Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
12/05/2024, 03:48
General
- Target 381a181f8e40fc7ddf8c2c15dc6d55a2_JaffaCakes118.exe
- Size 396KB
- Sample240512-ec3rtsfa6s
- SHA256 9f195d5b1ff0a5f0c07973d60624c89141c01c0d01d3f8091aa7626150ddf598
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- ModiLoader Second Stage 10 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\381a181f8e40fc7ddf8c2c15dc6d55a2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\381a181f8e40fc7ddf8c2c15dc6d55a2_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\381a181f8e40fc7ddf8c2c15dc6d55a2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\381a181f8e40fc7ddf8c2c15dc6d55a2_JaffaCakes118.exe"2⤵
-
-
C:\Windows\system32\mshta.exe"C:\Windows\system32\mshta.exe" javascript:eNYtS4="wn";m82z=new%20ActiveXObject("WScript.Shell");yQIxnq05="84D2Y";UF5bg=m82z.RegRead("HKLM\\software\\Wow6432Node\\JlLiYm\\KwgNiHQz1T");B3PNO="2Ms";eval(UF5bg);O04dLyoy="EE";1⤵
- Process spawned unexpected child process
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:oiiu2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_kqdin4ry.nlb.ps1
memory/2288-15-0x00000000008E0000-0x00000000009B6000-memory.dmp
memory/2288-11-0x0000000000400000-0x000000000043A000-memory.dmp
memory/2288-12-0x00000000008E0000-0x00000000009B6000-memory.dmp
memory/2288-16-0x00000000008E0000-0x00000000009B6000-memory.dmp
memory/2288-4-0x0000000000400000-0x000000000043A000-memory.dmp
memory/2288-14-0x00000000008E0000-0x00000000009B6000-memory.dmp
memory/2288-13-0x00000000008E0000-0x00000000009B6000-memory.dmp
memory/2288-17-0x00000000008E0000-0x00000000009B6000-memory.dmp
memory/2288-10-0x0000000000400000-0x000000000043A000-memory.dmp
memory/2288-18-0x00000000008E0000-0x00000000009B6000-memory.dmp
memory/2488-23-0x0000000005B90000-0x0000000005BF6000-memory.dmp
memory/2488-22-0x0000000005AF0000-0x0000000005B12000-memory.dmp
memory/2488-21-0x0000000005D30000-0x0000000006358000-memory.dmp
memory/2488-24-0x0000000006360000-0x00000000063C6000-memory.dmp
memory/2488-20-0x0000000003180000-0x00000000031B6000-memory.dmp
memory/2488-34-0x0000000006460000-0x00000000067B4000-memory.dmp
memory/2488-35-0x0000000006890000-0x00000000068AE000-memory.dmp
memory/2488-36-0x00000000068C0000-0x000000000690C000-memory.dmp
memory/2488-37-0x0000000008130000-0x00000000087AA000-memory.dmp
memory/2488-38-0x0000000006DA0000-0x0000000006DBA000-memory.dmp