Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05-05-2024 08:47

General

  • Target

    16e3029222864030e68ddeca0687882d_JaffaCakes118.exe

  • Size

    549KB

  • MD5

    16e3029222864030e68ddeca0687882d

  • SHA1

    f42c97e4054763a8520aaa7318596d5955251294

  • SHA256

    e2862099ecb4e6a3e51f07e1d1811cf8dd4903c33f9bd3be86587fb52ba01766

  • SHA512

    be22223452269ef0d4228146c4df7d7d4f285294c2af927359c7f2e8164629c69ee15fef77bed2f143f6d521bc64d72b9f3abe9c83911c1c6c2807086cfd08ca

  • SSDEEP

    12288:/ZTDd4t/u28bEFGWtdOKbBEP68A2TiiIk1c9La:/H4Vu4xL2Pa2mZk1Wa

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • ModiLoader Second Stage 42 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 12 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\16e3029222864030e68ddeca0687882d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\16e3029222864030e68ddeca0687882d_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2172
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe
      2⤵
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2896
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe
        3⤵
        • Looks for VirtualBox Guest Additions in registry
        • Adds policy Run key to start application
        • Looks for VMWare Tools registry key
        • Checks BIOS information in registry
        • Deletes itself
        • Adds Run key to start application
        • Maps connected drives based on registry
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2576
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\SysWOW64\regsvr32.exe"
          4⤵
            PID:2408
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\SysWOW64\regsvr32.exe"
            4⤵
              PID:576

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/576-63-0x0000000000090000-0x000000000015C000-memory.dmp

        Filesize

        816KB

      • memory/576-60-0x0000000000BB0000-0x0000000000BB7000-memory.dmp

        Filesize

        28KB

      • memory/576-62-0x0000000000BB0000-0x0000000000BB7000-memory.dmp

        Filesize

        28KB

      • memory/576-66-0x0000000000090000-0x000000000015C000-memory.dmp

        Filesize

        816KB

      • memory/576-67-0x0000000000090000-0x000000000015C000-memory.dmp

        Filesize

        816KB

      • memory/576-64-0x0000000000090000-0x000000000015C000-memory.dmp

        Filesize

        816KB

      • memory/576-65-0x0000000000090000-0x000000000015C000-memory.dmp

        Filesize

        816KB

      • memory/2172-5-0x0000000000050000-0x000000000011C000-memory.dmp

        Filesize

        816KB

      • memory/2172-1-0x0000000000340000-0x0000000000341000-memory.dmp

        Filesize

        4KB

      • memory/2172-4-0x0000000000050000-0x000000000011C000-memory.dmp

        Filesize

        816KB

      • memory/2172-15-0x0000000000400000-0x000000000048E000-memory.dmp

        Filesize

        568KB

      • memory/2172-0-0x00000000027B0000-0x0000000002B00000-memory.dmp

        Filesize

        3.3MB

      • memory/2172-6-0x0000000000050000-0x000000000011C000-memory.dmp

        Filesize

        816KB

      • memory/2172-8-0x0000000000050000-0x000000000011C000-memory.dmp

        Filesize

        816KB

      • memory/2172-7-0x0000000000050000-0x000000000011C000-memory.dmp

        Filesize

        816KB

      • memory/2172-2-0x0000000000400000-0x000000000048E000-memory.dmp

        Filesize

        568KB

      • memory/2172-10-0x0000000000050000-0x000000000011C000-memory.dmp

        Filesize

        816KB

      • memory/2408-53-0x00000000000D0000-0x000000000019C000-memory.dmp

        Filesize

        816KB

      • memory/2408-56-0x00000000000D0000-0x000000000019C000-memory.dmp

        Filesize

        816KB

      • memory/2408-52-0x00000000000D0000-0x000000000019C000-memory.dmp

        Filesize

        816KB

      • memory/2408-54-0x00000000000D0000-0x000000000019C000-memory.dmp

        Filesize

        816KB

      • memory/2408-57-0x00000000000D0000-0x000000000019C000-memory.dmp

        Filesize

        816KB

      • memory/2408-55-0x00000000000D0000-0x000000000019C000-memory.dmp

        Filesize

        816KB

      • memory/2408-51-0x0000000000BB0000-0x0000000000BB7000-memory.dmp

        Filesize

        28KB

      • memory/2408-49-0x0000000000BB0000-0x0000000000BB7000-memory.dmp

        Filesize

        28KB

      • memory/2576-40-0x0000000000230000-0x00000000002FC000-memory.dmp

        Filesize

        816KB

      • memory/2576-36-0x0000000000230000-0x00000000002FC000-memory.dmp

        Filesize

        816KB

      • memory/2576-43-0x0000000000230000-0x00000000002FC000-memory.dmp

        Filesize

        816KB

      • memory/2576-46-0x0000000000230000-0x00000000002FC000-memory.dmp

        Filesize

        816KB

      • memory/2576-47-0x0000000000230000-0x00000000002FC000-memory.dmp

        Filesize

        816KB

      • memory/2576-45-0x0000000000230000-0x00000000002FC000-memory.dmp

        Filesize

        816KB

      • memory/2576-44-0x0000000000230000-0x00000000002FC000-memory.dmp

        Filesize

        816KB

      • memory/2576-48-0x0000000000230000-0x00000000002FC000-memory.dmp

        Filesize

        816KB

      • memory/2576-42-0x0000000000230000-0x00000000002FC000-memory.dmp

        Filesize

        816KB

      • memory/2576-41-0x0000000000230000-0x00000000002FC000-memory.dmp

        Filesize

        816KB

      • memory/2576-37-0x0000000000230000-0x00000000002FC000-memory.dmp

        Filesize

        816KB

      • memory/2576-34-0x0000000000230000-0x00000000002FC000-memory.dmp

        Filesize

        816KB

      • memory/2576-35-0x0000000000230000-0x00000000002FC000-memory.dmp

        Filesize

        816KB

      • memory/2576-32-0x0000000000230000-0x00000000002FC000-memory.dmp

        Filesize

        816KB

      • memory/2576-33-0x0000000000230000-0x00000000002FC000-memory.dmp

        Filesize

        816KB

      • memory/2576-31-0x0000000000BB0000-0x0000000000BB7000-memory.dmp

        Filesize

        28KB

      • memory/2576-29-0x0000000000BB0000-0x0000000000BB7000-memory.dmp

        Filesize

        28KB

      • memory/2576-59-0x0000000000230000-0x00000000002FC000-memory.dmp

        Filesize

        816KB

      • memory/2576-58-0x0000000000230000-0x00000000002FC000-memory.dmp

        Filesize

        816KB

      • memory/2896-25-0x0000000000170000-0x000000000023C000-memory.dmp

        Filesize

        816KB

      • memory/2896-22-0x0000000000170000-0x000000000023C000-memory.dmp

        Filesize

        816KB

      • memory/2896-20-0x0000000000170000-0x000000000023C000-memory.dmp

        Filesize

        816KB

      • memory/2896-19-0x0000000000170000-0x000000000023C000-memory.dmp

        Filesize

        816KB

      • memory/2896-23-0x0000000000170000-0x000000000023C000-memory.dmp

        Filesize

        816KB

      • memory/2896-21-0x0000000000170000-0x000000000023C000-memory.dmp

        Filesize

        816KB

      • memory/2896-18-0x0000000000BB0000-0x0000000000BB7000-memory.dmp

        Filesize

        28KB

      • memory/2896-16-0x0000000000BB0000-0x0000000000BB7000-memory.dmp

        Filesize

        28KB