Analysis
- max time kernel
93s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/07/2024, 16:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
22f9c48aecdff7bab7a713fb9924b194_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
22f9c48aecdff7bab7a713fb9924b194_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 22f9c48aecdff7bab7a713fb9924b194_JaffaCakes118.exe
- Size 744KB
- Sample240703-tj6jmaxhml
- SHA256 5c1f9fe29360c1fae71ff9c62f05796e52e97df2797ee48b916cafb13b4c8d82
- MD5 22f9c48aecdff7bab7a713fb9924b194
- SHA1 aaa8cff8e585e264dc30c9ac2d07935bc4cfdfb3
- SHA512 a9114efcfebef43e43d1518cac4664d9479c00f1895184c4046299372559725c61883365ef25b3c57cd0e487dcd62951f58a85500c848f98b5139112ecda58f0
- SSDEEP 12288:qc//////vaK8cq39KWHJ3ECfbxgr8RUWS0ewHCjU67UjqBgx4D6AVNZRU52CfAzE:qc//////CK8cq8UyCfy8RUNCHCju+BgJ
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 5 IoCs
resource yara_rule behavioral2/memory/1168-0-0x0000000000400000-0x00000000004C3000-memory.dmp modiloader_stage2 behavioral2/memory/1168-1-0x0000000000400000-0x00000000004C3000-memory.dmp modiloader_stage2 behavioral2/memory/1168-3-0x0000000000400000-0x00000000004C3000-memory.dmp modiloader_stage2 behavioral2/memory/1168-4-0x0000000000400000-0x00000000004C3000-memory.dmp modiloader_stage2 behavioral2/memory/1168-7-0x0000000000400000-0x00000000004C3000-memory.dmp modiloader_stage2 - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 528 set thread context of 1168 528 22f9c48aecdff7bab7a713fb9924b194_JaffaCakes118.exe 81 PID 1168 set thread context of 4688 1168 22f9c48aecdff7bab7a713fb9924b194_JaffaCakes118.exe 82 - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\2010.txt 22f9c48aecdff7bab7a713fb9924b194_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A29848B1-3957-11EF-92F1-F2AC8AF4D319} = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2000671037" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31116644" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426788377" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31116644" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1996764667" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31116644" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1996764667" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4688 IEXPLORE.EXE - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4688 IEXPLORE.EXE 4688 IEXPLORE.EXE 3364 IEXPLORE.EXE 3364 IEXPLORE.EXE 3364 IEXPLORE.EXE 3364 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 528 wrote to memory of 1168 528 22f9c48aecdff7bab7a713fb9924b194_JaffaCakes118.exe 81 PID 528 wrote to memory of 1168 528 22f9c48aecdff7bab7a713fb9924b194_JaffaCakes118.exe 81 PID 528 wrote to memory of 1168 528 22f9c48aecdff7bab7a713fb9924b194_JaffaCakes118.exe 81 PID 528 wrote to memory of 1168 528 22f9c48aecdff7bab7a713fb9924b194_JaffaCakes118.exe 81 PID 528 wrote to memory of 1168 528 22f9c48aecdff7bab7a713fb9924b194_JaffaCakes118.exe 81 PID 1168 wrote to memory of 4688 1168 22f9c48aecdff7bab7a713fb9924b194_JaffaCakes118.exe 82 PID 1168 wrote to memory of 4688 1168 22f9c48aecdff7bab7a713fb9924b194_JaffaCakes118.exe 82 PID 1168 wrote to memory of 4688 1168 22f9c48aecdff7bab7a713fb9924b194_JaffaCakes118.exe 82 PID 4688 wrote to memory of 3364 4688 IEXPLORE.EXE 83 PID 4688 wrote to memory of 3364 4688 IEXPLORE.EXE 83 PID 4688 wrote to memory of 3364 4688 IEXPLORE.EXE 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\22f9c48aecdff7bab7a713fb9924b194_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\22f9c48aecdff7bab7a713fb9924b194_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\22f9c48aecdff7bab7a713fb9924b194_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\22f9c48aecdff7bab7a713fb9924b194_JaffaCakes118.exe2⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4688 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3364
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 471B
- SHA256 8e323e0354939fd301d8db011a0b007476c93e0e048100922e3e59e34b04f716
- MD5 63a2d2b4cdc269762fe4bdb8cdfde7f8
- SHA1 5cce14e5285ce9844b164d37de9f4ad0acc7880f
- SHA512 db3b35b23c3088fdf8f5215d8f9149e717d871be0c7b69541aba232e6f829e18d9d074b53f173387985a3ba4df1c016ec5b75f4387d6123c6c1ba3113c43dec9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 404B
- SHA256 23044fd3099a6bc2bb5143725e975fba9fe3c4df551e3a6d846d0c3224da4d8c
- MD5 f2c216f8a79bf4da8e5282e741de7700
- SHA1 64a8db674fef1f73b64ee1ff68ce01a6c87c08ae
- SHA512 9f934d383151a08b42f993c7f6f3a2cf493c05e1a7701e211e77b5c165cd67123bd5d8bd8a76d296a861ab968f74c641c4d3a09c2eb46f695963ee8a72c26b19
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0RV7W6KN\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- MD5 SHA1 SHA512 SSDEEP