Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2024, 12:16

General

  • Target

    a7d03bacb5e4add586615998c76a9846_JaffaCakes118.exe

  • Size

    140KB

  • MD5

    a7d03bacb5e4add586615998c76a9846

  • SHA1

    ecfee0ce76a29a88b0b76efc1d89685ad2485adb

  • SHA256

    1ec5f3602547475192ddbab52e0b307c263477a04389de082b61f2057fc82b49

  • SHA512

    3aecfe5dccbdaa7cf0848040e7ffa222ee25171ed15695d800c8aaf26925f983b497c96bfa5004805629949f11434bbae7e3c032cade5d8e54c92a44a21e84c5

  • SSDEEP

    3072:HuepxZYYYYYYYYYYYUNHCtFQUdSo3cWmyYYHLZyESW/4697G:9pPYYYYYYYYYYYUNSyESJdyqESQJ

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3520
      • C:\Users\Admin\AppData\Local\Temp\a7d03bacb5e4add586615998c76a9846_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\a7d03bacb5e4add586615998c76a9846_JaffaCakes118.exe"
        2⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1412
        • C:\Users\Admin\AppData\Local\Temp\Tafali.exe
          "C:\Users\Admin\AppData\Local\Temp\Tafali.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1924
          • C:\Users\Admin\AppData\Local\Temp\Tafali.exe
            "C:\Users\Admin\AppData\Local\Temp\Tafali.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3200

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Tafali.exe

      Filesize

      76KB

      MD5

      997e0aeef6e13254333e3d4168c50549

      SHA1

      bc791977e962077794ec179ad4a74bca2990d0b0

      SHA256

      436ae508a4c9eb67139b150de6f035946ef8b30117e0b82390c2018db9b7deea

      SHA512

      cc0cd6f665299c8671cfd5efdf24ea46931bc004196c168d82643165a95da23a54909d7c68981967bff453a206caa06bbd98150cd0ede17aba546a10035b6fff

    • memory/1412-9-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

    • memory/3200-11-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/3200-12-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/3200-13-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/3200-19-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/3520-14-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

      Filesize

      28KB

    • memory/3520-15-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

      Filesize

      4KB