Analysis

  • max time kernel
    145s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2024 23:12

General

  • Target

    0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exe

  • Size

    556KB

  • MD5

    0a01bc26ac7b9017961ec40d2c832edd

  • SHA1

    e780f037d52902eecd20e3476801e7a19005fd90

  • SHA256

    a20c6bcdf6fd33c66ce73e27d1e036f5002f2e22254a0f05dbec13860ab9b189

  • SHA512

    479d9403558765de34f799470970089439aeec45355dabff2b104b81a4045f5fac7deb95518ad8952e911794d89764a6a98f1b1b5633b57c52131533b8484a37

  • SSDEEP

    12288:R57FAgcKCEtlfJF3Z4mxx/v1xIAMCS+0667K:R575CCJQmXX1xIAtS+r+K

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • ModiLoader Second Stage 6 IoCs
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 3 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Server Software Component: Terminal Services DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:928
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c del "C:\Users\Admin\AppData\Local\Temp\0a01bc26ac7b9017961ec40d2c832edd_JaffaCakes118.exe"
      2⤵
        PID:4060
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k network
      1⤵
      • Loads dropped DLL
      PID:3184

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\sysns.dll

      Filesize

      191KB

      MD5

      007fb208b6cde541b9e4f372bb1ad186

      SHA1

      0f54350aa21ef2935b4d8b62f6c0455ca0d32174

      SHA256

      84a510265baaaace2dc3b053480299a34b5a8a9f7302788764ee75d4f8b6dc59

      SHA512

      dfb32a988801905dec5aeb772702dc7467c83c4fd330874990bc742a7177006ba7cac58d855e4b504176d3667badf4ef9535e4d3bde832d6ed8febd9e522e8a3

    • C:\Windows\plugin\001.dll

      Filesize

      12KB

      MD5

      f7bfce68a1162ff656e34e227d027f71

      SHA1

      91b4d714ffc11c4e2d2d053a4bd0eabf08ce1cfc

      SHA256

      f2d2557e52e84ee74bb26c999b7847868f0cc2861d858d86f906a11250db6ba5

      SHA512

      95e212f16128bd206a3a4d3664673701d29fd17a934b66f3ccf10875543d1552b84612a246b3e93c7a9092b90c9d4ab14e5f121ac021919d616f362d7c1af404

    • memory/928-34-0x0000000000900000-0x0000000000901000-memory.dmp

      Filesize

      4KB

    • memory/928-4-0x0000000002360000-0x0000000002361000-memory.dmp

      Filesize

      4KB

    • memory/928-10-0x0000000002300000-0x0000000002301000-memory.dmp

      Filesize

      4KB

    • memory/928-32-0x0000000003320000-0x0000000003321000-memory.dmp

      Filesize

      4KB

    • memory/928-8-0x0000000002340000-0x0000000002341000-memory.dmp

      Filesize

      4KB

    • memory/928-13-0x0000000003320000-0x0000000003420000-memory.dmp

      Filesize

      1024KB

    • memory/928-14-0x0000000003320000-0x0000000003420000-memory.dmp

      Filesize

      1024KB

    • memory/928-7-0x0000000002350000-0x0000000002351000-memory.dmp

      Filesize

      4KB

    • memory/928-19-0x0000000003320000-0x0000000003420000-memory.dmp

      Filesize

      1024KB

    • memory/928-18-0x0000000003320000-0x0000000003420000-memory.dmp

      Filesize

      1024KB

    • memory/928-12-0x00000000032D0000-0x00000000032D3000-memory.dmp

      Filesize

      12KB

    • memory/928-31-0x0000000003320000-0x0000000003321000-memory.dmp

      Filesize

      4KB

    • memory/928-38-0x00000000032F0000-0x00000000032F1000-memory.dmp

      Filesize

      4KB

    • memory/928-37-0x0000000003300000-0x0000000003301000-memory.dmp

      Filesize

      4KB

    • memory/928-36-0x0000000003310000-0x0000000003311000-memory.dmp

      Filesize

      4KB

    • memory/928-35-0x0000000000910000-0x0000000000911000-memory.dmp

      Filesize

      4KB

    • memory/928-0-0x0000000000400000-0x000000000049C000-memory.dmp

      Filesize

      624KB

    • memory/928-33-0x0000000002110000-0x0000000002164000-memory.dmp

      Filesize

      336KB

    • memory/928-9-0x0000000002370000-0x0000000002371000-memory.dmp

      Filesize

      4KB

    • memory/928-1-0x0000000002110000-0x0000000002164000-memory.dmp

      Filesize

      336KB

    • memory/928-29-0x0000000000400000-0x000000000049C000-memory.dmp

      Filesize

      624KB

    • memory/928-30-0x0000000003320000-0x0000000003420000-memory.dmp

      Filesize

      1024KB

    • memory/928-25-0x0000000003320000-0x0000000003420000-memory.dmp

      Filesize

      1024KB

    • memory/928-17-0x0000000003320000-0x0000000003420000-memory.dmp

      Filesize

      1024KB

    • memory/928-16-0x0000000003320000-0x0000000003420000-memory.dmp

      Filesize

      1024KB

    • memory/928-15-0x0000000003320000-0x0000000003420000-memory.dmp

      Filesize

      1024KB

    • memory/928-6-0x00000000022E0000-0x00000000022E1000-memory.dmp

      Filesize

      4KB

    • memory/928-5-0x00000000022F0000-0x00000000022F1000-memory.dmp

      Filesize

      4KB

    • memory/928-11-0x00000000032E0000-0x00000000032E1000-memory.dmp

      Filesize

      4KB

    • memory/928-3-0x0000000002310000-0x0000000002311000-memory.dmp

      Filesize

      4KB

    • memory/928-2-0x0000000002330000-0x0000000002331000-memory.dmp

      Filesize

      4KB

    • memory/3184-48-0x0000000000400000-0x0000000000484000-memory.dmp

      Filesize

      528KB

    • memory/3184-43-0x0000000000FE0000-0x0000000000FEE000-memory.dmp

      Filesize

      56KB

    • memory/3184-44-0x0000000000400000-0x0000000000484000-memory.dmp

      Filesize

      528KB

    • memory/3184-46-0x0000000000400000-0x0000000000484000-memory.dmp

      Filesize

      528KB

    • memory/3184-39-0x0000000000400000-0x0000000000484000-memory.dmp

      Filesize

      528KB

    • memory/3184-50-0x0000000000400000-0x0000000000484000-memory.dmp

      Filesize

      528KB