Analysis
- max time kernel
146s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
03/07/2024, 04:33
General
- Target 2116d71e88ced26d4edb818ebd30d934_JaffaCakes118.exe
- Size 213KB
- Sample240703-e6j7ksxfjc
- SHA256 a6ad9566c639aab349ad98b8f47e891b0b7c5a7b5fea28063f04d5adff6d7943
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 5 IoCs
- Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 1 IoCs
- UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in System32 directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2116d71e88ced26d4edb818ebd30d934_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2116d71e88ced26d4edb818ebd30d934_JaffaCakes118.exe"1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3832 -s 2282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3832 -s 4042⤵
- Program crash
-
-
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\2116d71e88ced26d4edb818ebd30d934_JaffaCakes118.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3832 -ip 38321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3832 -ip 38321⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k network1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
sysn.dll
memory/2128-13-0x0000000000400000-0x000000000046F000-memory.dmp
memory/2128-15-0x0000000000400000-0x000000000046F000-memory.dmp
memory/2128-17-0x0000000000400000-0x000000000046F000-memory.dmp
memory/2128-19-0x0000000000400000-0x000000000046F000-memory.dmp
memory/3832-0-0x0000000000400000-0x00000000004D7000-memory.dmp
memory/3832-1-0x00000000001C0000-0x00000000001CA000-memory.dmp
memory/3832-2-0x0000000000400000-0x00000000004D7000-memory.dmp
memory/3832-3-0x0000000000401000-0x0000000000409000-memory.dmp
memory/3832-11-0x00000000001C0000-0x00000000001CA000-memory.dmp
memory/3832-14-0x0000000000400000-0x00000000004D7000-memory.dmp