Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-09-2024 15:59
Behavioral task
behavioral1
Sample
e086ed8a858266773d6197e1c703abbe_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
e086ed8a858266773d6197e1c703abbe_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
e086ed8a858266773d6197e1c703abbe_JaffaCakes118.exe
-
Size
124KB
-
MD5
e086ed8a858266773d6197e1c703abbe
-
SHA1
840c8e61a85d4973e2125d49de18038302c3b8db
-
SHA256
85112644680f17d463d585e03196d4c691146d14ea561650680d91fef2f708dc
-
SHA512
2ef900fc94260d8f92e1377110f21955e1d658235b64f3d4c08c0e430bbf52c2eb9afc913ebd5919e3f4921f0e6d3b9215722fc113e17d9b7d18f3f663b2522c
-
SSDEEP
1536:fayvRUVU3aH/gcTnwuwCaTVLnp/wyo6ijxgUz3hMDwkdqxAAlktq5zm90YB1:SeCeGPMLndtijxJznkdqxAAlR5S90
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = ",C:\\Windows\\apocalyps32.exe" apocalyps32.exe -
ModiLoader Second Stage 7 IoCs
resource yara_rule behavioral2/memory/1512-65-0x0000000040010000-0x000000004004B000-memory.dmp modiloader_stage2 behavioral2/memory/1512-62-0x0000000040010000-0x000000004004B000-memory.dmp modiloader_stage2 behavioral2/memory/1512-66-0x0000000040010000-0x000000004004B000-memory.dmp modiloader_stage2 behavioral2/memory/1512-67-0x0000000040010000-0x000000004004B000-memory.dmp modiloader_stage2 behavioral2/memory/1512-68-0x0000000040010000-0x000000004004B000-memory.dmp modiloader_stage2 behavioral2/memory/1512-71-0x0000000040010000-0x000000004004B000-memory.dmp modiloader_stage2 behavioral2/memory/1512-73-0x0000000040010000-0x000000004004B000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
pid Process 4924 apocalyps32.exe 1512 apocalyps32.exe -
resource yara_rule behavioral2/memory/1600-0-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/files/0x0005000000022f92-3.dat upx behavioral2/memory/1600-6-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/memory/4924-7-0x0000000040010000-0x000000004004B000-memory.dmp upx behavioral2/memory/1512-29-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/memory/4924-27-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/memory/4924-58-0x0000000040010000-0x000000004004B000-memory.dmp upx behavioral2/memory/4924-64-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/memory/1512-65-0x0000000040010000-0x000000004004B000-memory.dmp upx behavioral2/memory/1512-62-0x0000000040010000-0x000000004004B000-memory.dmp upx behavioral2/memory/1512-66-0x0000000040010000-0x000000004004B000-memory.dmp upx behavioral2/memory/1512-67-0x0000000040010000-0x000000004004B000-memory.dmp upx behavioral2/memory/1512-68-0x0000000040010000-0x000000004004B000-memory.dmp upx behavioral2/memory/1512-71-0x0000000040010000-0x000000004004B000-memory.dmp upx behavioral2/memory/1512-73-0x0000000040010000-0x000000004004B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\apocalyps32 = "C:\\Windows\\apocalyps32.exe" apocalyps32.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\apocalyps32.exe e086ed8a858266773d6197e1c703abbe_JaffaCakes118.exe File opened for modification C:\Windows\apocalyps32.exe e086ed8a858266773d6197e1c703abbe_JaffaCakes118.exe File created C:\Windows\apocalyps32.exe apocalyps32.exe File opened for modification C:\Windows\ap0calypse_71FB52F8\ServerLogs\Admin\14-09-2024 apocalyps32.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language apocalyps32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e086ed8a858266773d6197e1c703abbe_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language apocalyps32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1512 apocalyps32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1512 apocalyps32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1600 wrote to memory of 4924 1600 e086ed8a858266773d6197e1c703abbe_JaffaCakes118.exe 88 PID 1600 wrote to memory of 4924 1600 e086ed8a858266773d6197e1c703abbe_JaffaCakes118.exe 88 PID 1600 wrote to memory of 4924 1600 e086ed8a858266773d6197e1c703abbe_JaffaCakes118.exe 88 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89 PID 4924 wrote to memory of 1512 4924 apocalyps32.exe 89
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\e086ed8a858266773d6197e1c703abbe_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e086ed8a858266773d6197e1c703abbe_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\apocalyps32.exe-bs3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\apocalyps32.exe"C:\Windows\apocalyps32.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1512
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5e086ed8a858266773d6197e1c703abbe
SHA1840c8e61a85d4973e2125d49de18038302c3b8db
SHA25685112644680f17d463d585e03196d4c691146d14ea561650680d91fef2f708dc
SHA5122ef900fc94260d8f92e1377110f21955e1d658235b64f3d4c08c0e430bbf52c2eb9afc913ebd5919e3f4921f0e6d3b9215722fc113e17d9b7d18f3f663b2522c