Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2024 18:03
Behavioral task
behavioral1
Sample
426b0c346df4beed65ea2fa9d94807e3_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
426b0c346df4beed65ea2fa9d94807e3_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
426b0c346df4beed65ea2fa9d94807e3_JaffaCakes118.exe
-
Size
18KB
-
MD5
426b0c346df4beed65ea2fa9d94807e3
-
SHA1
9e8f46a08e01a6a89e2dd6f324da88da50ad836a
-
SHA256
943d86149b1761efc06b3d4700f3dff50be50661cdab80c06b247135c1d27491
-
SHA512
a16b2023b8d72f34264a73066fe3cdabad1547c045119b4d28ae8eba28d5c8d9f70cbc4c6f3f7157df61cc0e8aa81dda9be395560f7779ebcfcf8bac8f19ce9a
-
SSDEEP
384:7Ew7wknHOYXQdhLGPvCaV4pLS7OGQ8xy1Czc/Dp+c6nne:7Ew7wkHOYEGPvCaV4pLzb1f/Dpl
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
Processes:
resource yara_rule behavioral2/memory/840-8-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/4004-10-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/4004-11-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
426b0c346df4beed65ea2fa9d94807e3_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 426b0c346df4beed65ea2fa9d94807e3_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
AdobeART.exepid process 4004 AdobeART.exe -
Processes:
resource yara_rule behavioral2/memory/840-0-0x0000000000400000-0x0000000000414000-memory.dmp upx C:\Users\Admin\AppData\Roaming\AdobeART.exe upx behavioral2/memory/840-8-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4004-10-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4004-11-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
AdobeART.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeART = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeART.exe" AdobeART.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
426b0c346df4beed65ea2fa9d94807e3_JaffaCakes118.exedescription pid process target process PID 840 wrote to memory of 4004 840 426b0c346df4beed65ea2fa9d94807e3_JaffaCakes118.exe AdobeART.exe PID 840 wrote to memory of 4004 840 426b0c346df4beed65ea2fa9d94807e3_JaffaCakes118.exe AdobeART.exe PID 840 wrote to memory of 4004 840 426b0c346df4beed65ea2fa9d94807e3_JaffaCakes118.exe AdobeART.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\426b0c346df4beed65ea2fa9d94807e3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\426b0c346df4beed65ea2fa9d94807e3_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AdobeART.exe"C:\Users\Admin\AppData\Roaming\AdobeART.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\AdobeART.exeFilesize
18KB
MD5426b0c346df4beed65ea2fa9d94807e3
SHA19e8f46a08e01a6a89e2dd6f324da88da50ad836a
SHA256943d86149b1761efc06b3d4700f3dff50be50661cdab80c06b247135c1d27491
SHA512a16b2023b8d72f34264a73066fe3cdabad1547c045119b4d28ae8eba28d5c8d9f70cbc4c6f3f7157df61cc0e8aa81dda9be395560f7779ebcfcf8bac8f19ce9a
-
memory/840-0-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/840-8-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4004-10-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4004-11-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB