Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    05-05-2024 15:06

General

  • Target

    183da5248aa31d95f9462a9b49c50b36_JaffaCakes118.exe

  • Size

    272KB

  • MD5

    183da5248aa31d95f9462a9b49c50b36

  • SHA1

    1a5c4156d21bd2d0e4fb9fd8cabe362411970da6

  • SHA256

    252f271550eb6a0ec533597feb9d63f5ef308388935a4734159b1d60ec0c878e

  • SHA512

    15c9457e2783e46ff0c0689d2b5a2663a10841c04221587679d5d48be702eef0e51c28e1a34ea1ec3527b52eecd5ba8d1dcaa85b81b0a846dc8642fcf53e1be1

  • SSDEEP

    6144:JKz24ZvSmqKYg1OuevkGD7ALodyLUwICvEr:cdvWUo5XvkUIvEr

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
  • ModiLoader Second Stage 60 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\183da5248aa31d95f9462a9b49c50b36_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\183da5248aa31d95f9462a9b49c50b36_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Users\Admin\AppData\Local\Temp\183da5248aa31d95f9462a9b49c50b36_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\183da5248aa31d95f9462a9b49c50b36_JaffaCakes118.exe"
      2⤵
        PID:1652
    • C:\Windows\system32\mshta.exe
      "C:\Windows\system32\mshta.exe" javascript:iqyPK8h="7SKSF";D5J6=new%20ActiveXObject("WScript.Shell");d4fAwY="BsV3K";x2Wjx8=D5J6.RegRead("HKLM\\software\\Wow6432Node\\gzaHwY\\HRdnfc1fd");OxxP32="EtHrq";eval(x2Wjx8);nM5GZPq="OT";
      1⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:2232
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:mrqlf
        2⤵
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2420
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32.exe
          3⤵
          • Looks for VirtualBox Guest Additions in registry
          • Looks for VirtualBox drivers on disk
          • Looks for VMWare Tools registry key
          • Checks BIOS information in registry
          • Deletes itself
          • Drops startup file
          • Adds Run key to start application
          • Maps connected drives based on registry
          • Suspicious use of SetThreadContext
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:2624
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\SysWOW64\regsvr32.exe"
            4⤵
              PID:2904

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\ed3e8\5cad4.cc93a6

        Filesize

        38KB

        MD5

        8c5d76dc8913b4b9d779139bd98bc4aa

        SHA1

        8ecd0b54ac32c24bb3c1d06e5151295ce0ef09b4

        SHA256

        f6aa8866c2b49ba839275ebb0d0d17630ae63d20987d523037bd632575ae1330

        SHA512

        443b2be513599d9434168634de7fbf317aa637a0f5a89c4e6c80fd62fc68cf032a1ee6ae333f24de7701caf9e510f46ff5f0c83302266d748fa92bfb8bf2b242

      • C:\Users\Admin\AppData\Local\ed3e8\bc0ec.bat

        Filesize

        58B

        MD5

        c9726b1023d08f87d7c310ef440fc21a

        SHA1

        e121739a7d5fd0bd5e0a08827105a41798195629

        SHA256

        009c0ef73332c5aae4e96ba2013e33cda30f312c604c5b1e768c190a522160fc

        SHA512

        571d0720f495a92114cdce0abbf951bd3ac6f66394adc88964c3870feb2552640290d65bf739c9e844e4f0c33ddbda9e39f6e66cfaad8a4b35a210df05efe1b0

      • C:\Users\Admin\AppData\Local\ed3e8\d468b.lnk

        Filesize

        865B

        MD5

        625f54a2fef23c3a3d59e2c950ba65c6

        SHA1

        0ac958e936b708c89a364d56513b85fa89b98b07

        SHA256

        c0bf9ed2ce41a218807ca8ed0ed6587fe2388d6e82bfa489f4d6f799cf662e6b

        SHA512

        a1f3b67b7eafa29f9a4925999aca67fa98fafb8dbe055b8d6d01e72402f4e0a3e8e8d283e39a1e3abb856ebf42dcceee74756bde9c0e16e7747c3389d1d1866f

      • C:\Users\Admin\AppData\Roaming\158f4\93aca.cc93a6

        Filesize

        44KB

        MD5

        224a96698095259ab707c64e8a2e5d18

        SHA1

        81e13fecd84dd76b74072f7b63c2d8713a5b80cf

        SHA256

        de91e37447860f1ae60170bcd269090568a29f45354db3fbed93087efd147ea9

        SHA512

        fb5afc8ed1a420644c254a009936a77ffe6f1afd7b7169e46095444ac5217dac805319ba417a2ad4b450a2a55f9a99b84677ced81420a284021a692668e3e296

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2d7d1.lnk

        Filesize

        981B

        MD5

        bebc26141e049d539319bb30b6b54d9e

        SHA1

        1d3d6261dc5cc68a1e7a9c718a8e177e3b5b31ea

        SHA256

        150bec976ac8a8e49819cb833b76a72d3e5452aece6c317c91e894a171347951

        SHA512

        85e16016a0e8d19c361a657f5605b38cf00e507b5f18cb58ed40ccb036266207a0558f418b7471c4fe3a1e1ba0234613b67933689c87fb26925cab629f593a8a

      • memory/1652-7-0x0000000001DA0000-0x0000000001E76000-memory.dmp

        Filesize

        856KB

      • memory/1652-5-0x0000000000400000-0x000000000043A000-memory.dmp

        Filesize

        232KB

      • memory/1652-6-0x0000000001DA0000-0x0000000001E76000-memory.dmp

        Filesize

        856KB

      • memory/1652-4-0x0000000000400000-0x000000000043A000-memory.dmp

        Filesize

        232KB

      • memory/1652-10-0x0000000001DA0000-0x0000000001E76000-memory.dmp

        Filesize

        856KB

      • memory/1652-9-0x0000000001DA0000-0x0000000001E76000-memory.dmp

        Filesize

        856KB

      • memory/1652-8-0x0000000001DA0000-0x0000000001E76000-memory.dmp

        Filesize

        856KB

      • memory/1652-11-0x0000000001DA0000-0x0000000001E76000-memory.dmp

        Filesize

        856KB

      • memory/1652-12-0x0000000001DA0000-0x0000000001E76000-memory.dmp

        Filesize

        856KB

      • memory/1652-2-0x0000000000400000-0x000000000043A000-memory.dmp

        Filesize

        232KB

      • memory/2420-21-0x0000000006200000-0x00000000062D6000-memory.dmp

        Filesize

        856KB

      • memory/2420-26-0x0000000006200000-0x00000000062D6000-memory.dmp

        Filesize

        856KB

      • memory/2624-56-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-38-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-29-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-34-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-40-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-28-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-30-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-48-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-57-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-47-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-46-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-49-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-45-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-59-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-58-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-25-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-55-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-54-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-44-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-43-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-42-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-41-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-39-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-27-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-37-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-36-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-35-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-33-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-32-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-31-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-66-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2624-23-0x0000000000090000-0x00000000001D1000-memory.dmp

        Filesize

        1.3MB

      • memory/2904-71-0x0000000000210000-0x0000000000351000-memory.dmp

        Filesize

        1.3MB

      • memory/2904-74-0x0000000000210000-0x0000000000351000-memory.dmp

        Filesize

        1.3MB

      • memory/2904-80-0x0000000000210000-0x0000000000351000-memory.dmp

        Filesize

        1.3MB

      • memory/2904-79-0x0000000000210000-0x0000000000351000-memory.dmp

        Filesize

        1.3MB

      • memory/2904-82-0x0000000000210000-0x0000000000351000-memory.dmp

        Filesize

        1.3MB

      • memory/2904-75-0x0000000000210000-0x0000000000351000-memory.dmp

        Filesize

        1.3MB

      • memory/2904-81-0x0000000000210000-0x0000000000351000-memory.dmp

        Filesize

        1.3MB

      • memory/2904-72-0x0000000000210000-0x0000000000351000-memory.dmp

        Filesize

        1.3MB

      • memory/2904-77-0x0000000000210000-0x0000000000351000-memory.dmp

        Filesize

        1.3MB

      • memory/2904-70-0x0000000000210000-0x0000000000351000-memory.dmp

        Filesize

        1.3MB

      • memory/2904-68-0x0000000000210000-0x0000000000351000-memory.dmp

        Filesize

        1.3MB

      • memory/2904-67-0x0000000000210000-0x0000000000351000-memory.dmp

        Filesize

        1.3MB

      • memory/2904-78-0x0000000000210000-0x0000000000351000-memory.dmp

        Filesize

        1.3MB

      • memory/2904-76-0x0000000000210000-0x0000000000351000-memory.dmp

        Filesize

        1.3MB

      • memory/2904-73-0x0000000000210000-0x0000000000351000-memory.dmp

        Filesize

        1.3MB

      • memory/2904-69-0x0000000000210000-0x0000000000351000-memory.dmp

        Filesize

        1.3MB