Analysis
-
max time kernel
78s -
max time network
87s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 19:58
Static task
static1
Behavioral task
behavioral1
Sample
094c102cfe009d32dcc6472fbdeb13fc_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
094c102cfe009d32dcc6472fbdeb13fc_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
094c102cfe009d32dcc6472fbdeb13fc_JaffaCakes118.exe
-
Size
636KB
-
MD5
094c102cfe009d32dcc6472fbdeb13fc
-
SHA1
ead4ce61a16655c4901cbda4e3577e7c46c78d26
-
SHA256
9f39836ad42f321fcfdeec74f2f5215dd1ff49f1757a005cfdc291431d71b990
-
SHA512
a2083fab892553d869a524251c7a13478edf3eaa87175999bd8a4eab2fa49daa9c89521c305732aba8c287be92d05286c2bbe95094bbad852c3325c02c0e4a6a
-
SSDEEP
12288:eyjSZuoqrTb/+PCLraJQFUF3Z4mxx4DqVTVOCu:y4BrnWPC/aGmQmXfVTzu
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2500-42-0x0000000000400000-0x000000000050F000-memory.dmp modiloader_stage2 behavioral2/memory/2500-45-0x0000000000400000-0x000000000050F000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
5.exepid process 2500 5.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
094c102cfe009d32dcc6472fbdeb13fc_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 094c102cfe009d32dcc6472fbdeb13fc_JaffaCakes118.exe -
Drops file in System32 directory 1 IoCs
Processes:
5.exedescription ioc process File created C:\Windows\SysWOW64\FieleWay.txt 5.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5.exedescription pid process target process PID 2500 set thread context of 1552 2500 5.exe IEXPLORE.EXE -
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{73696E78-2F3F-11EF-BCA5-6E6D447F5FDC} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425075382" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 1552 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid process 1552 IEXPLORE.EXE 1552 IEXPLORE.EXE 3132 IEXPLORE.EXE 3132 IEXPLORE.EXE 3132 IEXPLORE.EXE 3132 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
094c102cfe009d32dcc6472fbdeb13fc_JaffaCakes118.exe5.exeIEXPLORE.EXEdescription pid process target process PID 1224 wrote to memory of 2500 1224 094c102cfe009d32dcc6472fbdeb13fc_JaffaCakes118.exe 5.exe PID 1224 wrote to memory of 2500 1224 094c102cfe009d32dcc6472fbdeb13fc_JaffaCakes118.exe 5.exe PID 1224 wrote to memory of 2500 1224 094c102cfe009d32dcc6472fbdeb13fc_JaffaCakes118.exe 5.exe PID 2500 wrote to memory of 1552 2500 5.exe IEXPLORE.EXE PID 2500 wrote to memory of 1552 2500 5.exe IEXPLORE.EXE PID 2500 wrote to memory of 1552 2500 5.exe IEXPLORE.EXE PID 1552 wrote to memory of 3132 1552 IEXPLORE.EXE IEXPLORE.EXE PID 1552 wrote to memory of 3132 1552 IEXPLORE.EXE IEXPLORE.EXE PID 1552 wrote to memory of 3132 1552 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\094c102cfe009d32dcc6472fbdeb13fc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\094c102cfe009d32dcc6472fbdeb13fc_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1552 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3132
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
266KB
MD51cc325a1101ef64554b026a2f9ef24c0
SHA19ad930fb4e5641c9147af575c2ac8bd0496ab87c
SHA256848500536d90cae3b795a1924f08816bc431514e2922a9bc2c3a9373645b2102
SHA512448c232ed493500ccdc9e66a16357c4502ce76fce51f4ff8f00baf07bd897908aacdb0fe1ffdbeff73eb4e041e98d5aa57cacc073fff9c927718deb934e315d3