Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-05-2024 09:05

General

  • Target

    16f2bfd12ecc59c08c846c7a91179688_JaffaCakes118.exe

  • Size

    357KB

  • MD5

    16f2bfd12ecc59c08c846c7a91179688

  • SHA1

    ac74f2287c0bfe874a210570322452929b765f5e

  • SHA256

    22515694f5e8a26dabe3a2c78c91b20868877b50f2e11779e15a946ff0e9a239

  • SHA512

    6d445e1454aeedb55a8f98176abc078c7878de8738eb5cb00b5bc388bb4921eb678bcd3e109ebe59c72732fa17dbd7f2064afd500067bbbe1520ec581f66bbd2

  • SSDEEP

    6144:SyN8f1pUqmWqpYTHpIb93Oh68L6xywQ1blRjXS7ytx2Uvs:h6f1pUqmIHpyG6TitS0xS

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • ModiLoader Second Stage 48 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 12 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\16f2bfd12ecc59c08c846c7a91179688_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\16f2bfd12ecc59c08c846c7a91179688_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1596
    • C:\Windows\SysWOW64\dllhost.exe
      dllhost.exe
      2⤵
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3772
      • C:\Windows\SysWOW64\dllhost.exe
        dllhost.exe
        3⤵
        • Looks for VirtualBox Guest Additions in registry
        • Adds policy Run key to start application
        • Looks for VMWare Tools registry key
        • Checks BIOS information in registry
        • Deletes itself
        • Adds Run key to start application
        • Maps connected drives based on registry
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2280
        • C:\Windows\SysWOW64\dllhost.exe
          "C:\Windows\SysWOW64\dllhost.exe"
          4⤵
            PID:4788
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
              PID:1136
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2432 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:4080

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1136-47-0x0000000000A00000-0x0000000000AC4000-memory.dmp

          Filesize

          784KB

        • memory/1136-45-0x00000000002C0000-0x00000000006F3000-memory.dmp

          Filesize

          4.2MB

        • memory/1136-46-0x0000000000A00000-0x0000000000AC4000-memory.dmp

          Filesize

          784KB

        • memory/1136-49-0x0000000000A00000-0x0000000000AC4000-memory.dmp

          Filesize

          784KB

        • memory/1136-44-0x00000000002C0000-0x00000000006F3000-memory.dmp

          Filesize

          4.2MB

        • memory/1136-50-0x0000000000A00000-0x0000000000AC4000-memory.dmp

          Filesize

          784KB

        • memory/1136-48-0x0000000000A00000-0x0000000000AC4000-memory.dmp

          Filesize

          784KB

        • memory/1136-52-0x0000000000A00000-0x0000000000AC4000-memory.dmp

          Filesize

          784KB

        • memory/1596-3-0x00000000023B0000-0x00000000023B1000-memory.dmp

          Filesize

          4KB

        • memory/1596-12-0x0000000000400000-0x000000000045F000-memory.dmp

          Filesize

          380KB

        • memory/1596-10-0x00000000042D0000-0x0000000004394000-memory.dmp

          Filesize

          784KB

        • memory/1596-7-0x00000000042D0000-0x0000000004394000-memory.dmp

          Filesize

          784KB

        • memory/1596-5-0x0000000000400000-0x000000000045F000-memory.dmp

          Filesize

          380KB

        • memory/1596-4-0x00000000023B0000-0x00000000023B1000-memory.dmp

          Filesize

          4KB

        • memory/1596-0-0x0000000002490000-0x0000000002510000-memory.dmp

          Filesize

          512KB

        • memory/1596-2-0x0000000002490000-0x0000000002510000-memory.dmp

          Filesize

          512KB

        • memory/1596-1-0x00000000023B0000-0x00000000023B1000-memory.dmp

          Filesize

          4KB

        • memory/2280-21-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-61-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-23-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-24-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-25-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-26-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-27-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-62-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-63-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-64-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-66-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-67-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-68-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-69-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-38-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-41-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-42-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-40-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-39-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-36-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-37-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-35-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-43-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-18-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-19-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-20-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-17-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-16-0x0000000000180000-0x0000000000187000-memory.dmp

          Filesize

          28KB

        • memory/2280-70-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-65-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/2280-22-0x0000000000A80000-0x0000000000B44000-memory.dmp

          Filesize

          784KB

        • memory/3772-9-0x0000000000180000-0x0000000000187000-memory.dmp

          Filesize

          28KB

        • memory/3772-11-0x0000000000C00000-0x0000000000CC4000-memory.dmp

          Filesize

          784KB

        • memory/3772-13-0x0000000000C00000-0x0000000000CC4000-memory.dmp

          Filesize

          784KB

        • memory/4788-30-0x0000000000A00000-0x0000000000AC4000-memory.dmp

          Filesize

          784KB

        • memory/4788-31-0x0000000000A00000-0x0000000000AC4000-memory.dmp

          Filesize

          784KB

        • memory/4788-33-0x0000000000A00000-0x0000000000AC4000-memory.dmp

          Filesize

          784KB

        • memory/4788-34-0x0000000000A00000-0x0000000000AC4000-memory.dmp

          Filesize

          784KB

        • memory/4788-32-0x0000000000A00000-0x0000000000AC4000-memory.dmp

          Filesize

          784KB

        • memory/4788-29-0x0000000000A00000-0x0000000000AC4000-memory.dmp

          Filesize

          784KB

        • memory/4788-28-0x0000000000180000-0x0000000000187000-memory.dmp

          Filesize

          28KB