Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
17-06-2024 09:56
Behavioral task
behavioral1
Sample
b803cbdebe97b11bf1315129362e6cb9_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b803cbdebe97b11bf1315129362e6cb9_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
b803cbdebe97b11bf1315129362e6cb9_JaffaCakes118.exe
-
Size
84KB
-
MD5
b803cbdebe97b11bf1315129362e6cb9
-
SHA1
9c88cd51078c8f6b61fda47fae6a39ecd111f1e0
-
SHA256
4d6b7109a4c1640f0c68a06c53d54f64425d6cbe6c84d88fc18a0c5adedeb187
-
SHA512
fda931c19cb7ccc0768365087892be4619e9ece8546c185ab706ebfc907573fccccd4daeaa9f3a269c667bde3867f5a491381482418cd1d4b585f7a2ba397bb5
-
SSDEEP
1536:BeP5NJ2OOnVZV9+QwdiHbzXShcpNYAAroExqs:BW5P4RvOiHnXSOpNErx0
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 16 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\chost.exe modiloader_stage2 behavioral2/memory/1568-7-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/1464-9-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/1464-10-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/1464-11-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/1464-12-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/1464-13-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/1464-14-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/1464-15-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/1464-16-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/1464-17-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/1464-18-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/1464-19-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/1464-20-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/1464-21-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral2/memory/1464-22-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b803cbdebe97b11bf1315129362e6cb9_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation b803cbdebe97b11bf1315129362e6cb9_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
chost.exepid process 1464 chost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
chost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\host = "C:\\Users\\Admin\\AppData\\Local\\chost.exe" chost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
chost.exepid process 1464 chost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
b803cbdebe97b11bf1315129362e6cb9_JaffaCakes118.exedescription pid process target process PID 1568 wrote to memory of 1464 1568 b803cbdebe97b11bf1315129362e6cb9_JaffaCakes118.exe chost.exe PID 1568 wrote to memory of 1464 1568 b803cbdebe97b11bf1315129362e6cb9_JaffaCakes118.exe chost.exe PID 1568 wrote to memory of 1464 1568 b803cbdebe97b11bf1315129362e6cb9_JaffaCakes118.exe chost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b803cbdebe97b11bf1315129362e6cb9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b803cbdebe97b11bf1315129362e6cb9_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\chost.exe"C:\Users\Admin\AppData\Local\chost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\chost.exeFilesize
84KB
MD5b803cbdebe97b11bf1315129362e6cb9
SHA19c88cd51078c8f6b61fda47fae6a39ecd111f1e0
SHA2564d6b7109a4c1640f0c68a06c53d54f64425d6cbe6c84d88fc18a0c5adedeb187
SHA512fda931c19cb7ccc0768365087892be4619e9ece8546c185ab706ebfc907573fccccd4daeaa9f3a269c667bde3867f5a491381482418cd1d4b585f7a2ba397bb5
-
memory/1464-15-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1464-16-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1464-10-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1464-11-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1464-12-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1464-13-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1464-9-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1464-22-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1464-14-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1464-17-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1464-18-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1464-19-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1464-20-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1464-21-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1568-7-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB