Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/07/2024, 10:23

General

  • Target

    672fec09c1e3b1c4371a105f2e1b3cbf_JaffaCakes118.exe

  • Size

    628KB

  • MD5

    672fec09c1e3b1c4371a105f2e1b3cbf

  • SHA1

    51de31e594739df07c7ecbef4b497f6d24ebf753

  • SHA256

    220f60a75ba617d6c57a8b640e4546723646b2655ea146b898993d531186c84c

  • SHA512

    f799d44bc56010e87fad6ed9029303e4ca3b69c55be4a475bd0030ff26e7959b07ab69ac0dc62b35747e107b31f540c801dd5a2be00de15edf3463739ca56c48

  • SSDEEP

    12288:2eX2dhLTl8BBg31g0Owy/HCdhIw54aGNJhhSoRhBjrhIXa061CPQgcwQhFn:xmdxTODgTOwy/HwhR54aiiItaz61CPnc

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\672fec09c1e3b1c4371a105f2e1b3cbf_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\672fec09c1e3b1c4371a105f2e1b3cbf_JaffaCakes118.exe"
    1⤵
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Program Files\Common Files\Microsoft Shared\MSINFO\RECYCLER.EXE
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\RECYCLER.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:712
      • C:\program files\internet explorer\IEXPLORE.EXE
        "C:\program files\internet explorer\IEXPLORE.EXE"
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4140
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4140 CREDAT:17410 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:4888
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat""
      2⤵
        PID:3800

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\AutoRun.inf

      Filesize

      172B

      MD5

      927852231949a3349759bf1b81099a00

      SHA1

      859edef102d3daef447a34a2c2db8b3e54a18bf0

      SHA256

      4fe401c28161efc84b7a28d236c79680fd6bc5631d23533ccaa3afe8a13e1297

      SHA512

      cbdcb8194be39dfea6015182a57d043c9e2de807e96283fcc967a243a9f8d6223cca4190082408dfb5b213f08aae0a2a4444787425f22f8c033b2ea8533fe3fb

    • C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat

      Filesize

      212B

      MD5

      19032213762b50418eabafd10eadcea3

      SHA1

      7d16d9807b64cd9b7de7961add9030a1b6ede268

      SHA256

      f03f6b8065e420c4f1616e8d3c395392a61bc11bd3be75c3fa0958929a3a743a

      SHA512

      22e43c74f4becc6862f33e55dc18b2ad4eaf043a9f4a74082438ffe83f178cbb1940ec68eb4a05d36b20b50d284b03cb6c4364ec4dad8079fc2d812961185555

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\A4F1OTIC\suggestions[1].en-US

      Filesize

      17KB

      MD5

      5a34cb996293fde2cb7a4ac89587393a

      SHA1

      3c96c993500690d1a77873cd62bc639b3a10653f

      SHA256

      c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

      SHA512

      e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    • F:\RECYCLER.EXE

      Filesize

      628KB

      MD5

      672fec09c1e3b1c4371a105f2e1b3cbf

      SHA1

      51de31e594739df07c7ecbef4b497f6d24ebf753

      SHA256

      220f60a75ba617d6c57a8b640e4546723646b2655ea146b898993d531186c84c

      SHA512

      f799d44bc56010e87fad6ed9029303e4ca3b69c55be4a475bd0030ff26e7959b07ab69ac0dc62b35747e107b31f540c801dd5a2be00de15edf3463739ca56c48

    • memory/712-85-0x0000000000400000-0x00000000005B6000-memory.dmp

      Filesize

      1.7MB

    • memory/1880-31-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-20-0x0000000003630000-0x0000000003631000-memory.dmp

      Filesize

      4KB

    • memory/1880-2-0x0000000002370000-0x00000000023C4000-memory.dmp

      Filesize

      336KB

    • memory/1880-3-0x0000000002590000-0x0000000002591000-memory.dmp

      Filesize

      4KB

    • memory/1880-42-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-55-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-33-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-54-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-53-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-52-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-51-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-50-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-49-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-48-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-47-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-46-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-45-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-44-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-43-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-41-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-40-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-39-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-38-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-37-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-36-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-35-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-34-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-0-0x0000000000400000-0x00000000005B6000-memory.dmp

      Filesize

      1.7MB

    • memory/1880-1-0x0000000000760000-0x0000000000761000-memory.dmp

      Filesize

      4KB

    • memory/1880-32-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-17-0x0000000003540000-0x0000000003541000-memory.dmp

      Filesize

      4KB

    • memory/1880-28-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-27-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-26-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-25-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-23-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-24-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-22-0x0000000003630000-0x0000000003631000-memory.dmp

      Filesize

      4KB

    • memory/1880-21-0x0000000003630000-0x0000000003631000-memory.dmp

      Filesize

      4KB

    • memory/1880-19-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-30-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-16-0x0000000003540000-0x0000000003541000-memory.dmp

      Filesize

      4KB

    • memory/1880-18-0x0000000003540000-0x0000000003541000-memory.dmp

      Filesize

      4KB

    • memory/1880-29-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1880-14-0x0000000003540000-0x0000000003541000-memory.dmp

      Filesize

      4KB

    • memory/1880-15-0x0000000003540000-0x0000000003541000-memory.dmp

      Filesize

      4KB

    • memory/1880-12-0x0000000003530000-0x0000000003630000-memory.dmp

      Filesize

      1024KB

    • memory/1880-13-0x0000000003540000-0x0000000003541000-memory.dmp

      Filesize

      4KB

    • memory/1880-11-0x0000000002560000-0x0000000002561000-memory.dmp

      Filesize

      4KB

    • memory/1880-10-0x00000000025D0000-0x00000000025D1000-memory.dmp

      Filesize

      4KB

    • memory/1880-9-0x00000000025A0000-0x00000000025A1000-memory.dmp

      Filesize

      4KB

    • memory/1880-8-0x00000000025B0000-0x00000000025B1000-memory.dmp

      Filesize

      4KB

    • memory/1880-7-0x0000000002540000-0x0000000002541000-memory.dmp

      Filesize

      4KB

    • memory/1880-6-0x0000000002550000-0x0000000002551000-memory.dmp

      Filesize

      4KB

    • memory/1880-5-0x00000000025C0000-0x00000000025C1000-memory.dmp

      Filesize

      4KB

    • memory/1880-4-0x0000000002570000-0x0000000002571000-memory.dmp

      Filesize

      4KB

    • memory/1880-86-0x0000000000400000-0x00000000005B6000-memory.dmp

      Filesize

      1.7MB

    • memory/1880-87-0x0000000002370000-0x00000000023C4000-memory.dmp

      Filesize

      336KB

    • memory/4140-82-0x00000000000F0000-0x00000000002A6000-memory.dmp

      Filesize

      1.7MB