Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    04/07/2024, 01:41

General

  • Target

    24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe

  • Size

    844KB

  • MD5

    24324b4f141efbcee94b278fef963e5c

  • SHA1

    4a2737127a99cc0c87d4f6914198fff6225cf1bf

  • SHA256

    80ea7700f0bf3ce805448aa904fe6eedef23fb5c94c963304a22f196ec00462d

  • SHA512

    192ce308b122e584359ba8963a45a5503435b09c71224daaa67c2d00a1eb2f8504a5e2c0deec45c3f5160e465e23209a4c25b8d4a8d2eef04a83a5aae195e3bf

  • SSDEEP

    24576:fvX0CqJm7lpD2KXQztsFvKlH0jmr5WisTzjle5U5TIDV+DwLQk9Qd:3X05Jm7sAKF0GELm8IDVGqQV

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • ModiLoader Second Stage 2 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 16 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 53 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Drops desktop.ini file(s)
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:336
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    1⤵
      PID:856
      • C:\Windows\system32\wbem\WMIADAP.EXE
        wmiadap.exe /F /T /R
        2⤵
          PID:2284
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
        • Modifies WinLogon for persistence
        • Executes dropped EXE
        PID:1212
        • C:\Users\Admin\AppData\Local\Temp\24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe"
          2⤵
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1500
          • C:\Users\Admin\srRTMxaDv9.exe
            C:\Users\Admin\srRTMxaDv9.exe
            3⤵
            • Modifies visiblity of hidden/system files in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1804
            • C:\Users\Admin\sakeg.exe
              "C:\Users\Admin\sakeg.exe"
              4⤵
              • Modifies visiblity of hidden/system files in Explorer
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:2352
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c tasklist&&del srRTMxaDv9.exe
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2656
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                5⤵
                • Enumerates processes with tasklist
                • Suspicious use of AdjustPrivilegeToken
                PID:2780
          • C:\Users\Admin\amhost.exe
            C:\Users\Admin\amhost.exe
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2712
            • C:\Users\Admin\amhost.exe
              amhost.exe
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:2560
          • C:\Users\Admin\bmhost.exe
            C:\Users\Admin\bmhost.exe
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2680
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe"
              4⤵
                PID:1592
            • C:\Users\Admin\cmhost.exe
              C:\Users\Admin\cmhost.exe
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:1996
              • C:\Users\Admin\AppData\Local\252884a2\X
                176.53.17.24:80
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1312
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe"
                4⤵
                  PID:2008
              • C:\Users\Admin\dmhost.exe
                C:\Users\Admin\dmhost.exe
                3⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2492
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c tasklist&&del 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe
                3⤵
                • Deletes itself
                PID:844
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  4⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2692
          • C:\Windows\system32\wbem\wmiprvse.exe
            C:\Windows\system32\wbem\wmiprvse.exe -Embedding
            1⤵
              PID:1840

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\252884a2\@

              Filesize

              2KB

              MD5

              f5e66a93bc297ba83db0e7b5564ced3f

              SHA1

              863c519546cfba7531b8ecbf10ae5bede6d2193d

              SHA256

              94257ae4c040d8487cb44bc23030193944c72c12678dcd8b80684a3721b21231

              SHA512

              b7ee82bdc3057df90eed61a9d0d6d52420fb8baf6cc8f12f30144ecdd1f298f13d89e14bfa474ea939bd734440f185d7bba72d1140080a3ef975253191adaea3

            • C:\Windows\system32\consrv.dll

              Filesize

              53KB

              MD5

              4d7cde615a0f534bd5e359951829554b

              SHA1

              c885d00d9000f2a5dbc78f6193a052b36f4fe968

              SHA256

              414fdf9bdcae5136c1295d6d24740c50a484acd81f1f7d0fb5d5c138607cb80a

              SHA512

              33d632f9fbb694440a1ca568c90518784278efd1dc9ee2b57028149d56ebe1f7346d5b59dcfafee2eeaa10091dda05f48958e909d6bfc891e037ae1cfbd048d4

            • \??\globalroot\systemroot\assembly\temp\@

              Filesize

              2KB

              MD5

              811296d58d3e66816eaabab62ad21603

              SHA1

              b995c5d560808d98aa88732893f0d3cb5162651d

              SHA256

              bf28975439a51b7587c903bbfeaf5f48536ffe3a5336243af1647f94ba1e50b4

              SHA512

              0d4fdc054abc095fb35bcecf6e300baf665313c9dc7c360808e4ca5450e6d83c21e9e6760a91b5fefb0b2f363204ed6c89ac6bfbf91dc01c45478912a1677ce6

            • \Users\Admin\AppData\Local\252884a2\X

              Filesize

              41KB

              MD5

              be40a2578e862f1cecc9b9194f524201

              SHA1

              0c379f375f9bcfab2e8d86161cec07fe4a7dbc12

              SHA256

              2c0f19272baa42d1af85a395fe8cd687c50e91450abc5911f6806c317a25b6a6

              SHA512

              25fbee1dce99c0ca80cd11bbe0d9fceaa07bf8a8b9b3ebc04e55645c0a733dafc83a7922975c31bc9fdff6f413257ac8b9ff72628c78b48a5b7ab669eab369f8

            • \Users\Admin\amhost.exe

              Filesize

              80KB

              MD5

              8ccbe4f27f9710f3e7f75e1d1de57e49

              SHA1

              272e95e476477cd4a1715ee0bcf32318e0351718

              SHA256

              3d36ee15c25b2308f8552e121d885c26b46b4e7fc6dbb41a684bec53e0ae3b5d

              SHA512

              334f56b5158839f521513aff9de334536c86da633bf1a3b78592529275457973ed67fd55a54bef8f88ce918c2863c365cababfbd0ef888a27272906e281105d0

            • \Users\Admin\bmhost.exe

              Filesize

              258KB

              MD5

              2da0070a7c50f3a078b73b4fb7ee7c02

              SHA1

              999b4860a80b908622fadfc8fae27db66b200932

              SHA256

              f8a0f1b5b3f320f01173f151305dc780eac51bf78e7405fd2c0b9b3ba58945bf

              SHA512

              2d488508e785d92c5cf9f0abee8153d984d8dd8f1d59880643764f499e151fccc9572a9ad1fe0a82412b8ed230d25bd849a0beeded12325dc21839ed53512630

            • \Users\Admin\cmhost.exe

              Filesize

              358KB

              MD5

              03102e4338eb16e0c4dfe106830557e3

              SHA1

              4fdb5baf0900e44e95acdeee1c947be3b0518b39

              SHA256

              7dd28bddc46daddc8f7e14906f50ef991d3d7f1ffb785388fb5c42be9e162139

              SHA512

              c7d4b4b3766c0b4cdc3d16f56effe1b36cacd4a48f728cf1a33360eb6c48362587186dc0be45f098cd3117bc10c7113d51262939bfe018c6f963b36d59cd97c9

            • \Users\Admin\dmhost.exe

              Filesize

              32KB

              MD5

              3b906143422ff578e4a9bc688441e89c

              SHA1

              4164ef104958d715275a85f62603b5118f8a6ebc

              SHA256

              cb6cc4f0050dc045087df49249e1f2d57a86cc332106a904b7d59dff0819aacf

              SHA512

              06b1d0ae7c60565c982feaa6877f6538040b47d27f2b8ea0178ddab9505b5f91f69ac485adfa043747e7d8c8b9b75748dd11699d38eca76124f77ceda0e9daeb

            • \Users\Admin\sakeg.exe

              Filesize

              344KB

              MD5

              d853b95edccee6c0180bc056c2ef0be0

              SHA1

              68fdb4fede4e714151e3ac715a84b80e3176ccd4

              SHA256

              4d14dcba3941e5ec355355b8b58e09e7731b0bb0f05b29a7c3b48748c55be0fc

              SHA512

              9c8afa7dc47092ffef5cd3e043197877992ed68a62969db521d5ba2f7b72b441ccd4ca2504541260e646cd58b57f54c15fb195139dba8ad42782fd140a6eca3b

            • \Users\Admin\srRTMxaDv9.exe

              Filesize

              344KB

              MD5

              57a5743f47b3a874773041195600909c

              SHA1

              74f5c16a6ca03baea7c684e40d351f1ec484a70d

              SHA256

              eecfb7541cf571d34882ebeb19c3c396ed53243e23060d45e1f1b033e061da90

              SHA512

              66c4621663db921b7a18b843197ea6611e9473abca6b2a653d1f228146129434a7f643f598e0fdfbe300f2ea91168135de59a69f02f52245c71f12e4364e2954

            • \Windows\assembly\GAC_32\Desktop.ini

              Filesize

              4KB

              MD5

              878f9b6da85cb98fcbdf6abd1730a32f

              SHA1

              343007e658ea541f4680b4edf4513e69e1cc18a6

              SHA256

              75b5a460ed6f47fca8ec1bcd8a11b22f24fb33de4d5f307b851ad20c7f831b7d

              SHA512

              5425844e34ad5e717b08830020526f5c9465f654f3e9e29967b2983d5cb8dc225be2b89cd29a8e4cc99fcfc99e05556f66eefa0539283ab4569e603413a37293

            • \Windows\assembly\GAC_64\Desktop.ini

              Filesize

              5KB

              MD5

              9d7ec1e355ac35cbe6991721ef5ae3b8

              SHA1

              c35a00bd35c6e4a7516b93947be08ead966347e8

              SHA256

              68a3cec42215323100398a8eb2cbb37da7d58fe0fa9c6312e954e0f50a95ca98

              SHA512

              b7c4be28d8e179974672205a50e72fa1ec9e2e8170b3b8ee763e1751a3397c35afec7a72c88f0a79a8566749b2af1ff054660a96c3a6d6508c545d316a035dc0

            • memory/336-87-0x0000000000E50000-0x0000000000E62000-memory.dmp

              Filesize

              72KB

            • memory/1212-115-0x00000000024D0000-0x00000000024DB000-memory.dmp

              Filesize

              44KB

            • memory/1212-121-0x00000000024E0000-0x00000000024EB000-memory.dmp

              Filesize

              44KB

            • memory/1212-120-0x00000000024D0000-0x00000000024DB000-memory.dmp

              Filesize

              44KB

            • memory/1212-73-0x00000000024B0000-0x00000000024B6000-memory.dmp

              Filesize

              24KB

            • memory/1212-111-0x00000000024D0000-0x00000000024DB000-memory.dmp

              Filesize

              44KB

            • memory/1212-81-0x00000000024B0000-0x00000000024B6000-memory.dmp

              Filesize

              24KB

            • memory/1212-77-0x00000000024B0000-0x00000000024B6000-memory.dmp

              Filesize

              24KB

            • memory/1996-128-0x0000000000400000-0x0000000000465C48-memory.dmp

              Filesize

              407KB

            • memory/1996-136-0x0000000000400000-0x0000000000465C48-memory.dmp

              Filesize

              407KB

            • memory/2560-49-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

            • memory/2560-44-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

            • memory/2560-36-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

            • memory/2560-43-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

              Filesize

              4KB

            • memory/2560-40-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

            • memory/2560-38-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

            • memory/2560-50-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

            • memory/2560-52-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

            • memory/2560-51-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

            • memory/2680-64-0x0000000000650000-0x0000000000691000-memory.dmp

              Filesize

              260KB

            • memory/2680-69-0x0000000000650000-0x0000000000691000-memory.dmp

              Filesize

              260KB

            • memory/2680-68-0x0000000000650000-0x0000000000691000-memory.dmp

              Filesize

              260KB

            • memory/2680-60-0x0000000000650000-0x0000000000691000-memory.dmp

              Filesize

              260KB

            • memory/2680-72-0x0000000000650000-0x0000000000691000-memory.dmp

              Filesize

              260KB

            • memory/2680-91-0x0000000000400000-0x0000000000446000-memory.dmp

              Filesize

              280KB

            • memory/2680-70-0x0000000000650000-0x0000000000691000-memory.dmp

              Filesize

              260KB

            • memory/2712-45-0x0000000000400000-0x0000000000417000-memory.dmp

              Filesize

              92KB