Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05-05-2024 15:59

General

  • Target

    1861f5f5c1bf4c6eabe0b6fc8d792019_JaffaCakes118.exe

  • Size

    499KB

  • MD5

    1861f5f5c1bf4c6eabe0b6fc8d792019

  • SHA1

    a73a74301727189491556bac5146976fb26638ba

  • SHA256

    f12851c350ac9d71760465bfe01bc7e17f3dd2575412d99865cde1bbdf16d353

  • SHA512

    7d3ce18298009393683532b4f04ebc80ef8e0010a3cff6478e47b580cd97b2f9d5bf4cd2f73feb5b3719a9c1ff5b907a1d998a67a13aeee3fdbadfb4fbfbc6b1

  • SSDEEP

    6144:4kJ3VPwv21cNZSa/mZzxPTZSV0h6UOdmPvjqlyQkbs1jqLBcdFuhJVm3Cf1SlyIk:4kJ3twv8cmqmZJTZVvjKyQD1WL2dFuL1

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • ModiLoader Second Stage 41 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1861f5f5c1bf4c6eabe0b6fc8d792019_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1861f5f5c1bf4c6eabe0b6fc8d792019_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe
      2⤵
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2436
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe
        3⤵
        • Looks for VirtualBox Guest Additions in registry
        • Adds policy Run key to start application
        • Looks for VMWare Tools registry key
        • Checks BIOS information in registry
        • Deletes itself
        • Adds Run key to start application
        • Maps connected drives based on registry
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2700
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\SysWOW64\regsvr32.exe"
          4⤵
            PID:2360
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\SysWOW64\regsvr32.exe"
            4⤵
              PID:552

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/552-69-0x0000000000270000-0x000000000033C000-memory.dmp

        Filesize

        816KB

      • memory/552-65-0x0000000000270000-0x000000000033C000-memory.dmp

        Filesize

        816KB

      • memory/552-68-0x0000000000270000-0x000000000033C000-memory.dmp

        Filesize

        816KB

      • memory/552-67-0x0000000000270000-0x000000000033C000-memory.dmp

        Filesize

        816KB

      • memory/552-66-0x0000000000270000-0x000000000033C000-memory.dmp

        Filesize

        816KB

      • memory/1084-0-0x0000000002590000-0x0000000002690000-memory.dmp

        Filesize

        1024KB

      • memory/1084-8-0x0000000000050000-0x000000000011C000-memory.dmp

        Filesize

        816KB

      • memory/1084-7-0x0000000000050000-0x000000000011C000-memory.dmp

        Filesize

        816KB

      • memory/1084-9-0x0000000000050000-0x000000000011C000-memory.dmp

        Filesize

        816KB

      • memory/1084-6-0x0000000000050000-0x000000000011C000-memory.dmp

        Filesize

        816KB

      • memory/1084-1-0x0000000000280000-0x0000000000281000-memory.dmp

        Filesize

        4KB

      • memory/1084-11-0x0000000000050000-0x000000000011C000-memory.dmp

        Filesize

        816KB

      • memory/1084-18-0x0000000000400000-0x0000000000484000-memory.dmp

        Filesize

        528KB

      • memory/1084-10-0x0000000000050000-0x000000000011C000-memory.dmp

        Filesize

        816KB

      • memory/1084-2-0x0000000000280000-0x0000000000281000-memory.dmp

        Filesize

        4KB

      • memory/1084-3-0x0000000002590000-0x0000000002690000-memory.dmp

        Filesize

        1024KB

      • memory/1084-4-0x0000000000400000-0x0000000000484000-memory.dmp

        Filesize

        528KB

      • memory/2360-51-0x00000000007B0000-0x00000000007B7000-memory.dmp

        Filesize

        28KB

      • memory/2360-56-0x00000000001E0000-0x00000000002AC000-memory.dmp

        Filesize

        816KB

      • memory/2360-53-0x00000000007B0000-0x00000000007B7000-memory.dmp

        Filesize

        28KB

      • memory/2360-54-0x00000000001E0000-0x00000000002AC000-memory.dmp

        Filesize

        816KB

      • memory/2360-55-0x00000000001E0000-0x00000000002AC000-memory.dmp

        Filesize

        816KB

      • memory/2360-59-0x00000000001E0000-0x00000000002AC000-memory.dmp

        Filesize

        816KB

      • memory/2360-58-0x00000000001E0000-0x00000000002AC000-memory.dmp

        Filesize

        816KB

      • memory/2436-25-0x00000000000D0000-0x000000000019C000-memory.dmp

        Filesize

        816KB

      • memory/2436-16-0x00000000007B0000-0x00000000007B7000-memory.dmp

        Filesize

        28KB

      • memory/2436-20-0x00000000007B0000-0x00000000007B7000-memory.dmp

        Filesize

        28KB

      • memory/2436-21-0x00000000000D0000-0x000000000019C000-memory.dmp

        Filesize

        816KB

      • memory/2436-23-0x00000000000D0000-0x000000000019C000-memory.dmp

        Filesize

        816KB

      • memory/2436-24-0x00000000000D0000-0x000000000019C000-memory.dmp

        Filesize

        816KB

      • memory/2436-22-0x00000000000D0000-0x000000000019C000-memory.dmp

        Filesize

        816KB

      • memory/2436-26-0x00000000000D0000-0x000000000019C000-memory.dmp

        Filesize

        816KB

      • memory/2700-41-0x0000000000110000-0x00000000001DC000-memory.dmp

        Filesize

        816KB

      • memory/2700-45-0x0000000000110000-0x00000000001DC000-memory.dmp

        Filesize

        816KB

      • memory/2700-44-0x0000000000110000-0x00000000001DC000-memory.dmp

        Filesize

        816KB

      • memory/2700-49-0x0000000000110000-0x00000000001DC000-memory.dmp

        Filesize

        816KB

      • memory/2700-50-0x0000000000110000-0x00000000001DC000-memory.dmp

        Filesize

        816KB

      • memory/2700-46-0x0000000000110000-0x00000000001DC000-memory.dmp

        Filesize

        816KB

      • memory/2700-47-0x0000000000110000-0x00000000001DC000-memory.dmp

        Filesize

        816KB

      • memory/2700-48-0x0000000000110000-0x00000000001DC000-memory.dmp

        Filesize

        816KB

      • memory/2700-43-0x0000000000110000-0x00000000001DC000-memory.dmp

        Filesize

        816KB

      • memory/2700-42-0x0000000000110000-0x00000000001DC000-memory.dmp

        Filesize

        816KB

      • memory/2700-38-0x0000000000110000-0x00000000001DC000-memory.dmp

        Filesize

        816KB

      • memory/2700-39-0x0000000000110000-0x00000000001DC000-memory.dmp

        Filesize

        816KB

      • memory/2700-60-0x0000000000110000-0x00000000001DC000-memory.dmp

        Filesize

        816KB

      • memory/2700-61-0x0000000000110000-0x00000000001DC000-memory.dmp

        Filesize

        816KB

      • memory/2700-40-0x0000000000110000-0x00000000001DC000-memory.dmp

        Filesize

        816KB

      • memory/2700-37-0x0000000000110000-0x00000000001DC000-memory.dmp

        Filesize

        816KB

      • memory/2700-36-0x0000000000110000-0x00000000001DC000-memory.dmp

        Filesize

        816KB

      • memory/2700-31-0x00000000007B0000-0x00000000007B7000-memory.dmp

        Filesize

        28KB

      • memory/2700-33-0x00000000007B0000-0x00000000007B7000-memory.dmp

        Filesize

        28KB