Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31-12-2024 04:01
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe
-
Size
152KB
-
MD5
03c222c69a38ae806d171b3a48fa2a5d
-
SHA1
633bda88fa088ef1f07e0dad0ee7c3e6d577efac
-
SHA256
3b155f1e387567be9b8d6c1d2c507dc0484c046b9b2c332617c1843cea04b7e2
-
SHA512
013e0272483bd4d4ae5346eb2bf132553ddd9794d055ccaa5e722f0513a9b129e7fccf7c5fc838a3075f9f77116eefc6215671a3d9afa320b00ed4138fdb2b55
-
SSDEEP
1536:c1DMz1DQvXLq6t7awFONecenlLnQHIG5R9c73P600t:9eGw9A0rC00t
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 3 IoCs
resource yara_rule behavioral1/memory/2844-791-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/2668-1486-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral1/memory/2668-1495-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Executes dropped EXE 8 IoCs
pid Process 2760 svhust.exe 2400 svhust.exe 2844 svhust.exe 2560 AdobeART.exe 1584 AdobeART.exe 280 svhust.exe 1076 svhust.exe 2668 svhust.exe -
Loads dropped DLL 12 IoCs
pid Process 1616 JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe 1616 JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe 1616 JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe 1616 JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe 2760 svhust.exe 2760 svhust.exe 2844 svhust.exe 2844 svhust.exe 2560 AdobeART.exe 1584 AdobeART.exe 1584 AdobeART.exe 1584 AdobeART.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhust = "C:\\Users\\Admin\\AppData\\Roaming\\svhust\\svhust.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeART = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeART.exe" svhust.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 2400 set thread context of 1616 2400 JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe 30 PID 2760 set thread context of 2400 2760 svhust.exe 35 PID 2760 set thread context of 2844 2760 svhust.exe 36 PID 2560 set thread context of 1584 2560 AdobeART.exe 38 PID 280 set thread context of 1076 280 svhust.exe 40 PID 280 set thread context of 2668 280 svhust.exe 41 -
resource yara_rule behavioral1/memory/1616-364-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1616-778-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2844-775-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/2844-791-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1584-1489-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2668-1486-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/2400-1492-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2668-1495-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1076-1494-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhust.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhust.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdobeART.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhust.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhust.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhust.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhust.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdobeART.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe Token: SeDebugPrivilege 1076 svhust.exe Token: SeDebugPrivilege 2400 svhust.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2400 JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe 1616 JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe 2760 svhust.exe 2400 svhust.exe 2560 AdobeART.exe 1584 AdobeART.exe 280 svhust.exe 1076 svhust.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2400 wrote to memory of 1616 2400 JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe 30 PID 2400 wrote to memory of 1616 2400 JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe 30 PID 2400 wrote to memory of 1616 2400 JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe 30 PID 2400 wrote to memory of 1616 2400 JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe 30 PID 2400 wrote to memory of 1616 2400 JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe 30 PID 2400 wrote to memory of 1616 2400 JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe 30 PID 2400 wrote to memory of 1616 2400 JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe 30 PID 2400 wrote to memory of 1616 2400 JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe 30 PID 1616 wrote to memory of 2732 1616 JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe 31 PID 1616 wrote to memory of 2732 1616 JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe 31 PID 1616 wrote to memory of 2732 1616 JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe 31 PID 1616 wrote to memory of 2732 1616 JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe 31 PID 2732 wrote to memory of 2844 2732 cmd.exe 33 PID 2732 wrote to memory of 2844 2732 cmd.exe 33 PID 2732 wrote to memory of 2844 2732 cmd.exe 33 PID 2732 wrote to memory of 2844 2732 cmd.exe 33 PID 1616 wrote to memory of 2760 1616 JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe 34 PID 1616 wrote to memory of 2760 1616 JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe 34 PID 1616 wrote to memory of 2760 1616 JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe 34 PID 1616 wrote to memory of 2760 1616 JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe 34 PID 2760 wrote to memory of 2400 2760 svhust.exe 35 PID 2760 wrote to memory of 2400 2760 svhust.exe 35 PID 2760 wrote to memory of 2400 2760 svhust.exe 35 PID 2760 wrote to memory of 2400 2760 svhust.exe 35 PID 2760 wrote to memory of 2400 2760 svhust.exe 35 PID 2760 wrote to memory of 2400 2760 svhust.exe 35 PID 2760 wrote to memory of 2400 2760 svhust.exe 35 PID 2760 wrote to memory of 2400 2760 svhust.exe 35 PID 2760 wrote to memory of 2844 2760 svhust.exe 36 PID 2760 wrote to memory of 2844 2760 svhust.exe 36 PID 2760 wrote to memory of 2844 2760 svhust.exe 36 PID 2760 wrote to memory of 2844 2760 svhust.exe 36 PID 2760 wrote to memory of 2844 2760 svhust.exe 36 PID 2760 wrote to memory of 2844 2760 svhust.exe 36 PID 2760 wrote to memory of 2844 2760 svhust.exe 36 PID 2760 wrote to memory of 2844 2760 svhust.exe 36 PID 2844 wrote to memory of 2560 2844 svhust.exe 37 PID 2844 wrote to memory of 2560 2844 svhust.exe 37 PID 2844 wrote to memory of 2560 2844 svhust.exe 37 PID 2844 wrote to memory of 2560 2844 svhust.exe 37 PID 2560 wrote to memory of 1584 2560 AdobeART.exe 38 PID 2560 wrote to memory of 1584 2560 AdobeART.exe 38 PID 2560 wrote to memory of 1584 2560 AdobeART.exe 38 PID 2560 wrote to memory of 1584 2560 AdobeART.exe 38 PID 2560 wrote to memory of 1584 2560 AdobeART.exe 38 PID 2560 wrote to memory of 1584 2560 AdobeART.exe 38 PID 2560 wrote to memory of 1584 2560 AdobeART.exe 38 PID 2560 wrote to memory of 1584 2560 AdobeART.exe 38 PID 1584 wrote to memory of 280 1584 AdobeART.exe 39 PID 1584 wrote to memory of 280 1584 AdobeART.exe 39 PID 1584 wrote to memory of 280 1584 AdobeART.exe 39 PID 1584 wrote to memory of 280 1584 AdobeART.exe 39 PID 280 wrote to memory of 1076 280 svhust.exe 40 PID 280 wrote to memory of 1076 280 svhust.exe 40 PID 280 wrote to memory of 1076 280 svhust.exe 40 PID 280 wrote to memory of 1076 280 svhust.exe 40 PID 280 wrote to memory of 1076 280 svhust.exe 40 PID 280 wrote to memory of 1076 280 svhust.exe 40 PID 280 wrote to memory of 1076 280 svhust.exe 40 PID 280 wrote to memory of 1076 280 svhust.exe 40 PID 280 wrote to memory of 2668 280 svhust.exe 41 PID 280 wrote to memory of 2668 280 svhust.exe 41 PID 280 wrote to memory of 2668 280 svhust.exe 41 PID 280 wrote to memory of 2668 280 svhust.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\LLYFO.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhust" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2844
-
-
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2400
-
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Roaming\AdobeART.exe"C:\Users\Admin\AppData\Roaming\AdobeART.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Roaming\AdobeART.exe"C:\Users\Admin\AppData\Roaming\AdobeART.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:280 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1076
-
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"8⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2668
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
141B
MD5e83a2e0b3c1e03dfb96ffd9924117a45
SHA127a3e4ba115ba1bad0bf094f5b97e768d1ece33e
SHA256655407d94fff9e707712a588d97a2017cc1c9d690a67c688ed0abcb79e452b13
SHA5125f61686a3b7db3544d83a4f2ce1a75868c7dc266709f72a34eafecc3a26696a985b1912a559aed8f5a2cacbfe26be9beae2374340d1801bb18473de785557480
-
Filesize
152KB
MD527d880d3c5897688f5c45aaf103bd783
SHA1409d66733abfb6268a9393c5f8b937b27e365746
SHA2563212bd74dbab352d294c378141cbc07fc4b3a77dff467611a6d6560f89a2af58
SHA512a249aa6fcd0d016ef048a5cbf666b185af8804f88c33f3e9a5d66def8ee9b831fcfde63b753b68856f0298e8f3d46d6656f296b2b749d2faea1b565c3927a799