Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 15:02
Behavioral task
behavioral1
Sample
0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe
-
Size
726KB
-
MD5
0714394b7db4db09309ee67096723c0e
-
SHA1
7903c3111ec507cf266ef88c8ce42145ffca3d10
-
SHA256
ae78f1813c96535532be71ac89259f51b7b84edbaf9fcd2f97db58af04e06e1a
-
SHA512
96bf8c44011a0fba5366c017bfa27f19c4d7374b6e1625b8ad11d26d14ddb3998d5ba493186fe0a4a1c85a0de6ac5ae913fb5a38ef5005e027978050f5f62993
-
SSDEEP
12288:F8k37stBEScWoGdqDkg16l9xneL73U9sPG7SGzJkZqTYEH4K:F8kL0BfTdqDktl3cA+6zJcqTY4b
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral1/memory/1984-13-0x0000000000060000-0x000000000011C000-memory.dmp modiloader_stage2 behavioral1/memory/2344-14-0x0000000000400000-0x00000000004BC000-memory.dmp modiloader_stage2 -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe File opened (read-only) \??\Q: 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe File opened (read-only) \??\E: 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe File opened (read-only) \??\G: 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe File opened (read-only) \??\H: 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe File opened (read-only) \??\S: 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe File opened (read-only) \??\Y: 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe File opened (read-only) \??\A: 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe File opened (read-only) \??\B: 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe File opened (read-only) \??\J: 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe File opened (read-only) \??\V: 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe File opened (read-only) \??\W: 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe File opened (read-only) \??\X: 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe File opened (read-only) \??\K: 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe File opened (read-only) \??\R: 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe File opened (read-only) \??\U: 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe File opened (read-only) \??\O: 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe File opened (read-only) \??\P: 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe File opened (read-only) \??\T: 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe File opened (read-only) \??\Z: 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe File opened (read-only) \??\I: 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe File opened (read-only) \??\L: 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe File opened (read-only) \??\M: 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\AutoRun.inf 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe File opened for modification F:\AutoRun.inf 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2344 set thread context of 1984 2344 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe 28 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\paramstr.txt 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{170CAF61-2F16-11EF-8C92-6A2211F10352} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425057629" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1984 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1984 IEXPLORE.EXE 1984 IEXPLORE.EXE 2760 IEXPLORE.EXE 2760 IEXPLORE.EXE 2760 IEXPLORE.EXE 2760 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2344 wrote to memory of 1984 2344 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe 28 PID 2344 wrote to memory of 1984 2344 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe 28 PID 2344 wrote to memory of 1984 2344 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe 28 PID 2344 wrote to memory of 1984 2344 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe 28 PID 2344 wrote to memory of 1984 2344 0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe 28 PID 1984 wrote to memory of 2760 1984 IEXPLORE.EXE 29 PID 1984 wrote to memory of 2760 1984 IEXPLORE.EXE 29 PID 1984 wrote to memory of 2760 1984 IEXPLORE.EXE 29 PID 1984 wrote to memory of 2760 1984 IEXPLORE.EXE 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0714394b7db4db09309ee67096723c0e_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2760
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81B
MD5400209ebd824aeeb7633f6640322e89d
SHA1e7d7e83f618e9ffcce5c332992fe34dbd8be9ce8
SHA256e7c5b1bccffef005c0da369a4bc1ce6beafff8298b3d253bb6b1dabd672b304d
SHA512e046c0662d5f2ba9399278102ff8fcf685ea13a63980ebb85898ad23ab67e620e2264a07d88b5a6e33d34d9263eaabc7cde921621f1efefbaec5b54a7af948c0