Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 18:50
Static task
static1
Behavioral task
behavioral1
Sample
08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe
-
Size
285KB
-
MD5
08cf47adfb8a527f7847bcef5a6e0ab7
-
SHA1
89173e4ff6a37c0ead703de99b1b60b78da551fb
-
SHA256
5b909cda4fa30292f4068912cb87c6f7bb7222ba73c0ced54f42e4bc9fc94c8d
-
SHA512
5b5bbc5d03bcba042162ee720687dbbd9c4227eb313836a8b3221ad157dd9dcda8f7f37a01ac79d658074dd13c05482e1404bb210c443781720402f76f733380
-
SSDEEP
6144:U0DI7Qa2UvGW70rShfvv+rejFCtvsbze851T2bycNtbt81P:U0Ha2xWorSKejvbze8jTgNNtby1P
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3008-2-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/2064-19-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/2064-28-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3008-29-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
INETINF0.EXEpid process 2064 INETINF0.EXE -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exedescription ioc process File opened (read-only) \??\S: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\T: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\Z: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\B: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\L: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\N: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\O: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\P: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\H: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\J: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\U: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\Y: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\K: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\M: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\R: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\V: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\W: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\X: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\A: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\E: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\G: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\I: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened (read-only) \??\Q: 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exedescription ioc process File created C:\AutoRun.inf 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened for modification C:\AutoRun.inf 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File created F:\AutoRun.inf 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File opened for modification F:\AutoRun.inf 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
Processes:
INETINF0.EXEdescription ioc process File created C:\Windows\SysWOW64\_INETINF0.EXE INETINF0.EXE File opened for modification C:\Windows\SysWOW64\_INETINF0.EXE INETINF0.EXE -
Suspicious use of SetThreadContext 2 IoCs
Processes:
INETINF0.EXEdescription pid process target process PID 2064 set thread context of 2900 2064 INETINF0.EXE mmc.exe PID 2064 set thread context of 888 2064 INETINF0.EXE IEXPLORE.EXE -
Drops file in Windows directory 3 IoCs
Processes:
08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\INETINF0.EXE 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File created C:\Windows\SxingDel.bat 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe File created C:\Windows\INETINF0.EXE 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4508 2900 WerFault.exe mmc.exe -
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3466712203" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31114050" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{FA01712B-2F35-11EF-B1BC-F2F05A85BDCE} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31114050" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3463743139" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31114050" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425674409" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3463743139" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 888 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid process 888 IEXPLORE.EXE 888 IEXPLORE.EXE 3584 IEXPLORE.EXE 3584 IEXPLORE.EXE 3584 IEXPLORE.EXE 3584 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exeINETINF0.EXEIEXPLORE.EXEdescription pid process target process PID 3008 wrote to memory of 2064 3008 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe INETINF0.EXE PID 3008 wrote to memory of 2064 3008 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe INETINF0.EXE PID 3008 wrote to memory of 2064 3008 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe INETINF0.EXE PID 2064 wrote to memory of 2900 2064 INETINF0.EXE mmc.exe PID 2064 wrote to memory of 2900 2064 INETINF0.EXE mmc.exe PID 2064 wrote to memory of 2900 2064 INETINF0.EXE mmc.exe PID 2064 wrote to memory of 2900 2064 INETINF0.EXE mmc.exe PID 2064 wrote to memory of 2900 2064 INETINF0.EXE mmc.exe PID 2064 wrote to memory of 888 2064 INETINF0.EXE IEXPLORE.EXE PID 2064 wrote to memory of 888 2064 INETINF0.EXE IEXPLORE.EXE PID 2064 wrote to memory of 888 2064 INETINF0.EXE IEXPLORE.EXE PID 3008 wrote to memory of 4484 3008 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe cmd.exe PID 3008 wrote to memory of 4484 3008 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe cmd.exe PID 3008 wrote to memory of 4484 3008 08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe cmd.exe PID 888 wrote to memory of 3584 888 IEXPLORE.EXE IEXPLORE.EXE PID 888 wrote to memory of 3584 888 IEXPLORE.EXE IEXPLORE.EXE PID 888 wrote to memory of 3584 888 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\08cf47adfb8a527f7847bcef5a6e0ab7_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\INETINF0.EXEC:\Windows\INETINF0.EXE2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\mmc.exe"C:\Windows\system32\mmc.exe"3⤵PID:2900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 244⤵
- Program crash
PID:4508 -
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:888 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SxingDel.bat2⤵PID:4484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2900 -ip 29001⤵PID:3444
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
212B
MD52860cdeaa28eabac1d14e3172defc721
SHA1aa7d6aa6d29db261376cb4718a32776d851d96ac
SHA256db41cca14b50bdc8dfce42eddd05539cda6fb2651d8ea62d478f7ab33a59a535
SHA5125df7aabdb03fa406e1ec0027bd18a0dd0cb36a9bf6ff8244fcbd25f13628e5dc3785fa879a8f96f67fa434d90468f824fd89ba1531e33d130f14e31a62da1421
-
Filesize
285KB
MD508cf47adfb8a527f7847bcef5a6e0ab7
SHA189173e4ff6a37c0ead703de99b1b60b78da551fb
SHA2565b909cda4fa30292f4068912cb87c6f7bb7222ba73c0ced54f42e4bc9fc94c8d
SHA5125b5bbc5d03bcba042162ee720687dbbd9c4227eb313836a8b3221ad157dd9dcda8f7f37a01ac79d658074dd13c05482e1404bb210c443781720402f76f733380