Analysis

  • max time kernel
    139s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2024 19:30

General

  • Target

    091c5a964683ba62f38ef111aacd1d49_JaffaCakes118.exe

  • Size

    233KB

  • MD5

    091c5a964683ba62f38ef111aacd1d49

  • SHA1

    2b124933c40409482f3583af02160dbe832ce5ec

  • SHA256

    cdf6f848d8c68b8b521f675a8129292b120d08c8673ebd3619ad230a388a84cb

  • SHA512

    013c7609b062885cc5283d441203a13bca6b38a1c8bc043d1eba0245fd088e833f141861a1e9e2cda4fc3406fb539668119494c065313103edb154d0dae1bc70

  • SSDEEP

    6144:sLiX5MU9Y2jd58njRL4k85uMQVMX7tV13xqCwk:Lpd5YRLi5uMQVMXJnBq

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 7 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\091c5a964683ba62f38ef111aacd1d49_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\091c5a964683ba62f38ef111aacd1d49_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:5532
    • C:\Windows\fin32.exe
      "C:\Windows\fin32.exe" /stext hms.atr
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2552
      • C:\Windows\fin32.exe
        C:\Windows\fin32.exe /stext hms.atr
        3⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook accounts
        • Drops file in Windows directory
        PID:6012
    • C:\Windows\ykl32.exe
      "C:\Windows\ykl32.exe" /stext gls.fdn
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4216
      • C:\Windows\ykl32.exe
        C:\Windows\ykl32.exe /stext gls.fdn
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:3888
    • C:\Windows\amr32.exe
      "C:\Windows\amr32.exe" /stext hrk.klo
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1772
      • C:\Windows\amr32.exe
        C:\Windows\amr32.exe /stext hrk.klo
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        PID:5724

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\amr32.exe

    Filesize

    62KB

    MD5

    e9914753824f503e700ec74e219077f7

    SHA1

    de4b97da5f4e6a804398553f33a23d03feee1a42

    SHA256

    91814933cf6d7937616e776ecba937ca6a50d3c2e3fe332df12eb600592111e1

    SHA512

    30cf6d57f2abe05eb38b34156daaae5e8a9a85a91cfaf5b42b9b527c0d942e876e551b86413b1d0394ad73fcc6e6d91236746c81d0adc32f0f3467c42b2c48bc

  • C:\Windows\fin32.exe

    Filesize

    81KB

    MD5

    133c173c5c95ec572e015990029387c3

    SHA1

    3686180e408b7a83f693b4146eed84ae684b03a5

    SHA256

    8a85ab91faf309c8001ee265bc724df1319e58d3af3ed789616b512d6a92eab2

    SHA512

    19d04dde12dada208edc03383ddeaa2e545cd2b430fa1a534d2dd7ac545fedbcdd3e9f240e3228ea3d006e7740e7e301703dc76e8e05f3c59ad23d8271fce412

  • C:\Windows\hrk.klo

    Filesize

    311B

    MD5

    a81b01be24a2782876a193c0e63c7f12

    SHA1

    a626a5b87b24a956dbd99977795995b6bbb88d74

    SHA256

    7724a27024ecaf8e7fea4e1e3fb54902d87e4c4af5395fb9836433d596f4f41a

    SHA512

    ea2bffb38c29806182ab24a7d8b55270fcc68a729e44b0767f6bd3dd8823bb8b7767561873c49b5eaab5446f63e7081e9525f6388f8b525c3aed04b6154f53bd

  • C:\Windows\ykl32.exe

    Filesize

    42KB

    MD5

    a32a77d444987c6b39b13d90223b6932

    SHA1

    678257eabad39b317b70d1f91ee67689e20d2729

    SHA256

    d1001a99f08c511dd35aab4ad1cfcc3d546ac8d880d66cd2e19d8963e26a10f9

    SHA512

    f5248e0877c4ffc87449e14d6e757a86af33ce940b1a3cdbd4e9696072e5cc3ed5c45e9093ce618e7011f6089c86b8ebfa19e15a18fe0b15386a604d27c55378

  • memory/1772-40-0x0000000032000000-0x0000000032015000-memory.dmp

    Filesize

    84KB

  • memory/2552-14-0x0000000032000000-0x0000000032019000-memory.dmp

    Filesize

    100KB

  • memory/3888-29-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/3888-28-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/3888-24-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/4216-25-0x0000000032000000-0x000000003200F000-memory.dmp

    Filesize

    60KB

  • memory/5532-0-0x0000000000400000-0x000000000047D000-memory.dmp

    Filesize

    500KB

  • memory/5532-49-0x0000000000400000-0x000000000047D000-memory.dmp

    Filesize

    500KB

  • memory/5532-1-0x00000000005F0000-0x00000000005F1000-memory.dmp

    Filesize

    4KB

  • memory/5724-42-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/5724-38-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/5724-43-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/5724-45-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/6012-15-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/6012-10-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/6012-13-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB