Analysis
-
max time kernel
141s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 19:20
Behavioral task
behavioral1
Sample
090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe
-
Size
295KB
-
MD5
090ba923c9117d4641559a66bb40e275
-
SHA1
48bd696970da3a4095ce62016755a82d9887e5b4
-
SHA256
e63a86159c13f3cd984d002cafd4d683c3f08e98835ea376c816b1d43bd91a74
-
SHA512
f66c884e5271bd4d81bbd4f6df98c9b0a9fc81635f901045e342e8a3e4e9b67b10bb6ab8d1c2d77a4ee94db43d737d2cc947130e4abd9d85cb3eaa0c0e34edd5
-
SSDEEP
6144:OYWr9t3ut7qNbcoPWjd8gqI4opZfkz06fdRPr8Cf+Ikawj+/9kJ6m30:OYG9t+t+1cd8gdi0ITd+I6jnLk
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1652-33-0x0000000000400000-0x00000000004C6000-memory.dmp modiloader_stage2 behavioral1/memory/2184-34-0x0000000000400000-0x00000000004C6000-memory.dmp modiloader_stage2 behavioral1/memory/1652-47-0x0000000000400000-0x00000000004C6000-memory.dmp modiloader_stage2 -
Processes:
resource yara_rule F:\Server91.exe aspack_v212_v242 -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2948 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
Server91.exepid process 2184 Server91.exe -
Loads dropped DLL 5 IoCs
Processes:
090ba923c9117d4641559a66bb40e275_JaffaCakes118.exeWerFault.exepid process 1652 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe 1652 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe 2672 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
090ba923c9117d4641559a66bb40e275_JaffaCakes118.exedescription ioc process File opened (read-only) \??\R: 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened (read-only) \??\T: 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened (read-only) \??\U: 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened (read-only) \??\S: 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened (read-only) \??\Z: 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened (read-only) \??\A: 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened (read-only) \??\B: 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened (read-only) \??\H: 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened (read-only) \??\M: 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened (read-only) \??\O: 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened (read-only) \??\Q: 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened (read-only) \??\W: 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened (read-only) \??\X: 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened (read-only) \??\G: 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened (read-only) \??\I: 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened (read-only) \??\J: 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened (read-only) \??\L: 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened (read-only) \??\P: 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened (read-only) \??\E: 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened (read-only) \??\K: 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened (read-only) \??\N: 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened (read-only) \??\V: 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened (read-only) \??\Y: 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
090ba923c9117d4641559a66bb40e275_JaffaCakes118.exedescription ioc process File created C:\AutoRun.inf 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened for modification C:\AutoRun.inf 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File created F:\AutoRun.inf 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened for modification F:\AutoRun.inf 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
Processes:
Server91.exedescription ioc process File created C:\Windows\SysWOW64\_Server91.exe Server91.exe File opened for modification C:\Windows\SysWOW64\_Server91.exe Server91.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Server91.exedescription pid process target process PID 2184 set thread context of 3052 2184 Server91.exe calc.exe -
Drops file in Program Files directory 3 IoCs
Processes:
090ba923c9117d4641559a66bb40e275_JaffaCakes118.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\Server91.exe 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\Server91.exe 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2672 2184 WerFault.exe Server91.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
090ba923c9117d4641559a66bb40e275_JaffaCakes118.exeServer91.exedescription pid process target process PID 1652 wrote to memory of 2184 1652 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe Server91.exe PID 1652 wrote to memory of 2184 1652 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe Server91.exe PID 1652 wrote to memory of 2184 1652 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe Server91.exe PID 1652 wrote to memory of 2184 1652 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe Server91.exe PID 2184 wrote to memory of 3052 2184 Server91.exe calc.exe PID 2184 wrote to memory of 3052 2184 Server91.exe calc.exe PID 2184 wrote to memory of 3052 2184 Server91.exe calc.exe PID 2184 wrote to memory of 3052 2184 Server91.exe calc.exe PID 2184 wrote to memory of 3052 2184 Server91.exe calc.exe PID 2184 wrote to memory of 3052 2184 Server91.exe calc.exe PID 2184 wrote to memory of 2672 2184 Server91.exe WerFault.exe PID 2184 wrote to memory of 2672 2184 Server91.exe WerFault.exe PID 2184 wrote to memory of 2672 2184 Server91.exe WerFault.exe PID 2184 wrote to memory of 2672 2184 Server91.exe WerFault.exe PID 1652 wrote to memory of 2948 1652 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe cmd.exe PID 1652 wrote to memory of 2948 1652 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe cmd.exe PID 1652 wrote to memory of 2948 1652 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe cmd.exe PID 1652 wrote to memory of 2948 1652 090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\090ba923c9117d4641559a66bb40e275_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Program Files\Common Files\Microsoft Shared\MSINFO\Server91.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\Server91.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:3052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 2803⤵
- Loads dropped DLL
- Program crash
PID:2672 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat""2⤵
- Deletes itself
PID:2948
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD55a84d2267f8715ab6f5e853aed4d92d5
SHA1c080353538c99294710ac64f6ea3eb272496b03f
SHA256301d89971791942fe3d92aa3c85c68ba9653b8581f0419bc407f245600eb35e7
SHA512025e8ea8a9aeacd1a069c7eb9c723727df1f1eb2ced91a24946b3ece124ac5dda5be3e92c78840f8332b40eb6f8a9f129b6a592ebc8b56846f53d1f13bd6ba1f
-
Filesize
295KB
MD5090ba923c9117d4641559a66bb40e275
SHA148bd696970da3a4095ce62016755a82d9887e5b4
SHA256e63a86159c13f3cd984d002cafd4d683c3f08e98835ea376c816b1d43bd91a74
SHA512f66c884e5271bd4d81bbd4f6df98c9b0a9fc81635f901045e342e8a3e4e9b67b10bb6ab8d1c2d77a4ee94db43d737d2cc947130e4abd9d85cb3eaa0c0e34edd5