Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2024 22:13
Behavioral task
behavioral1
Sample
9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exe
-
Size
173KB
-
MD5
9c1cab1001b33950d03fc9e3a2e715a5
-
SHA1
7750b75e3e51f36743b117cba6157e80240bf709
-
SHA256
ed117253e0f9745ed82690515f66e6da5edcfbef56283ad22d006dd0bd4071fc
-
SHA512
90cfc254c65344a4edb78005d932162e6b05402cd114e63cca9f82461c72053edf856c9d395fce5531668b26b830751ddb8dcde21e7ed36687a4f8ed2527e5de
-
SSDEEP
3072:99okd0/TZRnkXcSCajvDQDy7NgbjyEcBjsYwSd3Kgt8dTBfH8EW2:93gZOXxPkDy7NgMwSd3NqdTB/8x2
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
apocalyps32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = ",C:\\Windows\\apocalyps32.exe" apocalyps32.exe -
ModiLoader Second Stage 16 IoCs
Processes:
resource yara_rule C:\Windows\apocalyps32.exe modiloader_stage2 behavioral2/memory/652-4-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral2/memory/2660-5-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral2/memory/2660-6-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral2/memory/2660-7-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral2/memory/2660-8-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral2/memory/2660-9-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral2/memory/2660-10-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral2/memory/2660-11-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral2/memory/2660-12-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral2/memory/2660-13-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral2/memory/2660-14-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral2/memory/2660-15-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral2/memory/2660-16-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral2/memory/2660-17-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 behavioral2/memory/2660-18-0x0000000030000000-0x0000000030031000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
apocalyps32.exepid process 2660 apocalyps32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
apocalyps32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\apocalyps32 = "C:\\Windows\\apocalyps32.exe" apocalyps32.exe -
Drops file in Windows directory 2 IoCs
Processes:
9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\apocalyps32.exe 9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exe File created C:\Windows\apocalyps32.exe 9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
apocalyps32.exepid process 2660 apocalyps32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
apocalyps32.exepid process 2660 apocalyps32.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exeapocalyps32.exedescription pid process target process PID 652 wrote to memory of 2660 652 9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exe apocalyps32.exe PID 652 wrote to memory of 2660 652 9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exe apocalyps32.exe PID 652 wrote to memory of 2660 652 9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exe apocalyps32.exe PID 2660 wrote to memory of 3352 2660 apocalyps32.exe Explorer.EXE PID 2660 wrote to memory of 3352 2660 apocalyps32.exe Explorer.EXE PID 2660 wrote to memory of 3352 2660 apocalyps32.exe Explorer.EXE PID 2660 wrote to memory of 3352 2660 apocalyps32.exe Explorer.EXE PID 2660 wrote to memory of 3352 2660 apocalyps32.exe Explorer.EXE PID 2660 wrote to memory of 3352 2660 apocalyps32.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9c1cab1001b33950d03fc9e3a2e715a5_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\apocalyps32.exe-bs3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\apocalyps32.exeFilesize
173KB
MD59c1cab1001b33950d03fc9e3a2e715a5
SHA17750b75e3e51f36743b117cba6157e80240bf709
SHA256ed117253e0f9745ed82690515f66e6da5edcfbef56283ad22d006dd0bd4071fc
SHA51290cfc254c65344a4edb78005d932162e6b05402cd114e63cca9f82461c72053edf856c9d395fce5531668b26b830751ddb8dcde21e7ed36687a4f8ed2527e5de
-
memory/652-4-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2660-5-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2660-6-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2660-7-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2660-8-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2660-9-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2660-10-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2660-11-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2660-12-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2660-13-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2660-14-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2660-15-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2660-16-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2660-17-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB
-
memory/2660-18-0x0000000030000000-0x0000000030031000-memory.dmpFilesize
196KB