Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
20/06/2024, 18:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe
- Size 285KB
- Sample240620-xg5fbssdrb
- SHA256 5b909cda4fa30292f4068912cb87c6f7bb7222ba73c0ced54f42e4bc9fc94c8d
- MD5 08cf47adfb8a527f7847bcef5a6e0ab7
- SHA1 89173e4ff6a37c0ead703de99b1b60b78da551fb
- SHA512 5b5bbc5d03bcba042162ee720687dbbd9c4227eb313836a8b3221ad157dd9dcda8f7f37a01ac79d658074dd13c05482e1404bb210c443781720402f76f733380
- SSDEEP 6144:U0DI7Qa2UvGW70rShfvv+rejFCtvsbze851T2bycNtbt81P:U0Ha2xWorSKejvbze8jTgNNtby1P
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 4 IoCs
resource yara_rule behavioral2/memory/3008-2-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/2064-19-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/2064-28-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3008-29-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 - Executes dropped EXE 1 IoCs
pid Process 2064 INETINF0.EXE - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\T: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\Z: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\B: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\L: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\N: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\O: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\P: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\H: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\J: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\U: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\Y: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\K: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\M: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\R: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\V: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\W: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\X: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\A: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\E: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\G: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\I: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\Q: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe - Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\AutoRun.inf 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened for modification C:\AutoRun.inf 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File created F:\AutoRun.inf 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened for modification F:\AutoRun.inf 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\_INETINF0.EXE INETINF0.EXE File opened for modification C:\Windows\SysWOW64\_INETINF0.EXE INETINF0.EXE - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2064 set thread context of 2900 2064 INETINF0.EXE 89 PID 2064 set thread context of 888 2064 INETINF0.EXE 91 - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\INETINF0.EXE 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File created C:\Windows\SxingDel.bat 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File created C:\Windows\INETINF0.EXE 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe - Program crash 1 IoCs
pid pid_target Process procid_target 4508 2900 WerFault.exe 89 -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3466712203" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31114050" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{FA01712B-2F35-11EF-B1BC-F2F05A85BDCE} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31114050" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3463743139" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31114050" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425674409" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3463743139" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 888 IEXPLORE.EXE - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 888 IEXPLORE.EXE 888 IEXPLORE.EXE 3584 IEXPLORE.EXE 3584 IEXPLORE.EXE 3584 IEXPLORE.EXE 3584 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2064 3008 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe 86 PID 3008 wrote to memory of 2064 3008 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe 86 PID 3008 wrote to memory of 2064 3008 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe 86 PID 2064 wrote to memory of 2900 2064 INETINF0.EXE 89 PID 2064 wrote to memory of 2900 2064 INETINF0.EXE 89 PID 2064 wrote to memory of 2900 2064 INETINF0.EXE 89 PID 2064 wrote to memory of 2900 2064 INETINF0.EXE 89 PID 2064 wrote to memory of 2900 2064 INETINF0.EXE 89 PID 2064 wrote to memory of 888 2064 INETINF0.EXE 91 PID 2064 wrote to memory of 888 2064 INETINF0.EXE 91 PID 2064 wrote to memory of 888 2064 INETINF0.EXE 91 PID 3008 wrote to memory of 4484 3008 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe 92 PID 3008 wrote to memory of 4484 3008 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe 92 PID 3008 wrote to memory of 4484 3008 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe 92 PID 888 wrote to memory of 3584 888 IEXPLORE.EXE 96 PID 888 wrote to memory of 3584 888 IEXPLORE.EXE 96 PID 888 wrote to memory of 3584 888 IEXPLORE.EXE 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\INETINF0.EXEC:\Windows\INETINF0.EXE2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\mmc.exe"C:\Windows\system32\mmc.exe"3⤵PID:2900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 244⤵
- Program crash
PID:4508
-
-
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:888 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3584
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SxingDel.bat2⤵PID:4484
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2900 -ip 29001⤵PID:3444
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0K2PF59Z\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SxingDel.bat
- Size 212B
- SHA256 db41cca14b50bdc8dfce42eddd05539cda6fb2651d8ea62d478f7ab33a59a535
- MD5 2860cdeaa28eabac1d14e3172defc721
- SHA1 aa7d6aa6d29db261376cb4718a32776d851d96ac
- SHA512 5df7aabdb03fa406e1ec0027bd18a0dd0cb36a9bf6ff8244fcbd25f13628e5dc3785fa879a8f96f67fa434d90468f824fd89ba1531e33d130f14e31a62da1421
- MD5 SHA1 SHA512
- Path F:\INETINF0.EXE
- Size 285KB
- SHA256 5b909cda4fa30292f4068912cb87c6f7bb7222ba73c0ced54f42e4bc9fc94c8d
- MD5 08cf47adfb8a527f7847bcef5a6e0ab7
- SHA1 89173e4ff6a37c0ead703de99b1b60b78da551fb
- SHA512 5b5bbc5d03bcba042162ee720687dbbd9c4227eb313836a8b3221ad157dd9dcda8f7f37a01ac79d658074dd13c05482e1404bb210c443781720402f76f733380
- SSDEEP 6144:U0DI7Qa2UvGW70rShfvv+rejFCtvsbze851T2bycNtbt81P:U0Ha2xWorSKejvbze8jTgNNtby1P
- MD5 SHA1 SHA512 SSDEEP