Analysis

  • max time kernel
    140s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-09-2024 01:28

General

  • Target

    eed02915913c93f4803c5a73355e3f6d_JaffaCakes118.exe

  • Size

    1.4MB

  • MD5

    eed02915913c93f4803c5a73355e3f6d

  • SHA1

    ff6545c958fbe1d4bc5a0e6358e98f8caac4fd54

  • SHA256

    2849b86afd181845a44fec47757e6e28779e63b8a4b69b74ed9c5b51b79b4bd3

  • SHA512

    d6900c4048b2dc4491746cf5463b2e1f2d0dfe8dc43789291914b0d04ba6c4a772b8656d2f5f04a26ea9c53b7518648ec3448260ebc24b7b4ebac0674ae27ef9

  • SSDEEP

    24576:oWj1c3bhxuC2mG/89P3TvLmFNcZKL7R4vk0eheDxeQ9Mzlsn+eW0:oW+rh2m/9PmFNcMS7ehup9/+0

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • UAC bypass 3 TTPs 1 IoCs
  • ModiLoader Second Stage 19 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • UPX packed file 22 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eed02915913c93f4803c5a73355e3f6d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eed02915913c93f4803c5a73355e3f6d_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Users\Admin\AppData\Local\Temp\teste1.exe
      "C:\Users\Admin\AppData\Local\Temp\teste1.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2468
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2876

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\paranavip_2191_226.jpg

    Filesize

    78KB

    MD5

    acbc3c472c0f9c05973dd6fbb780d313

    SHA1

    e5f7648d2e1271e424e91fb4cca721e9e5e2ff13

    SHA256

    987c9ef2f887ab3e6d3fbe8ce9187107469ddf41eb436211436951486d005b75

    SHA512

    c6b2693e0391b4b9730d6e9e766eed8f8024168b331506e315dc7a88022f1b6460a3d95c6f022de6aae0c62f54cc418264020de5484e257c6484fc66d8b63b7f

  • \Users\Admin\AppData\Local\Temp\cmsetac.dll

    Filesize

    33KB

    MD5

    a051d2b068a39cf0ca7964e9d5582e24

    SHA1

    5267e606b75dcda068a46a8f6275c7aeeee07a46

    SHA256

    5cdb3bbcb2f22348c8671ce56f98379468acfa905b5af2172abe3bb625c93226

    SHA512

    89f6b1922be91ff92599b1b1b4fab9192c95b9787ee81c492770c254a44ce97128f4a8d8931130752bfe2f3356b70131bed8020620dcc80b6a3a378cc09590d2

  • \Users\Admin\AppData\Local\Temp\ntdtcstp.dll

    Filesize

    7KB

    MD5

    67587e25a971a141628d7f07bd40ffa0

    SHA1

    76fcd014539a3bb247cc0b761225f68bd6055f6b

    SHA256

    e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

    SHA512

    6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

  • \Users\Admin\AppData\Local\Temp\teste1.exe

    Filesize

    108KB

    MD5

    3befaff6e530f4209ad5c7b78701217e

    SHA1

    49271e83a37d3d49d36e7e8d4db90489657ce9b7

    SHA256

    afae375c32162f3df6ec4612814f2fa74b55e429f91c33464b12862298d1f722

    SHA512

    8745eb8eb7c142c957bf0bffb776257b3d1b02a9dee7edb5535d7ea6329cd12bc05b83f29fdec534ac496f98d2406ff2e0864e69f77af1204a4f821e140e98a9

  • memory/2380-9-0x00000000049F0000-0x0000000004A40000-memory.dmp

    Filesize

    320KB

  • memory/2380-2-0x0000000000401000-0x0000000000407000-memory.dmp

    Filesize

    24KB

  • memory/2380-32-0x0000000004A30000-0x0000000004A32000-memory.dmp

    Filesize

    8KB

  • memory/2380-39-0x0000000000401000-0x0000000000407000-memory.dmp

    Filesize

    24KB

  • memory/2380-37-0x0000000000400000-0x0000000000536000-memory.dmp

    Filesize

    1.2MB

  • memory/2380-0-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2380-1-0x0000000000540000-0x0000000000627000-memory.dmp

    Filesize

    924KB

  • memory/2380-38-0x0000000004A40000-0x0000000004A4E000-memory.dmp

    Filesize

    56KB

  • memory/2380-29-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2380-36-0x0000000004A40000-0x0000000004A4E000-memory.dmp

    Filesize

    56KB

  • memory/2468-25-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2468-45-0x0000000000280000-0x0000000000288000-memory.dmp

    Filesize

    32KB

  • memory/2468-96-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2468-34-0x00000000775E0000-0x00000000776D0000-memory.dmp

    Filesize

    960KB

  • memory/2468-92-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2468-88-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2468-23-0x00000000025B0000-0x00000000025BE000-memory.dmp

    Filesize

    56KB

  • memory/2468-21-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2468-16-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2468-41-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2468-42-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2468-43-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2468-44-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2468-84-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2468-46-0x00000000025B0000-0x00000000025BE000-memory.dmp

    Filesize

    56KB

  • memory/2468-80-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2468-48-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2468-52-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2468-56-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2468-60-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2468-64-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2468-68-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2468-72-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2468-76-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2876-33-0x00000000001D0000-0x00000000001D2000-memory.dmp

    Filesize

    8KB

  • memory/2876-47-0x0000000000100000-0x000000000010E000-memory.dmp

    Filesize

    56KB

  • memory/2876-30-0x00000000775F0000-0x00000000775F1000-memory.dmp

    Filesize

    4KB

  • memory/2876-28-0x0000000000100000-0x000000000010E000-memory.dmp

    Filesize

    56KB

  • memory/2876-31-0x00000000775E0000-0x00000000776D0000-memory.dmp

    Filesize

    960KB