Analysis
-
max time kernel
92s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26/09/2024, 04:59 UTC
Static task
static1
Behavioral task
behavioral1
Sample
f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe
-
Size
605KB
-
MD5
f79dfbc3b8a8f8b9fd83e46883702f87
-
SHA1
05a6e85d01fa03ba78d592bb3c989a5ab1c0d21b
-
SHA256
64673f314e82337483b9fac8800a4ed11f8b05d70410d504c27a8d5406c0fea9
-
SHA512
bfea7d05105d6e2577665afd5a26f29d5dff53ff7d4e2b7e40debf39c0844070fc7b648648bd0645fbf2feb874979c778ebf89d8550ae2b4dc89d828ea707135
-
SSDEEP
12288:2rsWE6q36UnEFqHZtZbVp1VhbkSp3OeiHequ3GqXHnP3wNmz:24yUnn55bbkSp3Oeibu3GUHPwNmz
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral2/memory/4744-11-0x00000000033F0000-0x00000000034F0000-memory.dmp modiloader_stage2 behavioral2/memory/4744-66-0x0000000000400000-0x00000000005AA000-memory.dmp modiloader_stage2 -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe File opened (read-only) \??\T: f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe File opened (read-only) \??\U: f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe File opened (read-only) \??\X: f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe File opened (read-only) \??\B: f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe File opened (read-only) \??\E: f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe File opened (read-only) \??\G: f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe File opened (read-only) \??\J: f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe File opened (read-only) \??\M: f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe File opened (read-only) \??\R: f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe File opened (read-only) \??\S: f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe File opened (read-only) \??\W: f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe File opened (read-only) \??\V: f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe File opened (read-only) \??\Y: f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe File opened (read-only) \??\H: f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe File opened (read-only) \??\I: f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe File opened (read-only) \??\L: f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe File opened (read-only) \??\Q: f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe File opened (read-only) \??\Z: f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe File opened (read-only) \??\A: f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe File opened (read-only) \??\K: f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe File opened (read-only) \??\N: f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe File opened (read-only) \??\O: f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\AutoRun.inf f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe File opened for modification F:\AutoRun.inf f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\paramstr.txt f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4744 wrote to memory of 2432 4744 f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe 82 PID 4744 wrote to memory of 2432 4744 f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f79dfbc3b8a8f8b9fd83e46883702f87_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"2⤵PID:2432
-
Network
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTRResponse88.210.23.2.in-addr.arpaIN PTRa2-23-210-88deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request68.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request100.209.201.84.in-addr.arpaIN PTRResponse
-
73 B 147 B 1 1
DNS Request
104.219.191.52.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
88.210.23.2.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
68.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
73 B 159 B 1 1
DNS Request
228.249.119.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
209.205.72.20.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
50.23.12.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
73 B 133 B 1 1
DNS Request
100.209.201.84.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
163B
MD5b440eed00f70b8fff8c6e70e518a50fd
SHA127458e044aa79761ea671de12b059adf4cc2178f
SHA256514afe9d37b54efc5d45596a17562d81e998bb3c2e2c296c9f7fcf7fec8ee054
SHA512b4a82119a6614d5a4b96d38ab688c27edcf09f5e667dda3edf850f6b3ba170b2b668b5bc98d4ac041d911f42e129f848aa8b362a83e8ea4241e3dac355d7c850