Analysis
-
max time kernel
137s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31-10-2024 11:34
Static task
static1
Behavioral task
behavioral1
Sample
82d8f19d1a4521e86922988eced2e240_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
82d8f19d1a4521e86922988eced2e240_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
82d8f19d1a4521e86922988eced2e240_JaffaCakes118.exe
-
Size
791KB
-
MD5
82d8f19d1a4521e86922988eced2e240
-
SHA1
9d5728039b7444f048787e6c06b095af79d24ff8
-
SHA256
70f265c0d8d925fc1a497e47eaa00cb96f0ec0207caf07633f87326e7604c476
-
SHA512
06eaa34a24a9df9cd2ad800aa5a52588b247c6707fb40a6213b7aaf3f97745aabc2bdb5065c74158ae9480c5dd5f43c6c1a993e87e03fc70d51e250a7c3ac07a
-
SSDEEP
24576:9bDtVhyrtEYq6pUj8XaHhwtkkIqTf9XnkA16o:7VMtEIyAKQIq1X6o
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4572-8-0x0000000000400000-0x000000000057D000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
WINHEL~1.EXEpid Process 4572 WINHEL~1.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
82d8f19d1a4521e86922988eced2e240_JaffaCakes118.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 82d8f19d1a4521e86922988eced2e240_JaffaCakes118.exe -
Drops file in Program Files directory 1 IoCs
Processes:
WINHEL~1.EXEdescription ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\Fiele Ps.txt WINHEL~1.EXE -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 1164 4572 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
82d8f19d1a4521e86922988eced2e240_JaffaCakes118.exeWINHEL~1.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82d8f19d1a4521e86922988eced2e240_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINHEL~1.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
82d8f19d1a4521e86922988eced2e240_JaffaCakes118.exeWINHEL~1.EXEdescription pid Process procid_target PID 2392 wrote to memory of 4572 2392 82d8f19d1a4521e86922988eced2e240_JaffaCakes118.exe 84 PID 2392 wrote to memory of 4572 2392 82d8f19d1a4521e86922988eced2e240_JaffaCakes118.exe 84 PID 2392 wrote to memory of 4572 2392 82d8f19d1a4521e86922988eced2e240_JaffaCakes118.exe 84 PID 4572 wrote to memory of 424 4572 WINHEL~1.EXE 91 PID 4572 wrote to memory of 424 4572 WINHEL~1.EXE 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\82d8f19d1a4521e86922988eced2e240_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82d8f19d1a4521e86922988eced2e240_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WINHEL~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WINHEL~1.EXE2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 5403⤵
- Program crash
PID:1164
-
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵PID:424
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4572 -ip 45721⤵PID:2084
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
737KB
MD58b8218c4b94e66c49e9e8973967b39d3
SHA16bbd54b7d20844f64217c999e697f34d569df899
SHA256f0a7af7a18424881334c20b061b458285d973b04ea83bf05e3e08e41d81a1b50
SHA51210d0ac05ae6c0c9c352b8667c1a5f4e94aec5c572c68f87d9b0812e619c732f50cd6ca61c44cd98d3bd02bee41ae16cf24afe0f400b8e163ae695af211b2e013