Analysis

  • max time kernel
    140s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2024 20:13

General

  • Target

    906ac205366ee08598f28907939ae310_JaffaCakes118.exe

  • Size

    348KB

  • MD5

    906ac205366ee08598f28907939ae310

  • SHA1

    a9af3927dcf8f5d6d3ccebfd721689c771bed311

  • SHA256

    e2373a7541c1807e504c043158fbe94edad6ba6e0901c4a4f7142a27c7c77b27

  • SHA512

    3a7dbb1984a0845b22e14383e4ac3573a503a136a65ea904c129c9f27632367fb64bc42190b81e2fa073cdfcf7696a36e90263b4fcba9d811b647d9cab1abbb1

  • SSDEEP

    6144:VFjL41SWW+Yta+ySQ+GyoCZUdzlEOVciyGCE+riGDAGxZKcJv6Msx/BGbF:VFjs1SWpY/ySBVoCmdzlEqciy+yiGhZD

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modiloader family
  • ModiLoader Second Stage 7 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\906ac205366ee08598f28907939ae310_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\906ac205366ee08598f28907939ae310_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4836
    • C:\fff2.exe
      "C:\fff2.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1300
    • C:\J3qbFH8P8.exe
      "C:\J3qbFH8P8.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4672
      • C:\J3qbFH8P8.exe
        "C:\J3qbFH8P8.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3396
        • C:\Windows\server.exe
          "C:\Windows\server.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1880
          • C:\Windows\server.exe
            "C:\Windows\server.exe"
            5⤵
            • Modifies WinLogon for persistence
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3276
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              6⤵
                PID:4336
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c \melt.bat
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4516
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c \melt.bat
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2764
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c \melt.bat
        2⤵
        • System Location Discovery: System Language Discovery
        PID:4400

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\J3qbFH8P8.exe

      Filesize

      220KB

      MD5

      144dec755361311d15dce9b03d368d01

      SHA1

      4d331cb6d916d997ee0d14faa1ae8dded71b02c8

      SHA256

      98e284e33c2b8aaa654fe78b5586dbfd10c45b694415c9fe7718feeab4f4ca25

      SHA512

      d2fa423ca1dd8c6dac906ba640812686d6260120870b5878dcce00ef0d67229872eb6104d1e8caf043d9d8a38d28699c2b491d271f1d16839d631f9102130993

    • C:\fff2.exe

      Filesize

      54KB

      MD5

      116d27fdf50ebecaada14096812dbf90

      SHA1

      5af91f4129b2e38f8decd50c8b0cc5d09c042bf1

      SHA256

      3ed5f41bad3acaf3eb8507d61b70c75c84e18febe06ebd482f3c366edcec394c

      SHA512

      e98eb844f4ddf74cccab1a14ea1a03accc3c2e0daa02aeb32d4718dbbb547ba80dbcd0d8469aed4d0f4fbb6949ddfe5e70fff099651d69d9fe8d2047b54b7c2a

    • C:\melt.bat

      Filesize

      249B

      MD5

      24d5fb2e5b97df704f946dc8ec093d6e

      SHA1

      cc2fe26222bf0dbe633d7b977c663aa8c3e59cb0

      SHA256

      7a9efa8448c4fb0c7e535d50e1d38d28709e22dc3e8598d348a956c7325afe72

      SHA512

      e84f379a6928649811bbe1134ecea6454f44077dda8c157720baa0a38b4dfd85ff54a9f8b90d289564d664b0a4d11400afbb1c3b4ca43051956d999e0df5ddf2

    • C:\melt.bat

      Filesize

      123B

      MD5

      58a67e1781a193dcf2f9f0685426380d

      SHA1

      8ce90e1df11d529112abb400b930dcfc73d78fce

      SHA256

      229cfb10926e706af01042a8348a9a910cfad0cb0aa9bc20c65e8dec0f006136

      SHA512

      598349435ac6abe93fab69891f33a7cb2c1d47184398c867eed8b057ee9b045e20865e79a839762f465a27c05efdd21d30caa1dc262c03321804513eef66e05a

    • memory/1300-21-0x0000000000400000-0x0000000000439000-memory.dmp

      Filesize

      228KB

    • memory/1300-71-0x0000000000400000-0x0000000000439000-memory.dmp

      Filesize

      228KB

    • memory/3276-60-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/3276-61-0x0000000010410000-0x0000000010455000-memory.dmp

      Filesize

      276KB

    • memory/3276-62-0x0000000010410000-0x0000000010455000-memory.dmp

      Filesize

      276KB

    • memory/3276-68-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/3396-36-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/3396-34-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/3396-35-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/3396-29-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/3396-49-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB