Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
15/10/2024, 02:08
General
-
Target
454cc610e7f352fe730059c05dfe51f4_JaffaCakes118.exe
-
Size
283KB
-
MD5
454cc610e7f352fe730059c05dfe51f4
-
SHA1
bd799df80046ef5bcc69aa490ab32bf8205d835e
-
SHA256
d4dacb6c5b36f0919b29fda9f4b18b2e24787cbc262d08a125f0223ee3ea8138
-
SHA512
dacba42b63a008fbbf37d4f64514f04dfcf2799026e7fe6f5a578322a730539fd6bf7725b9bff171abc15c53ae95eb0146c7441d1f75119b7f22eaa592deb4d5
-
SSDEEP
6144:WAsBZK+ykLkSxMJpFreV4LFZ6npt+lLHLj1QfC4T8BTFh4OEIPU1l3UCjses/R3:T+ykLkwMl6WLFkSLHLjK7oTFxc1l3vM5
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
-
ModiLoader Second Stage 46 IoCs
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Modifies registry class 7 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\454cc610e7f352fe730059c05dfe51f4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\454cc610e7f352fe730059c05dfe51f4_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\454cc610e7f352fe730059c05dfe51f4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\454cc610e7f352fe730059c05dfe51f4_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\mshta.exe"C:\Windows\system32\mshta.exe" javascript:emxPx99duw="nBTvos";A2g=new%20ActiveXObject("WScript.Shell");LaAh5tFN="aa3";kkU4H=A2g.RegRead("HKLM\\software\\Wow6432Node\\vwOzDI\\cAgBUHwCs");wjZa4oP4="qEUDVZjot";eval(kkU4H);U9u0mZZxM="yV";1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:ekwsr2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Adds policy Run key to start application
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5883eff06ac96966270731e4e22817e11
SHA1523c87c98236cbc04430e87ec19b977595092ac8
SHA25644e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82
SHA51260333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390
-
Filesize
48KB
MD54c3798bce21134782f690a2bbb1b1252
SHA191d76bea0cdafb5d40a2fb9b66810ebe7e94a344
SHA256f47aaf953a2e082e921025f7407a1ace17e893b3d7d7d0752e0c91bbf3b8a23b
SHA5124e12aff60aa0f298d6be13a5c9586ad5c6b9eab986e26c2d0b2210b14b649db691f8a641e544ef42f11927c7a2022ffb632bce8d4c5f8fa01794994aca6584c4
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
4KB
-
Filesize
816KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
52KB
-
Filesize
816KB
-
Filesize
816KB