Analysis
-
max time kernel
145s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 23:12
Static task
static1
Behavioral task
behavioral1
Sample
0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exe
-
Size
556KB
-
MD5
0a01bc26ac7b9017961ec40d2c832edd
-
SHA1
e780f037d52902eecd20e3476801e7a19005fd90
-
SHA256
a20c6bcdf6fd33c66ce73e27d1e036f5002f2e22254a0f05dbec13860ab9b189
-
SHA512
479d9403558765de34f799470970089439aeec45355dabff2b104b81a4045f5fac7deb95518ad8952e911794d89764a6a98f1b1b5633b57c52131533b8484a37
-
SSDEEP
12288:R57FAgcKCEtlfJF3Z4mxx/v1xIAMCS+0667K:R575CCJQmXX1xIAtS+r+K
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\System32\\userinit.exe,\"C:\\Windows\\netservice.exe\"un userinit.exe" 0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exe -
ModiLoader Second Stage 6 IoCs
Processes:
resource yara_rule behavioral2/memory/3184-39-0x0000000000400000-0x0000000000484000-memory.dmp modiloader_stage2 behavioral2/memory/928-29-0x0000000000400000-0x000000000049C000-memory.dmp modiloader_stage2 behavioral2/memory/3184-44-0x0000000000400000-0x0000000000484000-memory.dmp modiloader_stage2 behavioral2/memory/3184-46-0x0000000000400000-0x0000000000484000-memory.dmp modiloader_stage2 behavioral2/memory/3184-48-0x0000000000400000-0x0000000000484000-memory.dmp modiloader_stage2 behavioral2/memory/3184-50-0x0000000000400000-0x0000000000484000-memory.dmp modiloader_stage2 -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
Processes:
0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\netns\Parameters\ServiceDll = "C:\\Windows\\System32\\sysns.dll" 0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exe -
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Windows\SysWOW64\sysns.dll acprotect C:\Windows\plugin\001.dll acprotect -
Loads dropped DLL 3 IoCs
Processes:
svchost.exepid process 3184 svchost.exe 3184 svchost.exe 3184 svchost.exe -
Processes:
resource yara_rule C:\Windows\SysWOW64\sysns.dll upx behavioral2/memory/3184-39-0x0000000000400000-0x0000000000484000-memory.dmp upx C:\Windows\plugin\001.dll upx behavioral2/memory/3184-43-0x0000000000FE0000-0x0000000000FEE000-memory.dmp upx behavioral2/memory/3184-44-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3184-46-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3184-48-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3184-50-0x0000000000400000-0x0000000000484000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\sysns.dll 0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sysns.dll 0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exe -
Drops file in Windows directory 3 IoCs
Processes:
0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exedescription ioc process File created C:\Windows\netservice.exe 0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exe File opened for modification C:\Windows\netservice.exe 0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exe File created C:\Windows\plugin\001.dll 0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exedescription pid process target process PID 928 wrote to memory of 4060 928 0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exe cmd.exe PID 928 wrote to memory of 4060 928 0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exe cmd.exe PID 928 wrote to memory of 4060 928 0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exe"2⤵PID:4060
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k network1⤵
- Loads dropped DLL
PID:3184
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
191KB
MD5007fb208b6cde541b9e4f372bb1ad186
SHA10f54350aa21ef2935b4d8b62f6c0455ca0d32174
SHA25684a510265baaaace2dc3b053480299a34b5a8a9f7302788764ee75d4f8b6dc59
SHA512dfb32a988801905dec5aeb772702dc7467c83c4fd330874990bc742a7177006ba7cac58d855e4b504176d3667badf4ef9535e4d3bde832d6ed8febd9e522e8a3
-
Filesize
12KB
MD5f7bfce68a1162ff656e34e227d027f71
SHA191b4d714ffc11c4e2d2d053a4bd0eabf08ce1cfc
SHA256f2d2557e52e84ee74bb26c999b7847868f0cc2861d858d86f906a11250db6ba5
SHA51295e212f16128bd206a3a4d3664673701d29fd17a934b66f3ccf10875543d1552b84612a246b3e93c7a9092b90c9d4ab14e5f121ac021919d616f362d7c1af404