Analysis
-
max time kernel
149s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-09-2024 21:43
Behavioral task
behavioral1
Sample
f6ea610a088218bfee3becf2c10755f2_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
f6ea610a088218bfee3becf2c10755f2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
f6ea610a088218bfee3becf2c10755f2_JaffaCakes118.exe
-
Size
150KB
-
MD5
f6ea610a088218bfee3becf2c10755f2
-
SHA1
5cabef731a2f3531030af4f3196e5f5facac950a
-
SHA256
d489852754a270928b578dde7cff0c1fe0ecc7bf5ee4db18f11ccffddbfd3921
-
SHA512
a2f19f78806255046cb1ac32a02aaedba9dc2062f368549c690e63a55af1ec0283338aa23d0caad0d9b8aedba18ad6d512fb5d6974ee6bffcb7bd904c1220b81
-
SSDEEP
1536:ODCu9DxTCSNKkaEOdWGVXKQZ9KOplCKFQsARH2Qfl+aJ7rFa+jF8d75W01DjaWFe:ODCuZBP4kQZbXQRH2mlj7ud7s01Djo
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "userinit.exe,C:\\Windows\\apocalyps32.exe" apocalyps32.exe -
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral1/memory/2732-253-0x0000000040010000-0x000000004004C000-memory.dmp modiloader_stage2 behavioral1/memory/2732-263-0x0000000040010000-0x000000004004C000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
pid Process 2180 apocalyps32.exe 2732 apocalyps32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\apocalyps32 = "C:\\Windows\\apocalyps32.exe" apocalyps32.exe -
resource yara_rule behavioral1/memory/396-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/396-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2180-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d000000012251-5.dat upx behavioral1/memory/2180-17-0x00000000002D0000-0x00000000002F7000-memory.dmp upx behavioral1/memory/2180-10-0x0000000040010000-0x000000004004C000-memory.dmp upx behavioral1/memory/2180-252-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2732-253-0x0000000040010000-0x000000004004C000-memory.dmp upx behavioral1/memory/2732-263-0x0000000040010000-0x000000004004C000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\apocalyps32.exe f6ea610a088218bfee3becf2c10755f2_JaffaCakes118.exe File opened for modification C:\Windows\apocalyps32.exe f6ea610a088218bfee3becf2c10755f2_JaffaCakes118.exe File created C:\Windows\apocalyps32.exe apocalyps32.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f6ea610a088218bfee3becf2c10755f2_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language apocalyps32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language apocalyps32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2732 apocalyps32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 396 wrote to memory of 2180 396 f6ea610a088218bfee3becf2c10755f2_JaffaCakes118.exe 29 PID 396 wrote to memory of 2180 396 f6ea610a088218bfee3becf2c10755f2_JaffaCakes118.exe 29 PID 396 wrote to memory of 2180 396 f6ea610a088218bfee3becf2c10755f2_JaffaCakes118.exe 29 PID 396 wrote to memory of 2180 396 f6ea610a088218bfee3becf2c10755f2_JaffaCakes118.exe 29 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30 PID 2180 wrote to memory of 2732 2180 apocalyps32.exe 30
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\f6ea610a088218bfee3becf2c10755f2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f6ea610a088218bfee3becf2c10755f2_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\apocalyps32.exe-bs3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\apocalyps32.exe"C:\Windows\apocalyps32.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2732
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
150KB
MD5f6ea610a088218bfee3becf2c10755f2
SHA15cabef731a2f3531030af4f3196e5f5facac950a
SHA256d489852754a270928b578dde7cff0c1fe0ecc7bf5ee4db18f11ccffddbfd3921
SHA512a2f19f78806255046cb1ac32a02aaedba9dc2062f368549c690e63a55af1ec0283338aa23d0caad0d9b8aedba18ad6d512fb5d6974ee6bffcb7bd904c1220b81