Analysis
-
max time kernel
139s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22-07-2024 23:46
Static task
static1
Behavioral task
behavioral1
Sample
654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe
-
Size
668KB
-
MD5
654b69623060b9d0994cd2c14fc5c357
-
SHA1
1226e9dd4ca8243997c7b1bbac6e1686d08d1af5
-
SHA256
f5be6e5001a47d22eea6f9b4912a0142ff7cc86f075324fbb967f931fbb833b1
-
SHA512
9ec952e27eab08916ad31d9a6fe47f988793485b033e1680976a34fefc1a3e5df8dd6ed70b54882f29ddd66703da9c0b803f43253a575ae584f2a64774f2ff80
-
SSDEEP
12288:fqUfin1qJm/9e/sK1RaAXPTytF3Z4mxxukly74G1TBecNQP2d6sb0:SUf4IWQ7aAXutQmXPy74GpBeDP2d660
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral2/memory/2020-37-0x0000000000400000-0x000000000051F000-memory.dmp modiloader_stage2 behavioral2/memory/2068-40-0x0000000000400000-0x000000000051F000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 2068 rejoice91.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\A: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\E: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\J: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\K: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\L: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\N: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\R: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\O: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\P: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\Q: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\S: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\W: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\B: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\G: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\H: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\M: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\T: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\X: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\Y: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\I: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\U: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\Z: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created F:\AutoRun.inf 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened for modification F:\AutoRun.inf 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File created C:\AutoRun.inf 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened for modification C:\AutoRun.inf 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\_rejoice91.exe rejoice91.exe File opened for modification C:\Windows\SysWOW64\_rejoice91.exe rejoice91.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice91.exe 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice91.exe 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3624 2068 WerFault.exe 87 -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2068 2020 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe 87 PID 2020 wrote to memory of 2068 2020 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe 87 PID 2020 wrote to memory of 2068 2020 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe 87 PID 2068 wrote to memory of 2820 2068 rejoice91.exe 88 PID 2068 wrote to memory of 2820 2068 rejoice91.exe 88 PID 2068 wrote to memory of 2820 2068 rejoice91.exe 88 PID 2020 wrote to memory of 4372 2020 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe 92 PID 2020 wrote to memory of 4372 2020 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe 92 PID 2020 wrote to memory of 4372 2020 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice91.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice91.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:2820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 6643⤵
- Program crash
PID:3624
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat""2⤵PID:4372
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2068 -ip 20681⤵PID:3500
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD5391863e7f98c58a280f4b7fd6224b35f
SHA18b16814a5557b40a919047e90c898fad0bd25e9c
SHA2565f920bfc2383adf123fd9756058aa765ca40ad8df626fb0672f2a0ddd87bec9d
SHA5123a312c02235dd9afa109f635a05e75622f02507014446817062f7f4d82270623f727b4d4a834f17e2cec95fdc35ae78c7f992376c396b8de2a4ca4c119f9a881
-
Filesize
668KB
MD5654b69623060b9d0994cd2c14fc5c357
SHA11226e9dd4ca8243997c7b1bbac6e1686d08d1af5
SHA256f5be6e5001a47d22eea6f9b4912a0142ff7cc86f075324fbb967f931fbb833b1
SHA5129ec952e27eab08916ad31d9a6fe47f988793485b033e1680976a34fefc1a3e5df8dd6ed70b54882f29ddd66703da9c0b803f43253a575ae584f2a64774f2ff80