Analysis
-
max time kernel
145s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 18:16
Static task
static1
Behavioral task
behavioral1
Sample
72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe
-
Size
402KB
-
MD5
72d5c9929f5deeaaf53ddef612923201
-
SHA1
0e6d891ad656d0c39c1475e659a98d4628f3b7cd
-
SHA256
f0f348f34867b9bdbb490dd240428db74fde3e10b87d0b84f51ec052a457938f
-
SHA512
5de91cbfef4229cb56432821c2f196874ad3c8cb12daaad453fc2b495dc7aff899f196e75a82b7e0e75c59995605a650b4c3b674625d783f16645d1c7ddec91b
-
SSDEEP
6144:HxQviFxbA9zK4nZ5FD5FHXqzZKUWX6Ee8smVC9BwJ4ayW:qvKbUKmPFCZKnRVCBy4av
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
mshta.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1784 2328 mshta.exe -
ModiLoader Second Stage 10 IoCs
Processes:
resource yara_rule behavioral2/memory/4668-15-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral2/memory/4668-16-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral2/memory/4668-17-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral2/memory/4668-22-0x0000000000880000-0x0000000000954000-memory.dmp modiloader_stage2 behavioral2/memory/4668-21-0x0000000000880000-0x0000000000954000-memory.dmp modiloader_stage2 behavioral2/memory/4668-20-0x0000000000880000-0x0000000000954000-memory.dmp modiloader_stage2 behavioral2/memory/4668-18-0x0000000000880000-0x0000000000954000-memory.dmp modiloader_stage2 behavioral2/memory/4668-19-0x0000000000880000-0x0000000000954000-memory.dmp modiloader_stage2 behavioral2/memory/4668-23-0x0000000000880000-0x0000000000954000-memory.dmp modiloader_stage2 behavioral2/memory/4668-24-0x0000000000880000-0x0000000000954000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exemshta.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation 72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation mshta.exe -
Executes dropped EXE 2 IoCs
Processes:
988.exe988.exepid process 2268 988.exe 4668 988.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 1416 powershell.exe 1416 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1416 powershell.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe988.exemshta.exedescription pid process target process PID 4848 wrote to memory of 2588 4848 72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe 72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe PID 4848 wrote to memory of 2588 4848 72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe 72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe PID 4848 wrote to memory of 2588 4848 72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe 72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe PID 4848 wrote to memory of 2588 4848 72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe 72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe PID 4848 wrote to memory of 2588 4848 72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe 72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe PID 4848 wrote to memory of 2588 4848 72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe 72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe PID 4848 wrote to memory of 2588 4848 72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe 72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe PID 4848 wrote to memory of 2588 4848 72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe 72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe PID 2588 wrote to memory of 2268 2588 72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe 988.exe PID 2588 wrote to memory of 2268 2588 72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe 988.exe PID 2588 wrote to memory of 2268 2588 72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe 988.exe PID 2268 wrote to memory of 4668 2268 988.exe 988.exe PID 2268 wrote to memory of 4668 2268 988.exe 988.exe PID 2268 wrote to memory of 4668 2268 988.exe 988.exe PID 2268 wrote to memory of 4668 2268 988.exe 988.exe PID 2268 wrote to memory of 4668 2268 988.exe 988.exe PID 2268 wrote to memory of 4668 2268 988.exe 988.exe PID 2268 wrote to memory of 4668 2268 988.exe 988.exe PID 2268 wrote to memory of 4668 2268 988.exe 988.exe PID 2268 wrote to memory of 4668 2268 988.exe 988.exe PID 1784 wrote to memory of 1416 1784 mshta.exe powershell.exe PID 1784 wrote to memory of 1416 1784 mshta.exe powershell.exe PID 1784 wrote to memory of 1416 1784 mshta.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\72d5c9929f5deeaaf53ddef612923201_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\988.exe"C:\Users\Admin\AppData\Local\Temp\988.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\988.exe"C:\Users\Admin\AppData\Local\Temp\988.exe"4⤵
- Executes dropped EXE
PID:4668
-
C:\Windows\system32\mshta.exe"C:\Windows\system32\mshta.exe" javascript:PLejMNE5="JTz";H64Z=new%20ActiveXObject("WScript.Shell");BkmOX1iuE3="RNFMwEdC";Z17Wwk=H64Z.RegRead("HKLM\\software\\Wow6432Node\\ttNGv9bG\\WfdAwcy5");KqDMip8G6I="cFZIAYQQ";eval(Z17Wwk);yodLe00Q="k9HkMU5";1⤵
- Process spawned unexpected child process
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:srwpws2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1416
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\988.exeFilesize
312KB
MD5a3219787e189eea4c7dd81f766f3350d
SHA1369d430d0dad619a4a26f2546c483d723a6a5f85
SHA256cf137ffac729c32770b7fab7a8e925f7903e952f4aa4143fa84211331c3e694f
SHA51230cfff78744679c1ef2ec358d9dd7c46c8566fa3293aa750ff4ff0743e0a6f2a98e3060f140ff44ac319af1bf899cdaa5fb4e1c17a0f3ff6f71ff4509aea0b90
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zdqippm5.jua.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1416-30-0x0000000005A30000-0x0000000005A96000-memory.dmpFilesize
408KB
-
memory/1416-27-0x0000000005390000-0x00000000059B8000-memory.dmpFilesize
6.2MB
-
memory/1416-26-0x0000000002850000-0x0000000002886000-memory.dmpFilesize
216KB
-
memory/1416-44-0x0000000007000000-0x000000000701A000-memory.dmpFilesize
104KB
-
memory/1416-28-0x00000000051B0000-0x00000000051D2000-memory.dmpFilesize
136KB
-
memory/1416-43-0x00000000076D0000-0x0000000007D4A000-memory.dmpFilesize
6.5MB
-
memory/1416-42-0x0000000005F80000-0x0000000005FCC000-memory.dmpFilesize
304KB
-
memory/1416-41-0x0000000005F50000-0x0000000005F6E000-memory.dmpFilesize
120KB
-
memory/1416-40-0x0000000005AA0000-0x0000000005DF4000-memory.dmpFilesize
3.3MB
-
memory/1416-29-0x0000000005310000-0x0000000005376000-memory.dmpFilesize
408KB
-
memory/2588-2-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2588-1-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2588-0-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2588-11-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4668-16-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/4668-24-0x0000000000880000-0x0000000000954000-memory.dmpFilesize
848KB
-
memory/4668-23-0x0000000000880000-0x0000000000954000-memory.dmpFilesize
848KB
-
memory/4668-19-0x0000000000880000-0x0000000000954000-memory.dmpFilesize
848KB
-
memory/4668-18-0x0000000000880000-0x0000000000954000-memory.dmpFilesize
848KB
-
memory/4668-20-0x0000000000880000-0x0000000000954000-memory.dmpFilesize
848KB
-
memory/4668-21-0x0000000000880000-0x0000000000954000-memory.dmpFilesize
848KB
-
memory/4668-22-0x0000000000880000-0x0000000000954000-memory.dmpFilesize
848KB
-
memory/4668-17-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/4668-15-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB