Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
05/05/2024, 15:59
General
- Target 1861f5f5c1bf4c6eabe0b6fc8d792019_JaffaCakes118.exe
- Size 499KB
- Sample240505-tfgfbshe49
- SHA256 f12851c350ac9d71760465bfe01bc7e17f3dd2575412d99865cde1bbdf16d353
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- ModiLoader Second Stage 37 IoCs
- Adds policy Run key to start application 2 TTPs 2 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Deletes itself 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 8 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 12 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1861f5f5c1bf4c6eabe0b6fc8d792019_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1861f5f5c1bf4c6eabe0b6fc8d792019_JaffaCakes118.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe3⤵
- Looks for VirtualBox Guest Additions in registry
- Adds policy Run key to start application
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Adds Run key to start application
- Maps connected drives based on registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe"4⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1480-17-0x0000000000400000-0x0000000000484000-memory.dmp
memory/1480-1-0x00000000005C0000-0x00000000005C1000-memory.dmp
memory/1480-2-0x0000000002B80000-0x0000000002C80000-memory.dmp
memory/1480-3-0x0000000000400000-0x0000000000484000-memory.dmp
memory/1480-5-0x00000000007B0000-0x000000000087C000-memory.dmp
memory/1480-7-0x00000000007B0000-0x000000000087C000-memory.dmp
memory/1480-9-0x00000000007B0000-0x000000000087C000-memory.dmp
memory/1480-8-0x00000000007B0000-0x000000000087C000-memory.dmp
memory/1480-0-0x0000000002B80000-0x0000000002C80000-memory.dmp
memory/1480-6-0x00000000007B0000-0x000000000087C000-memory.dmp
memory/1480-10-0x00000000007B0000-0x000000000087C000-memory.dmp
memory/1552-58-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/1552-52-0x00000000009D0000-0x00000000009D9000-memory.dmp
memory/1552-57-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/1552-59-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/1552-61-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/1552-60-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/1552-56-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/1552-53-0x00000000009D0000-0x00000000009D9000-memory.dmp
memory/1552-55-0x00000000009D0000-0x00000000009D9000-memory.dmp
memory/4340-18-0x00000000009D0000-0x00000000009D9000-memory.dmp
memory/4340-26-0x00000000008C0000-0x000000000098C000-memory.dmp
memory/4340-15-0x00000000009D0000-0x00000000009D9000-memory.dmp
memory/4340-20-0x00000000009D0000-0x00000000009D9000-memory.dmp
memory/4340-22-0x00000000008C0000-0x000000000098C000-memory.dmp
memory/4340-25-0x00000000008C0000-0x000000000098C000-memory.dmp
memory/4340-24-0x00000000008C0000-0x000000000098C000-memory.dmp
memory/4340-23-0x00000000008C0000-0x000000000098C000-memory.dmp
memory/4340-21-0x00000000008C0000-0x000000000098C000-memory.dmp
memory/4488-68-0x00000000004F0000-0x00000000005BC000-memory.dmp
memory/4488-65-0x00000000009D0000-0x00000000009D9000-memory.dmp
memory/4488-67-0x00000000009D0000-0x00000000009D9000-memory.dmp
memory/4488-64-0x00000000009D0000-0x00000000009D9000-memory.dmp
memory/4936-37-0x0000000000C00000-0x0000000000CCC000-memory.dmp
memory/4936-47-0x0000000000C00000-0x0000000000CCC000-memory.dmp
memory/4936-46-0x0000000000C00000-0x0000000000CCC000-memory.dmp
memory/4936-51-0x0000000000C00000-0x0000000000CCC000-memory.dmp
memory/4936-33-0x00000000009D0000-0x00000000009D9000-memory.dmp
memory/4936-44-0x0000000000C00000-0x0000000000CCC000-memory.dmp
memory/4936-48-0x0000000000C00000-0x0000000000CCC000-memory.dmp
memory/4936-50-0x0000000000C00000-0x0000000000CCC000-memory.dmp
memory/4936-45-0x0000000000C00000-0x0000000000CCC000-memory.dmp
memory/4936-43-0x0000000000C00000-0x0000000000CCC000-memory.dmp
memory/4936-36-0x00000000009D0000-0x00000000009D9000-memory.dmp
memory/4936-39-0x0000000000C00000-0x0000000000CCC000-memory.dmp
memory/4936-40-0x0000000000C00000-0x0000000000CCC000-memory.dmp
memory/4936-62-0x0000000000C00000-0x0000000000CCC000-memory.dmp
memory/4936-63-0x0000000000C00000-0x0000000000CCC000-memory.dmp
memory/4936-41-0x0000000000C00000-0x0000000000CCC000-memory.dmp
memory/4936-42-0x0000000000C00000-0x0000000000CCC000-memory.dmp
memory/4936-38-0x0000000000C00000-0x0000000000CCC000-memory.dmp
memory/4936-34-0x00000000009D0000-0x00000000009D9000-memory.dmp