Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-06-2024 11:39
Static task
static1
Behavioral task
behavioral1
Sample
bbbbf63caf6a880b5eda01e9e66aeef4_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
bbbbf63caf6a880b5eda01e9e66aeef4_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
bbbbf63caf6a880b5eda01e9e66aeef4_JaffaCakes118.exe
-
Size
794KB
-
MD5
bbbbf63caf6a880b5eda01e9e66aeef4
-
SHA1
ca702fbe0adbc8514a3ef277434e0636a6616490
-
SHA256
29ede81b60e5339d3df6b58fe4205a57c2c7862c1e2a6f8398676666edf1d470
-
SHA512
d0e34b4120417cafea7e5ef86facf050020d5052635e93dc226e853977f76a9e4040d36ce0c909214e0e95f5a2994c0c942b30a199ff11fd17ac60b6f7b52c96
-
SSDEEP
12288:1QHlW7lerECtu4aLgbqu6khVc0qI7oe3gPxWNpUcocscxFZwb:1QQperrOUj6k7ZqC30VFMlwb
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
mshta.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 868 4644 mshta.exe -
ModiLoader Second Stage 11 IoCs
Processes:
resource yara_rule behavioral2/memory/4108-18-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral2/memory/4108-26-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral2/memory/4108-27-0x00000000010C0000-0x0000000001194000-memory.dmp modiloader_stage2 behavioral2/memory/4108-31-0x00000000010C0000-0x0000000001194000-memory.dmp modiloader_stage2 behavioral2/memory/4108-32-0x00000000010C0000-0x0000000001194000-memory.dmp modiloader_stage2 behavioral2/memory/4108-30-0x00000000010C0000-0x0000000001194000-memory.dmp modiloader_stage2 behavioral2/memory/4108-29-0x00000000010C0000-0x0000000001194000-memory.dmp modiloader_stage2 behavioral2/memory/4108-28-0x00000000010C0000-0x0000000001194000-memory.dmp modiloader_stage2 behavioral2/memory/4108-33-0x00000000010C0000-0x0000000001194000-memory.dmp modiloader_stage2 behavioral2/memory/4108-34-0x00000000010C0000-0x0000000001194000-memory.dmp modiloader_stage2 behavioral2/memory/4108-56-0x00000000010C0000-0x0000000001194000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mshta.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation mshta.exe -
Executes dropped EXE 1 IoCs
Processes:
UUPPHBZOfNIWNOEBZBhdR.exepid process 3964 UUPPHBZOfNIWNOEBZBhdR.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
bbbbf63caf6a880b5eda01e9e66aeef4_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" bbbbf63caf6a880b5eda01e9e66aeef4_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
UUPPHBZOfNIWNOEBZBhdR.exedescription pid process target process PID 3964 set thread context of 4108 3964 UUPPHBZOfNIWNOEBZBhdR.exe wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 3780 powershell.exe 3780 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3780 powershell.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
bbbbf63caf6a880b5eda01e9e66aeef4_JaffaCakes118.exeUUPPHBZOfNIWNOEBZBhdR.exemshta.exedescription pid process target process PID 3704 wrote to memory of 3964 3704 bbbbf63caf6a880b5eda01e9e66aeef4_JaffaCakes118.exe UUPPHBZOfNIWNOEBZBhdR.exe PID 3704 wrote to memory of 3964 3704 bbbbf63caf6a880b5eda01e9e66aeef4_JaffaCakes118.exe UUPPHBZOfNIWNOEBZBhdR.exe PID 3704 wrote to memory of 3964 3704 bbbbf63caf6a880b5eda01e9e66aeef4_JaffaCakes118.exe UUPPHBZOfNIWNOEBZBhdR.exe PID 3964 wrote to memory of 4108 3964 UUPPHBZOfNIWNOEBZBhdR.exe wscript.exe PID 3964 wrote to memory of 4108 3964 UUPPHBZOfNIWNOEBZBhdR.exe wscript.exe PID 3964 wrote to memory of 4108 3964 UUPPHBZOfNIWNOEBZBhdR.exe wscript.exe PID 3964 wrote to memory of 4108 3964 UUPPHBZOfNIWNOEBZBhdR.exe wscript.exe PID 3964 wrote to memory of 4108 3964 UUPPHBZOfNIWNOEBZBhdR.exe wscript.exe PID 868 wrote to memory of 3780 868 mshta.exe powershell.exe PID 868 wrote to memory of 3780 868 mshta.exe powershell.exe PID 868 wrote to memory of 3780 868 mshta.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbbbf63caf6a880b5eda01e9e66aeef4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bbbbf63caf6a880b5eda01e9e66aeef4_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exe UUPPHBZOfNIWNOEBZBh2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe- CmdLine Args3⤵
-
C:\Windows\system32\mshta.exe"C:\Windows\system32\mshta.exe" javascript:kI8ephCeQ="Kv";s56W=new%20ActiveXObject("WScript.Shell");q7IlfXr4="y0qotg3B";w3xQU=s56W.RegRead("HKLM\\software\\Wow6432Node\\F3jusL\\EjQGywA");sXCBcFK4="9Onzq";eval(w3xQU);D4h6bEuQ="l4jTHsa";1⤵
- Process spawned unexpected child process
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:lrfkpsy2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TcEMbLQgCOBPFilesize
211KB
MD58fadfcb36f2fcb8cd5563aa718ff7958
SHA100ed85c2346231c8d9b146bf77abe37712f298a5
SHA256abc35989ce7d5dddcaba45ee4fabf1d7029b6afc5ab11bfb6c69a8a5a9a79f91
SHA51263b9bcd5361c13165104446d981022614c8f84345895937d0686d5b37407a105c196e2219a1f09feb552a778987ca6536e8914987073ba92b62364b62d4ce139
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhFilesize
38KB
MD5adbbe9634b5819cc48cb9700d0d21f7b
SHA14a2f11f35db9fd8a3dfff28c9bfcd1463a8aeb2e
SHA256af423bd619a7ddf795f53194985596794c30279a56221dd30b67c3a7ba19a865
SHA51260d80abf67cedbd2d86459461b90eba039ec14b6f002daf44468ce621960d5fc745ccb6319f9c15fd0c29cfe6581ac2026d8747908005fbbf245d71144171d04
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UUPPHBZOfNIWNOEBZBhdR.exeFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5tdt2wmj.k3k.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/3780-54-0x0000000006490000-0x00000000064AA000-memory.dmpFilesize
104KB
-
memory/3780-53-0x00000000077D0000-0x0000000007E4A000-memory.dmpFilesize
6.5MB
-
memory/3780-52-0x0000000005FA0000-0x0000000005FEC000-memory.dmpFilesize
304KB
-
memory/3780-51-0x0000000005F60000-0x0000000005F7E000-memory.dmpFilesize
120KB
-
memory/3780-50-0x0000000005AD0000-0x0000000005E24000-memory.dmpFilesize
3.3MB
-
memory/3780-37-0x0000000005350000-0x0000000005978000-memory.dmpFilesize
6.2MB
-
memory/3780-40-0x0000000005A60000-0x0000000005AC6000-memory.dmpFilesize
408KB
-
memory/3780-39-0x00000000059F0000-0x0000000005A56000-memory.dmpFilesize
408KB
-
memory/3780-38-0x00000000051C0000-0x00000000051E2000-memory.dmpFilesize
136KB
-
memory/3780-36-0x0000000004BD0000-0x0000000004C06000-memory.dmpFilesize
216KB
-
memory/3964-17-0x0000000001750000-0x0000000001751000-memory.dmpFilesize
4KB
-
memory/4108-27-0x00000000010C0000-0x0000000001194000-memory.dmpFilesize
848KB
-
memory/4108-34-0x00000000010C0000-0x0000000001194000-memory.dmpFilesize
848KB
-
memory/4108-33-0x00000000010C0000-0x0000000001194000-memory.dmpFilesize
848KB
-
memory/4108-28-0x00000000010C0000-0x0000000001194000-memory.dmpFilesize
848KB
-
memory/4108-29-0x00000000010C0000-0x0000000001194000-memory.dmpFilesize
848KB
-
memory/4108-30-0x00000000010C0000-0x0000000001194000-memory.dmpFilesize
848KB
-
memory/4108-32-0x00000000010C0000-0x0000000001194000-memory.dmpFilesize
848KB
-
memory/4108-31-0x00000000010C0000-0x0000000001194000-memory.dmpFilesize
848KB
-
memory/4108-26-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/4108-18-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/4108-56-0x00000000010C0000-0x0000000001194000-memory.dmpFilesize
848KB