Analysis
- max time kernel
143s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
30/05/2024, 04:03
General
- Target 82fa69b0a13f32305d13dc88c2f3fbed_JaffaCakes118.exe
- Size 277KB
- Sample240530-emt8fadh2x
- SHA256 1cc2b271332ad8f952216047ae755c9e93f85788074f343f9be11c0be6059e3f
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- ModiLoader Second Stage 10 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\82fa69b0a13f32305d13dc88c2f3fbed_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fa69b0a13f32305d13dc88c2f3fbed_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\82fa69b0a13f32305d13dc88c2f3fbed_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82fa69b0a13f32305d13dc88c2f3fbed_JaffaCakes118.exe"2⤵
-
-
C:\Windows\system32\mshta.exe"C:\Windows\system32\mshta.exe" javascript:klt2CCTs="IIJfm";nL69=new%20ActiveXObject("WScript.Shell");CJ8VVzvUs="EBl";Jz29It=nL69.RegRead("HKLM\\software\\Wow6432Node\\6H4nnH3725\\OrcUdj");S1N7EniB="u9lOB";eval(Jz29It);ZVRjPW00h="VnIg17";1⤵
- Process spawned unexpected child process
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:oxpjlkww2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_d04aguz5.lrd.ps1
memory/4372-12-0x00000000009B0000-0x0000000000A84000-memory.dmp
memory/4372-7-0x0000000000400000-0x0000000000439000-memory.dmp
memory/4372-9-0x00000000009B0000-0x0000000000A84000-memory.dmp
memory/4372-13-0x00000000009B0000-0x0000000000A84000-memory.dmp
memory/4372-3-0x0000000000400000-0x0000000000439000-memory.dmp
memory/4372-10-0x00000000009B0000-0x0000000000A84000-memory.dmp
memory/4372-11-0x00000000009B0000-0x0000000000A84000-memory.dmp
memory/4372-14-0x00000000009B0000-0x0000000000A84000-memory.dmp
memory/4372-8-0x0000000000400000-0x0000000000439000-memory.dmp
memory/4372-15-0x00000000009B0000-0x0000000000A84000-memory.dmp
memory/5888-21-0x00000000059F0000-0x0000000005A56000-memory.dmp
memory/5888-19-0x00000000051B0000-0x00000000051D2000-memory.dmp
memory/5888-18-0x0000000005220000-0x0000000005848000-memory.dmp
memory/5888-20-0x0000000005980000-0x00000000059E6000-memory.dmp
memory/5888-17-0x0000000002840000-0x0000000002876000-memory.dmp
memory/5888-31-0x0000000005A60000-0x0000000005DB4000-memory.dmp
memory/5888-32-0x0000000005F50000-0x0000000005F6E000-memory.dmp
memory/5888-33-0x0000000005F90000-0x0000000005FDC000-memory.dmp
memory/5888-34-0x0000000007670000-0x0000000007CEA000-memory.dmp
memory/5888-35-0x0000000007010000-0x000000000702A000-memory.dmp