Analysis
-
max time kernel
148s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-06-2024 22:13
Behavioral task
behavioral1
Sample
9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exe
-
Size
173KB
-
MD5
9c1cab1001b33950d03fc9e3a2e715a5
-
SHA1
7750b75e3e51f36743b117cba6157e80240bf709
-
SHA256
ed117253e0f9745ed82690515f66e6da5edcfbef56283ad22d006dd0bd4071fc
-
SHA512
90cfc254c65344a4edb78005d932162e6b05402cd114e63cca9f82461c72053edf856c9d395fce5531668b26b830751ddb8dcde21e7ed36687a4f8ed2527e5de
-
SSDEEP
3072:99okd0/TZRnkXcSCajvDQDy7NgbjyEcBjsYwSd3Kgt8dTBfH8EW2:93gZOXxPkDy7NgMwSd3NqdTB/8x2
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
apocalyps32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "userinit.exe,C:\\Windows\\apocalyps32.exe" apocalyps32.exe -
ModiLoader Second Stage 16 IoCs
Processes:
resource yara_rule C:\Windows\apocalyps32.exe modiloader_stage2 behavioral1/memory/2964-6-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral1/memory/2968-14-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral1/memory/2968-15-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral1/memory/2968-16-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral1/memory/2968-17-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral1/memory/2968-18-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral1/memory/2968-19-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral1/memory/2968-20-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral1/memory/2968-21-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral1/memory/2968-22-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral1/memory/2968-23-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral1/memory/2968-24-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral1/memory/2968-25-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral1/memory/2968-26-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral1/memory/2968-27-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
apocalyps32.exepid process 2968 apocalyps32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
apocalyps32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\apocalyps32 = "C:\\Windows\\apocalyps32.exe" apocalyps32.exe -
Drops file in Windows directory 2 IoCs
Processes:
9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exedescription ioc process File created C:\Windows\apocalyps32.exe 9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exe File opened for modification C:\Windows\apocalyps32.exe 9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
apocalyps32.exepid process 2968 apocalyps32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
apocalyps32.exepid process 2968 apocalyps32.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exeapocalyps32.exedescription pid process target process PID 2964 wrote to memory of 2968 2964 9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exe apocalyps32.exe PID 2964 wrote to memory of 2968 2964 9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exe apocalyps32.exe PID 2964 wrote to memory of 2968 2964 9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exe apocalyps32.exe PID 2964 wrote to memory of 2968 2964 9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exe apocalyps32.exe PID 2968 wrote to memory of 1156 2968 apocalyps32.exe Explorer.EXE PID 2968 wrote to memory of 1156 2968 apocalyps32.exe Explorer.EXE PID 2968 wrote to memory of 1156 2968 apocalyps32.exe Explorer.EXE PID 2968 wrote to memory of 1156 2968 apocalyps32.exe Explorer.EXE PID 2968 wrote to memory of 1156 2968 apocalyps32.exe Explorer.EXE PID 2968 wrote to memory of 1156 2968 apocalyps32.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\apocalyps32.exe-bs3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\apocalyps32.exeFilesize
173KB
MD59c1cab1001b33950d03fc9e3a2e715a5
SHA17750b75e3e51f36743b117cba6157e80240bf709
SHA256ed117253e0f9745ed82690515f66e6da5edcfbef56283ad22d006dd0bd4071fc
SHA51290cfc254c65344a4edb78005d932162e6b05402cd114e63cca9f82461c72053edf856c9d395fce5531668b26b830751ddb8dcde21e7ed36687a4f8ed2527e5de
-
memory/1156-7-0x0000000002A20000-0x0000000002A21000-memory.dmpFilesize
4KB
-
memory/2964-6-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2968-19-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2968-21-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2968-16-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2968-17-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2968-18-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2968-14-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2968-20-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2968-15-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2968-22-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2968-23-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2968-24-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2968-25-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2968-26-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2968-27-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB