Analysis
-
max time kernel
148s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 02:31
Behavioral task
behavioral1
Sample
020f16b063839725abb42290a939694e_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
020f16b063839725abb42290a939694e_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
020f16b063839725abb42290a939694e_JaffaCakes118.exe
-
Size
80KB
-
MD5
020f16b063839725abb42290a939694e
-
SHA1
0c985d986403caeba4923ea0f18b449ca468558e
-
SHA256
6079ed711139394a38ffe43963f077ea892992786ca62536d7ab6be25fb20b92
-
SHA512
8eb6501cc6889a409bed197739cebb8d21df9ef997913978a10487d793f4306bda295ef52f123181ea41ede4866875c4d3758b7aa3df2b23cd9994c70417b9e6
-
SSDEEP
1536:2wRwOV9CjyB5YOJ23+jzI4t3w28HkJXqQiYonfnPK9Tx9nouy8:3Rw8vB5Yrujz93wrwXxi/PITbout
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 17 IoCs
Processes:
resource yara_rule behavioral1/memory/1720-0-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral1/memory/1720-10-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral1/memory/2832-14-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral1/memory/2832-15-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral1/memory/2832-16-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral1/memory/2832-17-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral1/memory/2832-18-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral1/memory/2832-19-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral1/memory/2832-20-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral1/memory/2832-21-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral1/memory/2832-22-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral1/memory/2832-23-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral1/memory/2832-24-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral1/memory/2832-25-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral1/memory/2832-26-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral1/memory/2832-27-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral1/memory/2832-28-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
Processes:
msmgrs.exepid process 2832 msmgrs.exe -
Drops startup file 2 IoCs
Processes:
msmgrs.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ntdll.lnk msmgrs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ntdll.lnk msmgrs.exe -
Executes dropped EXE 1 IoCs
Processes:
msmgrs.exepid process 2832 msmgrs.exe -
Loads dropped DLL 2 IoCs
Processes:
020f16b063839725abb42290a939694e_JaffaCakes118.exepid process 1720 020f16b063839725abb42290a939694e_JaffaCakes118.exe 1720 020f16b063839725abb42290a939694e_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral1/memory/1720-0-0x0000000000400000-0x0000000000439000-memory.dmp upx \Windows\SysWOW64\wins\setup\msmgrs.exe upx behavioral1/memory/1720-10-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral1/memory/2832-12-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral1/memory/2832-14-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral1/memory/2832-15-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral1/memory/2832-16-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral1/memory/2832-17-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral1/memory/2832-18-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral1/memory/2832-19-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral1/memory/2832-20-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral1/memory/2832-21-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral1/memory/2832-22-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral1/memory/2832-23-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral1/memory/2832-24-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral1/memory/2832-25-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral1/memory/2832-26-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral1/memory/2832-27-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral1/memory/2832-28-0x0000000000400000-0x0000000000439000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
020f16b063839725abb42290a939694e_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\wins\setup\msmgrs.exe 020f16b063839725abb42290a939694e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wins\setup\msmgrs.exe 020f16b063839725abb42290a939694e_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
020f16b063839725abb42290a939694e_JaffaCakes118.exemsmgrs.exepid process 1720 020f16b063839725abb42290a939694e_JaffaCakes118.exe 1720 020f16b063839725abb42290a939694e_JaffaCakes118.exe 2832 msmgrs.exe 2832 msmgrs.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
020f16b063839725abb42290a939694e_JaffaCakes118.exemsmgrs.execmd.execmd.execmd.exedescription pid process target process PID 1720 wrote to memory of 2832 1720 020f16b063839725abb42290a939694e_JaffaCakes118.exe msmgrs.exe PID 1720 wrote to memory of 2832 1720 020f16b063839725abb42290a939694e_JaffaCakes118.exe msmgrs.exe PID 1720 wrote to memory of 2832 1720 020f16b063839725abb42290a939694e_JaffaCakes118.exe msmgrs.exe PID 1720 wrote to memory of 2832 1720 020f16b063839725abb42290a939694e_JaffaCakes118.exe msmgrs.exe PID 2832 wrote to memory of 2780 2832 msmgrs.exe cmd.exe PID 2832 wrote to memory of 2780 2832 msmgrs.exe cmd.exe PID 2832 wrote to memory of 2780 2832 msmgrs.exe cmd.exe PID 2832 wrote to memory of 2780 2832 msmgrs.exe cmd.exe PID 2832 wrote to memory of 2784 2832 msmgrs.exe cmd.exe PID 2832 wrote to memory of 2784 2832 msmgrs.exe cmd.exe PID 2832 wrote to memory of 2784 2832 msmgrs.exe cmd.exe PID 2832 wrote to memory of 2784 2832 msmgrs.exe cmd.exe PID 2832 wrote to memory of 2800 2832 msmgrs.exe cmd.exe PID 2832 wrote to memory of 2800 2832 msmgrs.exe cmd.exe PID 2832 wrote to memory of 2800 2832 msmgrs.exe cmd.exe PID 2832 wrote to memory of 2800 2832 msmgrs.exe cmd.exe PID 2784 wrote to memory of 2112 2784 cmd.exe regsvr32.exe PID 2784 wrote to memory of 2112 2784 cmd.exe regsvr32.exe PID 2784 wrote to memory of 2112 2784 cmd.exe regsvr32.exe PID 2784 wrote to memory of 2112 2784 cmd.exe regsvr32.exe PID 2784 wrote to memory of 2112 2784 cmd.exe regsvr32.exe PID 2784 wrote to memory of 2112 2784 cmd.exe regsvr32.exe PID 2784 wrote to memory of 2112 2784 cmd.exe regsvr32.exe PID 2800 wrote to memory of 2788 2800 cmd.exe regsvr32.exe PID 2800 wrote to memory of 2788 2800 cmd.exe regsvr32.exe PID 2800 wrote to memory of 2788 2800 cmd.exe regsvr32.exe PID 2800 wrote to memory of 2788 2800 cmd.exe regsvr32.exe PID 2800 wrote to memory of 2788 2800 cmd.exe regsvr32.exe PID 2800 wrote to memory of 2788 2800 cmd.exe regsvr32.exe PID 2800 wrote to memory of 2788 2800 cmd.exe regsvr32.exe PID 2780 wrote to memory of 2628 2780 cmd.exe regsvr32.exe PID 2780 wrote to memory of 2628 2780 cmd.exe regsvr32.exe PID 2780 wrote to memory of 2628 2780 cmd.exe regsvr32.exe PID 2780 wrote to memory of 2628 2780 cmd.exe regsvr32.exe PID 2780 wrote to memory of 2628 2780 cmd.exe regsvr32.exe PID 2780 wrote to memory of 2628 2780 cmd.exe regsvr32.exe PID 2780 wrote to memory of 2628 2780 cmd.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\020f16b063839725abb42290a939694e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\020f16b063839725abb42290a939694e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wins\setup\msmgrs.exe"C:\Windows\system32\wins\setup\msmgrs.exe"2⤵
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe + command.com /c regsvr32 /u /s %WINDIR%/"Downloaded Program Files"/JaguarEditControl.dll3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /u /s C:\Windows/"Downloaded Program Files"/JaguarEditControl.dll4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe + command.com /c regsvr32 /u /s %WINDIR%/"Downloaded Program Files"/tebedit.ocx3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /u /s C:\Windows/"Downloaded Program Files"/tebedit.ocx4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe + command.com /c regsvr32 /u /s %WINDIR%/"Downloaded Program Files"/JaguarEdit4ISB.dll3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /u /s C:\Windows/"Downloaded Program Files"/JaguarEdit4ISB.dll4⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Windows\SysWOW64\wins\setup\msmgrs.exeFilesize
80KB
MD5020f16b063839725abb42290a939694e
SHA10c985d986403caeba4923ea0f18b449ca468558e
SHA2566079ed711139394a38ffe43963f077ea892992786ca62536d7ab6be25fb20b92
SHA5128eb6501cc6889a409bed197739cebb8d21df9ef997913978a10487d793f4306bda295ef52f123181ea41ede4866875c4d3758b7aa3df2b23cd9994c70417b9e6
-
memory/1720-0-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/1720-10-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2832-18-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2832-20-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2832-15-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2832-16-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2832-17-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2832-12-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2832-19-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2832-14-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2832-21-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2832-22-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2832-23-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2832-24-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2832-25-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2832-26-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2832-27-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2832-28-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB