Analysis
-
max time kernel
144s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 04:55
Static task
static1
Behavioral task
behavioral1
Sample
eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe
-
Size
832KB
-
MD5
eaa01b9d636573406e09ba88df1a1269
-
SHA1
71edf1f5b36fdc2d6d8f0768a021dc3a9fda7abc
-
SHA256
1fd55c8a7cb2c2fedf9355bf287f2c74cca66adb92fa5e6b5b1973ce790bcf3c
-
SHA512
ccb9f057e634042a114d4259df4a632edf6f490f28bd663b73dbd673b4d6909a74a9d9f6e01a3ed6c8a6cb5484277deaeb9746481ade87b59a968c8b70b4ae68
-
SSDEEP
24576:Buc//////ilkVJirwzUn/dl//o7dQKIm0+hIcaIVXLPR5D:Buc//////jfzU/ddg7dR04IcfLZB
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral1/memory/2172-4-0x0000000000400000-0x00000000004BF000-memory.dmp modiloader_stage2 -
resource yara_rule behavioral1/memory/2160-12-0x0000000000400000-0x000000000059B000-memory.dmp upx behavioral1/memory/2160-14-0x0000000000400000-0x000000000059B000-memory.dmp upx behavioral1/memory/2160-9-0x0000000000400000-0x000000000059B000-memory.dmp upx behavioral1/memory/2160-19-0x0000000000400000-0x000000000059B000-memory.dmp upx behavioral1/memory/2160-20-0x0000000000400000-0x000000000059B000-memory.dmp upx behavioral1/memory/2160-21-0x0000000000400000-0x000000000059B000-memory.dmp upx behavioral1/memory/2160-22-0x0000000000400000-0x000000000059B000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe File opened (read-only) \??\G: eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe File opened (read-only) \??\I: eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe File opened (read-only) \??\P: eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe File opened (read-only) \??\Q: eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe File opened (read-only) \??\R: eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe File opened (read-only) \??\L: eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe File opened (read-only) \??\U: eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe File opened (read-only) \??\Y: eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe File opened (read-only) \??\A: eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe File opened (read-only) \??\B: eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe File opened (read-only) \??\E: eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe File opened (read-only) \??\J: eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe File opened (read-only) \??\K: eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe File opened (read-only) \??\H: eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe File opened (read-only) \??\N: eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe File opened (read-only) \??\O: eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe File opened (read-only) \??\T: eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe File opened (read-only) \??\X: eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe File opened (read-only) \??\M: eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe File opened (read-only) \??\S: eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe File opened (read-only) \??\W: eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe File opened (read-only) \??\Z: eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2280 set thread context of 2172 2280 eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe 31 PID 2280 set thread context of 2160 2280 eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe 32 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC}\Control regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C73-067D-11D0-95D8-00A02463AB28}\TypeLib\ = "{0E59F1D2-1FBE-11D0-8FF2-00A0D10038BC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C70-067D-11D0-95D8-00A02463AB28} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C78-067D-11D0-95D8-00A02463AB28}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8B167D60-8605-11D0-ABCB-00A0C90FFFC0}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC}\ToolboxBitmap32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C70-067D-11D0-95D8-00A02463AB28}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C78-067D-11D0-95D8-00A02463AB28}\ = "IScriptError" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E59F1D3-1FBE-11D0-8FF2-00A0D10038BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8B167D60-8605-11D0-ABCB-00A0C90FFFC0}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSScriptControl.ScriptControl.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C73-067D-11D0-95D8-00A02463AB28}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C73-067D-11D0-95D8-00A02463AB28}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C71-067D-11D0-95D8-00A02463AB28}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8B167D60-8605-11D0-ABCB-00A0C90FFFC0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C71-067D-11D0-95D8-00A02463AB28}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C6F-067D-11D0-95D8-00A02463AB28}\ = "IScriptModuleCollection" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C6F-067D-11D0-95D8-00A02463AB28}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C78-067D-11D0-95D8-00A02463AB28}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC}\MiscStatus\1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8B167D60-8605-11D0-ABCB-00A0C90FFFC0}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C6F-067D-11D0-95D8-00A02463AB28}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ScriptControl\CurVer\ = "MSScriptControl.ScriptControl.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC}\MiscStatus regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C71-067D-11D0-95D8-00A02463AB28} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C70-067D-11D0-95D8-00A02463AB28}\TypeLib\ = "{0E59F1D2-1FBE-11D0-8FF2-00A0D10038BC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSScriptControl.ScriptControl\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSScriptControl.ScriptControl.1\ = "ScriptControl Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8B167D60-8605-11D0-ABCB-00A0C90FFFC0}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ScriptControl\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C73-067D-11D0-95D8-00A02463AB28}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C71-067D-11D0-95D8-00A02463AB28}\TypeLib\ = "{0E59F1D2-1FBE-11D0-8FF2-00A0D10038BC}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C71-067D-11D0-95D8-00A02463AB28}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C73-067D-11D0-95D8-00A02463AB28}\ = "IScriptProcedure" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C6F-067D-11D0-95D8-00A02463AB28} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C78-067D-11D0-95D8-00A02463AB28}\TypeLib\ = "{0E59F1D2-1FBE-11D0-8FF2-00A0D10038BC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E59F1D3-1FBE-11D0-8FF2-00A0D10038BC} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSScriptControl.ScriptControl regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C73-067D-11D0-95D8-00A02463AB28} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E59F1D3-1FBE-11D0-8FF2-00A0D10038BC}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E59F1D3-1FBE-11D0-8FF2-00A0D10038BC}\TypeLib\ = "{0E59F1D2-1FBE-11D0-8FF2-00A0D10038BC}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ScriptControl\ = "ScriptControl Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8B167D60-8605-11D0-ABCB-00A0C90FFFC0}\ = "DScriptControlSource" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ScriptControl\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C6F-067D-11D0-95D8-00A02463AB28}\TypeLib\ = "{0E59F1D2-1FBE-11D0-8FF2-00A0D10038BC}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E59F1D3-1FBE-11D0-8FF2-00A0D10038BC}\ = "IScriptControl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C71-067D-11D0-95D8-00A02463AB28}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C70-067D-11D0-95D8-00A02463AB28}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8B167D60-8605-11D0-ABCB-00A0C90FFFC0}\TypeLib\ = "{0E59F1D2-1FBE-11D0-8FF2-00A0D10038BC}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C71-067D-11D0-95D8-00A02463AB28}\ = "IScriptProcedureCollection" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C70-067D-11D0-95D8-00A02463AB28}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70841C78-067D-11D0-95D8-00A02463AB28}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E59F1D3-1FBE-11D0-8FF2-00A0D10038BC}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSScriptControl.ScriptControl\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC}\ProgID regsvr32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2160 eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe 2160 eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2172 2280 eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe 31 PID 2280 wrote to memory of 2172 2280 eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe 31 PID 2280 wrote to memory of 2172 2280 eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe 31 PID 2280 wrote to memory of 2172 2280 eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe 31 PID 2280 wrote to memory of 2172 2280 eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe 31 PID 2280 wrote to memory of 2172 2280 eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe 31 PID 2280 wrote to memory of 2160 2280 eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe 32 PID 2280 wrote to memory of 2160 2280 eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe 32 PID 2280 wrote to memory of 2160 2280 eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe 32 PID 2280 wrote to memory of 2160 2280 eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe 32 PID 2280 wrote to memory of 2160 2280 eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe 32 PID 2280 wrote to memory of 2160 2280 eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe 32 PID 2160 wrote to memory of 2864 2160 eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe 33 PID 2160 wrote to memory of 2864 2160 eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe 33 PID 2160 wrote to memory of 2864 2160 eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe 33 PID 2160 wrote to memory of 2864 2160 eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe 33 PID 2160 wrote to memory of 2864 2160 eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe 33 PID 2160 wrote to memory of 2864 2160 eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe 33 PID 2160 wrote to memory of 2864 2160 eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe2⤵PID:2172
-
-
C:\Users\Admin\AppData\Local\Temp\eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\eaa01b9d636573406e09ba88df1a1269_JaffaCakes118.exe2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s msscript.ocx3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2864
-
-