8ec171f1328036e

    SHA512

    7bced6bbdeb0f770d78f199d16d8ed86e90794141df101d1bb4878c55313af058a5551e0df2da65f6cd3507185cca13c7459aabf97c22faa83518b53321c2b7e

  • \Users\Admin\xhjic.exe
    Filesize

    152KB

    MD5

    a9d105fc81e25293bf7ff7645ea7c8cf

    SHA1

    2bfb37fd2aa97f2c60c33233f4dfa69d8fc26239

    SHA256

    06a90096ba1f4942423c2382e4bb5e9dfcd2540532dbc03af01ad52f066df7c4

    SHA512

    a5e71bcef7d023900aae68c852d30c1d50aca5633410b004d67a3c263bf39d2f7a0729549089097e6c80dd51ac33ff42e50dacf327d0570ca7190e7d01b6a960

  • memory/472-125-0x0000000002060000-0x00000000020A0000-memory.dmp
    Filesize

    256KB

  • memory/472-124-0x0000000002060000-0x00000000020A0000-memory.dmp
    Filesize

    256KB

  • memory/2044-114-0x00000000024D0000-0x0000000002510000-memory.dmp
    Filesize

    256KB

  • memory/2044-123-0x0000000010000000-0x000000001001D000-memory.dmp
    Filesize

    116KB

  • memory/2044-105-0x0000000010000000-0x000000001001D000-memory.dmp
    Filesize

    116KB

  • memory/2044-60-0x00000000024D0000-0x0000000002510000-memory.dmp
    Filesize

    256KB

  • memory/2044-58-0x00000000024D0000-0x0000000002510000-memory.dmp
    Filesize

    256KB

  • memory/2044-57-0x0000000010000000-0x000000001001D000-memory.dmp
    Filesize

    116KB

  • memory/2164-75-0x0000000000400000-0x000000000040B000-memory.dmp
    Filesize

    44KB

  • memory/2164-79-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
    Filesize

    4KB

  • memory/2164-78-0x0000000000400000-0x000000000040B000-memory.dmp
    Filesize

    44KB

  • memory/2164-84-0x0000000000400000-0x000000000040B000-memory.dmp
    Filesize

    44KB

  • memory/2164-85-0x0000000000400000-0x000000000040B000-memory.dmp
    Filesize

    44KB

  • memory/2164-62-0x0000000000400000-0x000000000040B000-memory.dmp
    Filesize

    44KB

  • memory/2164-64-0x0000000000400000-0x000000000040B000-memory.dmp
    Filesize

    44KB

  • memory/2164-66-0x0000000000400000-0x000000000040B000-memory.dmp
    Filesize

    44KB

  • memory/2164-69-0x0000000000400000-0x000000000040B000-memory.dmp
    Filesize

    44KB

  • memory/2164-72-0x0000000000400000-0x000000000040B000-memory.dmp
    Filesize

    44KB

  • memory/2588-59-0x0000000010000000-0x000000001001D000-memory.dmp
    Filesize

    116KB

  • memory/2588-44-0x00000000020D0000-0x0000000002110000-memory.dmp
    Filesize

    256KB

  • memory/2588-39-0x00000000020D0000-0x0000000002110000-memory.dmp
    Filesize

    256KB

  • memory/2588-36-0x0000000010000000-0x000000001001D000-memory.dmp
    Filesize

    116KB

  • memory/2628-50-0x0000000000400000-0x0000000000458000-memory.dmp
    Filesize

    352KB

  • memory/2628-45-0x0000000000400000-0x0000000000458000-memory.dmp
    Filesize

    352KB

  • memory/2628-38-0x0000000000400000-0x0000000000458000-memory.dmp
    Filesize

    352KB

  • memory/2628-41-0x0000000000400000-0x0000000000458000-memory.dmp
    Filesize

    352KB

  • memory/2628-42-0x0000000000220000-0x0000000000278000-memory.dmp
    Filesize

    352KB

  • memory/2628-43-0x0000000000221000-0x0000000000222000-memory.dmp
    Filesize

    4KB

  • memory/2680-83-0x0000000000400000-0x0000000000427000-memory.dmp
    Filesize

    156KB

  • memory/2700-31-0x0000000000470000-0x00000000004C8000-memory.dmp
    Filesize

    352KB

  • memory/3008-100-0x0000000003F50000-0x0000000004A0A000-memory.dmp
    Filesize

    10.7MB