Analysis

  • max time kernel
    91s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2024, 15:23

General

  • Target

    b220724a2e9600b554ccd887c7a39880_JaffaCakes118.exe

  • Size

    444KB

  • MD5

    b220724a2e9600b554ccd887c7a39880

  • SHA1

    36b799acdaf3870f51aaa229b1c4033d554a72e1

  • SHA256

    ea36623677d38a1901dbc5405f1087e62b1ead90a65401387bbbfeb8be850e40

  • SHA512

    d3f154e024f69168ce0e1564a888d42f981029a9ef30c747d4321a7fa46e87be9f1d26e57e5d7625675ecd459556bfc0d2528a4fef0951d727c7a42187b0456d

  • SSDEEP

    12288:SV+mzFHYEt+UmeGhiHbT613/p0thOYxG26sh+VR:S83x4GYbTWSthG2B+VR

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b220724a2e9600b554ccd887c7a39880_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b220724a2e9600b554ccd887c7a39880_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1804
    • C:\Program Files (x86)\%system%\QQ.exe
      "C:\Program Files (x86)\%system%\QQ.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4796

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\%system%\QQ.exe

    Filesize

    37KB

    MD5

    b41cf0e0cff16ad5c5c46ca0cc72c8b4

    SHA1

    a7cc123dadbaf7d2811b524fa80d4fcbff967973

    SHA256

    007047c0a03878eb4e81f526f0ff4006d96bcac955ba7f398758b18467986256

    SHA512

    813f64e368e7c7a03d8f0d8b4e7cb67065aeaa27ba174d77b118fc5d2ccfea9661fc48e8013bb92c9cd2ca6446c15573e3c028d9f641b91f065d6e3f30116af8

  • C:\Program Files\Common Files\microsoft shared\MSInfo\atmQQ2.dll

    Filesize

    20KB

    MD5

    33cb3dcfbde8200a0144f98a46467f14

    SHA1

    a95ec9ed18295dd2e4ae46ac8731c97d90a11c90

    SHA256

    92638efda9726a9ecd2f235e603614aa1c7e01d1789b15f8430c92e9e9823f97

    SHA512

    b25f1d7ff5856c69f124d6294ac792c9a73f04fe196a55ccb94870084e1a0de1decf6444086b5efba087f34a332074e61081ea97d3d4225f0cc9f79cb7743c9e

  • memory/1804-13-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/4796-10-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/4796-12-0x00000000001C0000-0x0000000000200000-memory.dmp

    Filesize

    256KB

  • memory/4796-14-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/4796-15-0x00000000001C0000-0x0000000000200000-memory.dmp

    Filesize

    256KB

  • memory/4796-22-0x00000000004B0000-0x00000000004D3000-memory.dmp

    Filesize

    140KB

  • memory/4796-23-0x00000000004B0000-0x00000000004D3000-memory.dmp

    Filesize

    140KB

  • memory/4796-24-0x00000000004B0000-0x00000000004D3000-memory.dmp

    Filesize

    140KB