Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
21/04/2024, 14:19
General
- Target ff79034c519c340037b8a3ec633a0923_JaffaCakes118.exe
- Size 986KB
- Sample240421-rm7vradb34
- SHA256 898df3a9b73f1be6a2bd592a10c2d4ac77c22b6bb89d588a6aced5bf6759e883
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- ModiLoader Second Stage 18 IoCs
- Executes dropped EXE 1 IoCs
- Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Drops file in Program Files directory 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff79034c519c340037b8a3ec633a0923_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ff79034c519c340037b8a3ec633a0923_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\hmNnnqii.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\hmNnnqii.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
hmNnnqii.exe
memory/2152-0-0x0000000000400000-0x0000000000630000-memory.dmp
memory/2152-1-0x0000000077BF4000-0x0000000077BF6000-memory.dmp
memory/2152-4-0x0000000000400000-0x0000000000630000-memory.dmp
memory/2152-5-0x0000000004880000-0x0000000004881000-memory.dmp
memory/2152-8-0x0000000004860000-0x0000000004861000-memory.dmp
memory/2152-11-0x0000000004830000-0x0000000004831000-memory.dmp
memory/2152-12-0x0000000004870000-0x0000000004871000-memory.dmp
memory/2152-10-0x0000000004850000-0x0000000004852000-memory.dmp
memory/2152-14-0x0000000004950000-0x0000000004951000-memory.dmp
memory/2152-13-0x0000000004840000-0x0000000004841000-memory.dmp
memory/2152-15-0x0000000004960000-0x0000000004962000-memory.dmp
memory/2152-17-0x0000000004900000-0x0000000004901000-memory.dmp
memory/2152-16-0x0000000004970000-0x0000000004971000-memory.dmp
memory/2152-18-0x00000000049B0000-0x00000000049B1000-memory.dmp
memory/2152-19-0x0000000004940000-0x0000000004941000-memory.dmp
memory/2152-20-0x0000000004A00000-0x0000000004A01000-memory.dmp
memory/2152-21-0x00000000048F0000-0x00000000048F1000-memory.dmp
memory/2152-22-0x00000000049C0000-0x00000000049C1000-memory.dmp
memory/2152-24-0x00000000047F0000-0x00000000047F1000-memory.dmp
memory/2152-25-0x0000000004990000-0x0000000004991000-memory.dmp
memory/2152-23-0x0000000004C20000-0x0000000004C22000-memory.dmp
memory/2152-26-0x0000000004890000-0x0000000004891000-memory.dmp
memory/2152-27-0x00000000048A0000-0x00000000048A1000-memory.dmp
memory/2152-28-0x00000000048E0000-0x00000000048E1000-memory.dmp
memory/2152-29-0x0000000004A10000-0x0000000004A11000-memory.dmp
memory/2152-43-0x0000000000400000-0x0000000000630000-memory.dmp
memory/2476-30-0x0000000000400000-0x0000000000630000-memory.dmp
memory/2476-31-0x0000000000400000-0x0000000000630000-memory.dmp
memory/2476-32-0x0000000004740000-0x0000000004741000-memory.dmp
memory/2476-33-0x0000000004720000-0x0000000004721000-memory.dmp
memory/2476-34-0x0000000004710000-0x0000000004712000-memory.dmp
memory/2476-35-0x00000000046F0000-0x00000000046F1000-memory.dmp
memory/2476-37-0x0000000004700000-0x0000000004701000-memory.dmp
memory/2476-36-0x0000000004730000-0x0000000004731000-memory.dmp
memory/2476-38-0x0000000004800000-0x0000000004801000-memory.dmp
memory/2476-40-0x0000000004810000-0x0000000004812000-memory.dmp
memory/2476-39-0x0000000004820000-0x0000000004821000-memory.dmp
memory/2476-42-0x00000000047B0000-0x00000000047B1000-memory.dmp
memory/2476-44-0x0000000004860000-0x0000000004861000-memory.dmp
memory/2476-41-0x0000000004830000-0x0000000004831000-memory.dmp
memory/2476-45-0x00000000047F0000-0x00000000047F1000-memory.dmp
memory/2476-46-0x00000000048B0000-0x00000000048B1000-memory.dmp
memory/2476-47-0x00000000047A0000-0x00000000047A1000-memory.dmp
memory/2476-48-0x0000000004870000-0x0000000004871000-memory.dmp
memory/2476-50-0x00000000048C0000-0x00000000048C1000-memory.dmp
memory/2476-49-0x0000000004AE0000-0x0000000004AE2000-memory.dmp
memory/2476-52-0x00000000049E0000-0x00000000049E2000-memory.dmp
memory/2476-51-0x00000000046B0000-0x00000000046B1000-memory.dmp
memory/2476-53-0x00000000047C0000-0x00000000047C1000-memory.dmp
memory/2476-54-0x00000000048A0000-0x00000000048A1000-memory.dmp
memory/2476-55-0x0000000004880000-0x0000000004882000-memory.dmp
memory/2476-56-0x0000000004890000-0x0000000004891000-memory.dmp
memory/2476-57-0x0000000004850000-0x0000000004851000-memory.dmp
memory/2476-58-0x0000000004840000-0x0000000004841000-memory.dmp
memory/2476-59-0x0000000004750000-0x0000000004751000-memory.dmp
memory/2476-60-0x0000000004770000-0x0000000004771000-memory.dmp
memory/2476-61-0x00000000047E0000-0x00000000047E1000-memory.dmp
memory/2476-62-0x0000000000400000-0x0000000000630000-memory.dmp
memory/2476-63-0x0000000000400000-0x0000000000630000-memory.dmp
memory/2476-64-0x0000000000400000-0x0000000000630000-memory.dmp
memory/2476-65-0x0000000000400000-0x0000000000630000-memory.dmp
memory/2476-66-0x0000000000400000-0x0000000000630000-memory.dmp
memory/2476-67-0x0000000000400000-0x0000000000630000-memory.dmp
memory/2476-68-0x0000000000400000-0x0000000000630000-memory.dmp
memory/2476-69-0x0000000000400000-0x0000000000630000-memory.dmp
memory/2476-70-0x0000000000400000-0x0000000000630000-memory.dmp
memory/2476-71-0x0000000000400000-0x0000000000630000-memory.dmp
memory/2476-72-0x0000000000400000-0x0000000000630000-memory.dmp
memory/2476-73-0x0000000000400000-0x0000000000630000-memory.dmp
memory/2476-74-0x0000000000400000-0x0000000000630000-memory.dmp
memory/2476-75-0x0000000000400000-0x0000000000630000-memory.dmp
memory/2476-76-0x0000000000400000-0x0000000000630000-memory.dmp