Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system - submitted
05/07/2024, 08:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
26cd7c5d24ef0eb15ca349df6b7284fc_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
26cd7c5d24ef0eb15ca349df6b7284fc_JaffaCakes118.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 26cd7c5d24ef0eb15ca349df6b7284fc_JaffaCakes118.exe
- Size 57KB
- Sample240705-kwgxcsyake
- SHA256 29476ce32fdce678866ca1183ed13b92283af1110a6bd0b6b348bf0b9aff9711
- MD5 26cd7c5d24ef0eb15ca349df6b7284fc
- SHA1 deff62ef4b2053bd92c1545622a814a856dcfa17
- SHA512 e2aac002fa8aa2bd97c62526ef8edf7792336e02a9033e592d35463e25cf8ce7d2b22a127c3bd7634da6a65dbfccc9265df07e90a6169163d89048f312fbaabe
- SSDEEP 1536:pm7wjsVTJ+p3JrkGLawHE/E2j+EHwnOE1/o88t/Tq4lBvJ:m+sVT45mn/bjnWo8sTq8Bx
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral2/memory/3168-3-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/files/0x0006000000023252-5.dat modiloader_stage2 - Executes dropped EXE 2 IoCs
pid Process 4316 temp.exe 2084 tcpip.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\tcpip.exe temp.exe File opened for modification C:\Windows\SysWOW64\tcpip.exe temp.exe File created C:\Windows\SysWOW64\mmmmmmmm.bat temp.exe File created C:\Windows\SysWOW64\msiupdata.dll tcpip.exe - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 3168 26cd7c5d24ef0eb15ca349df6b7284fc_JaffaCakes118.exe 3168 26cd7c5d24ef0eb15ca349df6b7284fc_JaffaCakes118.exe 3168 26cd7c5d24ef0eb15ca349df6b7284fc_JaffaCakes118.exe 3168 26cd7c5d24ef0eb15ca349df6b7284fc_JaffaCakes118.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 2084 tcpip.exe 2084 tcpip.exe 2084 tcpip.exe 2084 tcpip.exe 2084 tcpip.exe 2084 tcpip.exe 2084 tcpip.exe 2084 tcpip.exe 2084 tcpip.exe 2084 tcpip.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 4316 temp.exe 2084 tcpip.exe 2084 tcpip.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4316 temp.exe Token: SeDebugPrivilege 2084 tcpip.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3168 wrote to memory of 4836 3168 26cd7c5d24ef0eb15ca349df6b7284fc_JaffaCakes118.exe 82 PID 3168 wrote to memory of 4836 3168 26cd7c5d24ef0eb15ca349df6b7284fc_JaffaCakes118.exe 82 PID 3168 wrote to memory of 4836 3168 26cd7c5d24ef0eb15ca349df6b7284fc_JaffaCakes118.exe 82 PID 4836 wrote to memory of 4316 4836 cmd.exe 84 PID 4836 wrote to memory of 4316 4836 cmd.exe 84 PID 4836 wrote to memory of 4316 4836 cmd.exe 84 PID 4316 wrote to memory of 3084 4316 temp.exe 87 PID 4316 wrote to memory of 3084 4316 temp.exe 87 PID 4316 wrote to memory of 3084 4316 temp.exe 87 PID 2084 wrote to memory of 3500 2084 tcpip.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\26cd7c5d24ef0eb15ca349df6b7284fc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\26cd7c5d24ef0eb15ca349df6b7284fc_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\temp.exe3⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\temp.exeC:\Users\Admin\AppData\Local\Temp\temp.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\mmmmmmmm.bat5⤵PID:3084
-
-
-
-
-
C:\Windows\SysWOW64\tcpip.exeC:\Windows\SysWOW64\tcpip.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\temp.exe
- Size 43KB
- SHA256 775aa502d66daf6c2efd57aa4327f702b5d722a97ce0911cd04b32506483a3fe
- MD5 db00769127bf4d4bf6c69a88510f42f1
- SHA1 e64bb1e91c8bb810c94b8130bff8a5098ffca3aa
- SHA512 9bbd6f03aa85094eda5e7fb2182c133591216241997b879c6882fb7606b94a0a2eebbe3c730ddfe4a0e1e5624bbe39d7840d104755ccbdeb96b816eb0a96a0ac
- SSDEEP 768:VSWEolYEnrSP0Yoi4qZOLQNwdXcBq5OpBlaKr91EPFlx3G/39QuV:g6Y2Yv4qZyQNwdcUOpBlaO1olRnuV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\mmmmmmmm.bat
- Size 136B
- SHA256 4313d66d27196d0fc03c77e21f2b6020adf3f8cf4b7ca6895151c92cf0136bb9
- MD5 bbb1363ff9d91459fafad63764db72a0
- SHA1 39363d056769002ec16b5bd869d9a3548d5d131b
- SHA512 41bcbaefc2d018f93253202b5fe8864e28b232c3c9a7e7237d74b3a3078dec824fad25045dafc44d3a3faafc0a9bbf3d2d62df08628443a8a1a2fa375974b59a
- MD5 SHA1 SHA512