Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 18:50
Static task
static1
Behavioral task
behavioral1
Sample
08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe
-
Size
285KB
-
MD5
08cf47adfb8a527f7847bcef5a6e0ab7
-
SHA1
89173e4ff6a37c0ead703de99b1b60b78da551fb
-
SHA256
5b909cda4fa30292f4068912cb87c6f7bb7222ba73c0ced54f42e4bc9fc94c8d
-
SHA512
5b5bbc5d03bcba042162ee720687dbbd9c4227eb313836a8b3221ad157dd9dcda8f7f37a01ac79d658074dd13c05482e1404bb210c443781720402f76f733380
-
SSDEEP
6144:U0DI7Qa2UvGW70rShfvv+rejFCtvsbze851T2bycNtbt81P:U0Ha2xWorSKejvbze8jTgNNtby1P
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1452-2-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral1/memory/2320-22-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral1/memory/1452-33-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral1/memory/2320-35-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral1/memory/1452-44-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2628 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
INETINF0.EXEpid process 2320 INETINF0.EXE -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exedescription ioc process File opened (read-only) \??\B: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\G: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\I: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\J: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\T: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\E: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\L: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\R: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\S: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\U: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\V: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\X: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\M: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\N: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\O: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\P: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\W: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\Y: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\Z: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\A: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\H: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\K: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\Q: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exedescription ioc process File opened for modification C:\AutoRun.inf 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File created F:\AutoRun.inf 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened for modification F:\AutoRun.inf 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File created C:\AutoRun.inf 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
Processes:
INETINF0.EXEdescription ioc process File created C:\Windows\SysWOW64\_INETINF0.EXE INETINF0.EXE File opened for modification C:\Windows\SysWOW64\_INETINF0.EXE INETINF0.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
INETINF0.EXEdescription pid process target process PID 2320 set thread context of 2656 2320 INETINF0.EXE mmc.exe -
Drops file in Windows directory 3 IoCs
Processes:
08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\INETINF0.EXE 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File created C:\Windows\SxingDel.bat 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File created C:\Windows\INETINF0.EXE 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2836 2320 WerFault.exe INETINF0.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exeINETINF0.EXEdescription pid process target process PID 1452 wrote to memory of 2320 1452 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe INETINF0.EXE PID 1452 wrote to memory of 2320 1452 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe INETINF0.EXE PID 1452 wrote to memory of 2320 1452 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe INETINF0.EXE PID 1452 wrote to memory of 2320 1452 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe INETINF0.EXE PID 2320 wrote to memory of 2656 2320 INETINF0.EXE mmc.exe PID 2320 wrote to memory of 2656 2320 INETINF0.EXE mmc.exe PID 2320 wrote to memory of 2656 2320 INETINF0.EXE mmc.exe PID 2320 wrote to memory of 2656 2320 INETINF0.EXE mmc.exe PID 2320 wrote to memory of 2656 2320 INETINF0.EXE mmc.exe PID 2320 wrote to memory of 2656 2320 INETINF0.EXE mmc.exe PID 2320 wrote to memory of 2836 2320 INETINF0.EXE WerFault.exe PID 2320 wrote to memory of 2836 2320 INETINF0.EXE WerFault.exe PID 2320 wrote to memory of 2836 2320 INETINF0.EXE WerFault.exe PID 2320 wrote to memory of 2836 2320 INETINF0.EXE WerFault.exe PID 1452 wrote to memory of 2628 1452 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe cmd.exe PID 1452 wrote to memory of 2628 1452 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe cmd.exe PID 1452 wrote to memory of 2628 1452 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe cmd.exe PID 1452 wrote to memory of 2628 1452 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\INETINF0.EXEC:\Windows\INETINF0.EXE2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\mmc.exe"C:\Windows\system32\mmc.exe"3⤵PID:2656
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 2803⤵
- Program crash
PID:2836 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\SxingDel.bat2⤵
- Deletes itself
PID:2628
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD52860cdeaa28eabac1d14e3172defc721
SHA1aa7d6aa6d29db261376cb4718a32776d851d96ac
SHA256db41cca14b50bdc8dfce42eddd05539cda6fb2651d8ea62d478f7ab33a59a535
SHA5125df7aabdb03fa406e1ec0027bd18a0dd0cb36a9bf6ff8244fcbd25f13628e5dc3785fa879a8f96f67fa434d90468f824fd89ba1531e33d130f14e31a62da1421
-
Filesize
285KB
MD508cf47adfb8a527f7847bcef5a6e0ab7
SHA189173e4ff6a37c0ead703de99b1b60b78da551fb
SHA2565b909cda4fa30292f4068912cb87c6f7bb7222ba73c0ced54f42e4bc9fc94c8d
SHA5125b5bbc5d03bcba042162ee720687dbbd9c4227eb313836a8b3221ad157dd9dcda8f7f37a01ac79d658074dd13c05482e1404bb210c443781720402f76f733380