Analysis

  • max time kernel
    118s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/09/2024, 22:00

General

  • Target

    e11f797fa001457a8de0b985b8efd17e_JaffaCakes118.exe

  • Size

    786KB

  • MD5

    e11f797fa001457a8de0b985b8efd17e

  • SHA1

    69e9c3e1e7b3c260dc300dcd452ecf26ee1aeef0

  • SHA256

    111fe6977249740d31b9af738c485b007ad050f6fc450f54b8e4df60789894ad

  • SHA512

    fce1cb7ddd88a140786043c4acf1795cf910d28046c2485bf6c5e4e8f7c2fc6514c68de31db4b88ac2ea1b7b43a3a414584f2a9fdd9af2d816656ba87a23c45e

  • SSDEEP

    12288:AlZYc2z1y6lc5AgHQPQjd+d6v75Ce6BODa4ATsuPycl4O8yDl4lmTwA:AlKcI1uYPQjd+s755C3zDxl4lmTB

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 7 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e11f797fa001457a8de0b985b8efd17e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e11f797fa001457a8de0b985b8efd17e_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2524
    • C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice91.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice91.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1928
      • C:\Windows\SysWOW64\calc.exe
        "C:\Windows\system32\calc.exe"
        3⤵
          PID:2764
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 280
          3⤵
          • Loads dropped DLL
          • Program crash
          PID:2832
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat""
        2⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:1872

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\ReDelBat.bat

      Filesize

      212B

      MD5

      4fcceed71663bb45154c631e73757c53

      SHA1

      e5ae60d8296195c81a65ec412a0cd81637305901

      SHA256

      053b416993af3f05dadb45a0d249eba5d411d180af44071772713db79d61fd2c

      SHA512

      8ca8989c19106ce13f6865d8e518ed7a703608e0e43acd76f16eccb97c8befcb9ef03575b06fa7c8eaceb256882b9aa79983d4baad4ed3d9f4e7c282d753197f

    • F:\rejoice91.exe

      Filesize

      786KB

      MD5

      e11f797fa001457a8de0b985b8efd17e

      SHA1

      69e9c3e1e7b3c260dc300dcd452ecf26ee1aeef0

      SHA256

      111fe6977249740d31b9af738c485b007ad050f6fc450f54b8e4df60789894ad

      SHA512

      fce1cb7ddd88a140786043c4acf1795cf910d28046c2485bf6c5e4e8f7c2fc6514c68de31db4b88ac2ea1b7b43a3a414584f2a9fdd9af2d816656ba87a23c45e

    • memory/1928-22-0x00000000002E0000-0x00000000002E1000-memory.dmp

      Filesize

      4KB

    • memory/1928-35-0x0000000000400000-0x00000000004C7000-memory.dmp

      Filesize

      796KB

    • memory/1928-20-0x0000000000400000-0x00000000004C7000-memory.dmp

      Filesize

      796KB

    • memory/2524-34-0x0000000000400000-0x00000000004C7000-memory.dmp

      Filesize

      796KB

    • memory/2524-0-0x0000000000400000-0x00000000004C7000-memory.dmp

      Filesize

      796KB

    • memory/2524-18-0x0000000002090000-0x0000000002157000-memory.dmp

      Filesize

      796KB

    • memory/2524-1-0x0000000000260000-0x0000000000261000-memory.dmp

      Filesize

      4KB

    • memory/2524-43-0x0000000000400000-0x00000000004C7000-memory.dmp

      Filesize

      796KB

    • memory/2764-27-0x0000000000400000-0x00000000004C7000-memory.dmp

      Filesize

      796KB

    • memory/2764-29-0x0000000000400000-0x00000000004C7000-memory.dmp

      Filesize

      796KB

    • memory/2764-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB