Analysis
-
max time kernel
140s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 03:26
Behavioral task
behavioral1
Sample
0267f3ad68258fd1c208bd01068728bd_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0267f3ad68258fd1c208bd01068728bd_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
0267f3ad68258fd1c208bd01068728bd_JaffaCakes118.exe
-
Size
735KB
-
MD5
0267f3ad68258fd1c208bd01068728bd
-
SHA1
56099f8050cfff61407efef10698c693b194a345
-
SHA256
3c724d617a161797cd134a4c8babfe4dc02e23bf59d6acbb20f3c8885c1bf0d6
-
SHA512
23218905208bb20a228da9881d71424151ed8a6165f192990862fbbdae3afe9a32512ae7cf1ce49814cfd6d6e2e16d7e5870dc3c17012448bb33b5f227e85d73
-
SSDEEP
12288:rmX53KYzEkDAqAlqTfkHyirIIDCcwJ7+x7u+8wlFCR1EmMlXTEK:rm5BzEyAlqTf2yn6AJuCECR1EmKXT3
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 5 IoCs
Processes:
resource yara_rule C:\Program Files\Common Files\microsoft shared\MSInfo\shvost.exe modiloader_stage2 behavioral2/memory/5104-9-0x0000000000400000-0x00000000004BF000-memory.dmp modiloader_stage2 behavioral2/memory/4736-11-0x0000000000CE0000-0x0000000000D9F000-memory.dmp modiloader_stage2 behavioral2/memory/632-13-0x0000000000400000-0x00000000004BF000-memory.dmp modiloader_stage2 behavioral2/memory/3940-12-0x0000000000400000-0x00000000004BF000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
shvost.exepid process 3940 shvost.exe -
Drops file in System32 directory 2 IoCs
Processes:
shvost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\_shvost.exe shvost.exe File created C:\Windows\SysWOW64\_shvost.exe shvost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
shvost.exedescription pid process target process PID 3940 set thread context of 5104 3940 shvost.exe calc.exe PID 3940 set thread context of 4736 3940 shvost.exe IEXPLORE.EXE -
Drops file in Program Files directory 2 IoCs
Processes:
0267f3ad68258fd1c208bd01068728bd_JaffaCakes118.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\shvost.exe 0267f3ad68258fd1c208bd01068728bd_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\shvost.exe 0267f3ad68258fd1c208bd01068728bd_JaffaCakes118.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2892 5104 WerFault.exe calc.exe -
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E21D3360-2EB4-11EF-86EC-C21B8D59DC13} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425618964" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31113921" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31113921" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3062752775" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3062752775" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31113921" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3065565868" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 4736 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid process 4736 IEXPLORE.EXE 4736 IEXPLORE.EXE 3184 IEXPLORE.EXE 3184 IEXPLORE.EXE 3184 IEXPLORE.EXE 3184 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
0267f3ad68258fd1c208bd01068728bd_JaffaCakes118.exeshvost.exeIEXPLORE.EXEdescription pid process target process PID 632 wrote to memory of 3940 632 0267f3ad68258fd1c208bd01068728bd_JaffaCakes118.exe shvost.exe PID 632 wrote to memory of 3940 632 0267f3ad68258fd1c208bd01068728bd_JaffaCakes118.exe shvost.exe PID 632 wrote to memory of 3940 632 0267f3ad68258fd1c208bd01068728bd_JaffaCakes118.exe shvost.exe PID 3940 wrote to memory of 5104 3940 shvost.exe calc.exe PID 3940 wrote to memory of 5104 3940 shvost.exe calc.exe PID 3940 wrote to memory of 5104 3940 shvost.exe calc.exe PID 3940 wrote to memory of 5104 3940 shvost.exe calc.exe PID 3940 wrote to memory of 5104 3940 shvost.exe calc.exe PID 3940 wrote to memory of 4736 3940 shvost.exe IEXPLORE.EXE PID 3940 wrote to memory of 4736 3940 shvost.exe IEXPLORE.EXE PID 3940 wrote to memory of 4736 3940 shvost.exe IEXPLORE.EXE PID 4736 wrote to memory of 3184 4736 IEXPLORE.EXE IEXPLORE.EXE PID 4736 wrote to memory of 3184 4736 IEXPLORE.EXE IEXPLORE.EXE PID 4736 wrote to memory of 3184 4736 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\0267f3ad68258fd1c208bd01068728bd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0267f3ad68258fd1c208bd01068728bd_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Program Files\Common Files\Microsoft Shared\MSINFO\shvost.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\shvost.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:5104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 124⤵
- Program crash
PID:2892 -
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4736 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5104 -ip 51041⤵PID:2264
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
735KB
MD50267f3ad68258fd1c208bd01068728bd
SHA156099f8050cfff61407efef10698c693b194a345
SHA2563c724d617a161797cd134a4c8babfe4dc02e23bf59d6acbb20f3c8885c1bf0d6
SHA51223218905208bb20a228da9881d71424151ed8a6165f192990862fbbdae3afe9a32512ae7cf1ce49814cfd6d6e2e16d7e5870dc3c17012448bb33b5f227e85d73
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee