Analysis

  • max time kernel
    79s
  • max time network
    88s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2024 17:58

General

  • Target

    086f4dd9584cc8d05f6b56a6b68dc747_JaffaCakes118.exe

  • Size

    268KB

  • MD5

    086f4dd9584cc8d05f6b56a6b68dc747

  • SHA1

    35091173ecfce7cf0b1beae0741376bf454d311f

  • SHA256

    173b5946fd6bc355b0969bbf059b3c68e8224029486cac28af1c88a2677336bf

  • SHA512

    1dbb99bdd7de99ec27dd2c0b07618f8e7ad61cf22849d9abbdf4314c04fe58507dc1467bffa9178a01e4033a276ce561492809d67d7ab07aa09e977c6056a07c

  • SSDEEP

    6144:a/0gARCFiEMhuCTesqh7+0S6+m0FbR54HaVPNx0DU//MR8PNnvJ/d:ZgAR6iEMUCs7cbbRmsDHnPRvld

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 15 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\086f4dd9584cc8d05f6b56a6b68dc747_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\086f4dd9584cc8d05f6b56a6b68dc747_JaffaCakes118.exe"
    1⤵
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1844
    • C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice81.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice81.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4560
      • C:\Windows\SysWOW64\calc.exe
        "C:\Windows\system32\calc.exe"
        3⤵
          PID:2088
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 12
            4⤵
            • Program crash
            PID:1036
        • C:\program files\internet explorer\IEXPLORE.EXE
          "C:\program files\internet explorer\IEXPLORE.EXE"
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5104
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5104 CREDAT:17410 /prefetch:2
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:4816
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat""
        2⤵
          PID:3740
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2088 -ip 2088
        1⤵
          PID:3928

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\AutoRun.inf

          Filesize

          175B

          MD5

          ec717a148c0c1573ad6a89a66095c8a0

          SHA1

          2677e5c816b191a5941be928f014ec201e7de18f

          SHA256

          d9c1af73c937692718c241a501d6213fac7803ab2f8504a845a540baf047c218

          SHA512

          1a925338fbdbb79bb8e38064b092d5a2dbd47095751ac9e88490f255db050598f209aa97da0d8a9984e173059cb13019d2f187d0efc9777afc6fcf82fb763797

        • C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat

          Filesize

          212B

          MD5

          91baa46248787aaf15cf57f165af25d0

          SHA1

          243ac9b44e75904237773767c65b9a1bf15c984e

          SHA256

          3e037b955fafb0da7f2f60d5e2bc8a73f32e3f2a646fbf90459812d52e7a4c9c

          SHA512

          2ceafcc236a7017128f36991f7faeb8b2b9d3db04a4f988c85f484854543449b4bf6a521e1bf41a64e4f7d91ea8fff672e94b464fbc1345a643ea2de9536082a

        • F:\rejoice81.exe

          Filesize

          268KB

          MD5

          086f4dd9584cc8d05f6b56a6b68dc747

          SHA1

          35091173ecfce7cf0b1beae0741376bf454d311f

          SHA256

          173b5946fd6bc355b0969bbf059b3c68e8224029486cac28af1c88a2677336bf

          SHA512

          1dbb99bdd7de99ec27dd2c0b07618f8e7ad61cf22849d9abbdf4314c04fe58507dc1467bffa9178a01e4033a276ce561492809d67d7ab07aa09e977c6056a07c

        • memory/1844-36-0x0000000000400000-0x0000000000509000-memory.dmp

          Filesize

          1.0MB

        • memory/1844-1-0x00000000006B0000-0x00000000006B1000-memory.dmp

          Filesize

          4KB

        • memory/1844-2-0x0000000000400000-0x0000000000509000-memory.dmp

          Filesize

          1.0MB

        • memory/1844-3-0x0000000002180000-0x0000000002181000-memory.dmp

          Filesize

          4KB

        • memory/1844-0-0x0000000000400000-0x0000000000509000-memory.dmp

          Filesize

          1.0MB

        • memory/2088-31-0x0000000000400000-0x0000000000509000-memory.dmp

          Filesize

          1.0MB

        • memory/4560-27-0x0000000000400000-0x0000000000509000-memory.dmp

          Filesize

          1.0MB

        • memory/4560-37-0x0000000000400000-0x0000000000509000-memory.dmp

          Filesize

          1.0MB

        • memory/4560-30-0x0000000002180000-0x0000000002181000-memory.dmp

          Filesize

          4KB

        • memory/5104-33-0x0000000000250000-0x0000000000359000-memory.dmp

          Filesize

          1.0MB