Analysis
-
max time kernel
142s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 02:31
Behavioral task
behavioral1
Sample
020f16b063839725abb42290a939694e_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
020f16b063839725abb42290a939694e_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
020f16b063839725abb42290a939694e_JaffaCakes118.exe
-
Size
80KB
-
MD5
020f16b063839725abb42290a939694e
-
SHA1
0c985d986403caeba4923ea0f18b449ca468558e
-
SHA256
6079ed711139394a38ffe43963f077ea892992786ca62536d7ab6be25fb20b92
-
SHA512
8eb6501cc6889a409bed197739cebb8d21df9ef997913978a10487d793f4306bda295ef52f123181ea41ede4866875c4d3758b7aa3df2b23cd9994c70417b9e6
-
SSDEEP
1536:2wRwOV9CjyB5YOJ23+jzI4t3w28HkJXqQiYonfnPK9Tx9nouy8:3Rw8vB5Yrujz93wrwXxi/PITbout
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 15 IoCs
Processes:
resource yara_rule behavioral2/memory/3112-11-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral2/memory/2912-13-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral2/memory/2912-14-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral2/memory/2912-15-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral2/memory/2912-16-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral2/memory/2912-17-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral2/memory/2912-18-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral2/memory/2912-19-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral2/memory/2912-20-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral2/memory/2912-21-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral2/memory/2912-22-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral2/memory/2912-23-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral2/memory/2912-24-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral2/memory/2912-25-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 behavioral2/memory/2912-26-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
020f16b063839725abb42290a939694e_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation 020f16b063839725abb42290a939694e_JaffaCakes118.exe -
Deletes itself 1 IoCs
Processes:
msmgrs.exepid process 2912 msmgrs.exe -
Drops startup file 2 IoCs
Processes:
msmgrs.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ntdll.lnk msmgrs.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ntdll.lnk msmgrs.exe -
Executes dropped EXE 1 IoCs
Processes:
msmgrs.exepid process 2912 msmgrs.exe -
Processes:
resource yara_rule behavioral2/memory/3112-0-0x0000000000400000-0x0000000000439000-memory.dmp upx C:\Windows\SysWOW64\wins\setup\msmgrs.exe upx behavioral2/memory/3112-11-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral2/memory/2912-8-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral2/memory/2912-13-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral2/memory/2912-14-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral2/memory/2912-15-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral2/memory/2912-16-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral2/memory/2912-17-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral2/memory/2912-18-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral2/memory/2912-19-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral2/memory/2912-20-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral2/memory/2912-21-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral2/memory/2912-22-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral2/memory/2912-23-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral2/memory/2912-24-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral2/memory/2912-25-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral2/memory/2912-26-0x0000000000400000-0x0000000000439000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
020f16b063839725abb42290a939694e_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\wins\setup\msmgrs.exe 020f16b063839725abb42290a939694e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wins\setup\msmgrs.exe 020f16b063839725abb42290a939694e_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
020f16b063839725abb42290a939694e_JaffaCakes118.exemsmgrs.exepid process 3112 020f16b063839725abb42290a939694e_JaffaCakes118.exe 3112 020f16b063839725abb42290a939694e_JaffaCakes118.exe 2912 msmgrs.exe 2912 msmgrs.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
020f16b063839725abb42290a939694e_JaffaCakes118.exemsmgrs.execmd.execmd.execmd.exedescription pid process target process PID 3112 wrote to memory of 2912 3112 020f16b063839725abb42290a939694e_JaffaCakes118.exe msmgrs.exe PID 3112 wrote to memory of 2912 3112 020f16b063839725abb42290a939694e_JaffaCakes118.exe msmgrs.exe PID 3112 wrote to memory of 2912 3112 020f16b063839725abb42290a939694e_JaffaCakes118.exe msmgrs.exe PID 2912 wrote to memory of 4600 2912 msmgrs.exe cmd.exe PID 2912 wrote to memory of 4600 2912 msmgrs.exe cmd.exe PID 2912 wrote to memory of 4600 2912 msmgrs.exe cmd.exe PID 2912 wrote to memory of 3100 2912 msmgrs.exe cmd.exe PID 2912 wrote to memory of 3100 2912 msmgrs.exe cmd.exe PID 2912 wrote to memory of 3100 2912 msmgrs.exe cmd.exe PID 2912 wrote to memory of 3604 2912 msmgrs.exe cmd.exe PID 2912 wrote to memory of 3604 2912 msmgrs.exe cmd.exe PID 2912 wrote to memory of 3604 2912 msmgrs.exe cmd.exe PID 4600 wrote to memory of 5088 4600 cmd.exe regsvr32.exe PID 4600 wrote to memory of 5088 4600 cmd.exe regsvr32.exe PID 4600 wrote to memory of 5088 4600 cmd.exe regsvr32.exe PID 3100 wrote to memory of 2772 3100 cmd.exe regsvr32.exe PID 3100 wrote to memory of 2772 3100 cmd.exe regsvr32.exe PID 3100 wrote to memory of 2772 3100 cmd.exe regsvr32.exe PID 3604 wrote to memory of 3396 3604 cmd.exe regsvr32.exe PID 3604 wrote to memory of 3396 3604 cmd.exe regsvr32.exe PID 3604 wrote to memory of 3396 3604 cmd.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\020f16b063839725abb42290a939694e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\020f16b063839725abb42290a939694e_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wins\setup\msmgrs.exe"C:\Windows\system32\wins\setup\msmgrs.exe"2⤵
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe + command.com /c regsvr32 /u /s %WINDIR%/"Downloaded Program Files"/JaguarEditControl.dll3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /u /s C:\Windows/"Downloaded Program Files"/JaguarEditControl.dll4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe + command.com /c regsvr32 /u /s %WINDIR%/"Downloaded Program Files"/tebedit.ocx3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /u /s C:\Windows/"Downloaded Program Files"/tebedit.ocx4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe + command.com /c regsvr32 /u /s %WINDIR%/"Downloaded Program Files"/JaguarEdit4ISB.dll3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /u /s C:\Windows/"Downloaded Program Files"/JaguarEdit4ISB.dll4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4372,i,17949988676391029604,13756926835471203788,262144 --variations-seed-version --mojo-platform-channel-handle=1420 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\wins\setup\msmgrs.exeFilesize
80KB
MD5020f16b063839725abb42290a939694e
SHA10c985d986403caeba4923ea0f18b449ca468558e
SHA2566079ed711139394a38ffe43963f077ea892992786ca62536d7ab6be25fb20b92
SHA5128eb6501cc6889a409bed197739cebb8d21df9ef997913978a10487d793f4306bda295ef52f123181ea41ede4866875c4d3758b7aa3df2b23cd9994c70417b9e6
-
memory/2912-17-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2912-14-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2912-18-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2912-13-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2912-19-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2912-15-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2912-16-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2912-20-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2912-8-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2912-26-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2912-25-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2912-21-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2912-22-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2912-23-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2912-24-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/3112-0-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/3112-11-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB