Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-05-2024 05:27

General

  • Target

    1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe

  • Size

    356KB

  • MD5

    1f98f4990bbf6b268365ba7fdf56405f

  • SHA1

    e1f5a46baf14c6fdd67fcb1b3d37b54ad9a52317

  • SHA256

    5f2ebf4e711218b1c47e8c83cbe354a369efcfed3835c480c7ae08001dfbdb8f

  • SHA512

    bbf91e6a1a1c2a50f630d4ec347c7678647a78ce976af3db92b62498f77af84f506e1dadd4d9d8757c9f2297e80bbaf96e8575f5cb331800465417a6ed08717f

  • SSDEEP

    6144:Sae/c0RVIqxFu4s2a9XHCd9hxJamsAT4k+wCGbfQfojzMBR5h:W/cMVDxFu43cHYf1TPCAxjzMj

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • ModiLoader Second Stage 13 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Looks for VMWare Tools registry key
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:248
    • C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Looks for VMWare Tools registry key
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2700
  • C:\Windows\system32\mshta.exe
    "C:\Windows\system32\mshta.exe" javascript:gZfVkd7MU="A";c2y=new%20ActiveXObject("WScript.Shell");YirKUGAL3="lPw6Ad";on0qU=c2y.RegRead("HKLM\\software\\Wow6432Node\\HWHEDuC1Hi\\oTufir");aWK3mT2YS="HPJQ6QiQm";eval(on0qU);gDj6CnL="pT0Tlage5";
    1⤵
    • Process spawned unexpected child process
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4940
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:suaqla
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2d0k2imx.tpp.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\1f98f4990bbf6b268365ba7fdf56405f_JaffaCakes118.exe

    Filesize

    356KB

    MD5

    1f98f4990bbf6b268365ba7fdf56405f

    SHA1

    e1f5a46baf14c6fdd67fcb1b3d37b54ad9a52317

    SHA256

    5f2ebf4e711218b1c47e8c83cbe354a369efcfed3835c480c7ae08001dfbdb8f

    SHA512

    bbf91e6a1a1c2a50f630d4ec347c7678647a78ce976af3db92b62498f77af84f506e1dadd4d9d8757c9f2297e80bbaf96e8575f5cb331800465417a6ed08717f

  • memory/248-16-0x00000000029A0000-0x0000000002A74000-memory.dmp

    Filesize

    848KB

  • memory/248-10-0x00000000029A0000-0x0000000002A74000-memory.dmp

    Filesize

    848KB

  • memory/248-14-0x00000000029A0000-0x0000000002A74000-memory.dmp

    Filesize

    848KB

  • memory/248-13-0x00000000029A0000-0x0000000002A74000-memory.dmp

    Filesize

    848KB

  • memory/248-11-0x00000000029A0000-0x0000000002A74000-memory.dmp

    Filesize

    848KB

  • memory/248-15-0x00000000029A0000-0x0000000002A74000-memory.dmp

    Filesize

    848KB

  • memory/248-0-0x00000000006F0000-0x0000000000737000-memory.dmp

    Filesize

    284KB

  • memory/248-8-0x0000000000740000-0x0000000000747000-memory.dmp

    Filesize

    28KB

  • memory/248-9-0x00000000029A0000-0x0000000002A74000-memory.dmp

    Filesize

    848KB

  • memory/248-7-0x0000000000440000-0x0000000000445000-memory.dmp

    Filesize

    20KB

  • memory/248-6-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/248-41-0x00000000029A0000-0x0000000002A74000-memory.dmp

    Filesize

    848KB

  • memory/248-1-0x00000000006F0000-0x0000000000737000-memory.dmp

    Filesize

    284KB

  • memory/248-40-0x0000000000440000-0x0000000000445000-memory.dmp

    Filesize

    20KB

  • memory/2700-20-0x00000000005F0000-0x0000000000637000-memory.dmp

    Filesize

    284KB

  • memory/2700-21-0x00000000005F0000-0x0000000000637000-memory.dmp

    Filesize

    284KB

  • memory/2912-19-0x0000000004F40000-0x0000000005568000-memory.dmp

    Filesize

    6.2MB

  • memory/2912-23-0x0000000004E90000-0x0000000004EF6000-memory.dmp

    Filesize

    408KB

  • memory/2912-24-0x00000000055E0000-0x0000000005646000-memory.dmp

    Filesize

    408KB

  • memory/2912-34-0x00000000056C0000-0x0000000005A14000-memory.dmp

    Filesize

    3.3MB

  • memory/2912-35-0x0000000005BC0000-0x0000000005BDE000-memory.dmp

    Filesize

    120KB

  • memory/2912-36-0x0000000005C00000-0x0000000005C4C000-memory.dmp

    Filesize

    304KB

  • memory/2912-37-0x0000000007300000-0x000000000797A000-memory.dmp

    Filesize

    6.5MB

  • memory/2912-38-0x0000000006C80000-0x0000000006C9A000-memory.dmp

    Filesize

    104KB

  • memory/2912-22-0x0000000004DF0000-0x0000000004E12000-memory.dmp

    Filesize

    136KB

  • memory/2912-18-0x0000000004830000-0x0000000004866000-memory.dmp

    Filesize

    216KB