Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    31-12-2024 04:01

General

  • Target

    JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe

  • Size

    152KB

  • MD5

    03c222c69a38ae806d171b3a48fa2a5d

  • SHA1

    633bda88fa088ef1f07e0dad0ee7c3e6d577efac

  • SHA256

    3b155f1e387567be9b8d6c1d2c507dc0484c046b9b2c332617c1843cea04b7e2

  • SHA512

    013e0272483bd4d4ae5346eb2bf132553ddd9794d055ccaa5e722f0513a9b129e7fccf7c5fc838a3075f9f77116eefc6215671a3d9afa320b00ed4138fdb2b55

  • SSDEEP

    1536:c1DMz1DQvXLq6t7awFONecenlLnQHIG5R9c73P600t:9eGw9A0rC00t

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 3 IoCs
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 12 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2400
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_03c222c69a38ae806d171b3a48fa2a5d.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1616
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\LLYFO.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2732
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhust" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe" /f
          4⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:2844
      • C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
        "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2760
        • C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
          "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2400
        • C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
          "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2844
          • C:\Users\Admin\AppData\Roaming\AdobeART.exe
            "C:\Users\Admin\AppData\Roaming\AdobeART.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2560
            • C:\Users\Admin\AppData\Roaming\AdobeART.exe
              "C:\Users\Admin\AppData\Roaming\AdobeART.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1584
              • C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
                "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:280
                • C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
                  "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  PID:1076
                • C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
                  "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
                  8⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  PID:2668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\LLYFO.bat

    Filesize

    141B

    MD5

    e83a2e0b3c1e03dfb96ffd9924117a45

    SHA1

    27a3e4ba115ba1bad0bf094f5b97e768d1ece33e

    SHA256

    655407d94fff9e707712a588d97a2017cc1c9d690a67c688ed0abcb79e452b13

    SHA512

    5f61686a3b7db3544d83a4f2ce1a75868c7dc266709f72a34eafecc3a26696a985b1912a559aed8f5a2cacbfe26be9beae2374340d1801bb18473de785557480

  • C:\Users\Admin\AppData\Roaming\svhust\svhust.exe

    Filesize

    152KB

    MD5

    27d880d3c5897688f5c45aaf103bd783

    SHA1

    409d66733abfb6268a9393c5f8b937b27e365746

    SHA256

    3212bd74dbab352d294c378141cbc07fc4b3a77dff467611a6d6560f89a2af58

    SHA512

    a249aa6fcd0d016ef048a5cbf666b185af8804f88c33f3e9a5d66def8ee9b831fcfde63b753b68856f0298e8f3d46d6656f296b2b749d2faea1b565c3927a799

  • memory/1076-1494-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1584-1489-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1616-364-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1616-778-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2400-16-0x00000000002A0000-0x00000000002A1000-memory.dmp

    Filesize

    4KB

  • memory/2400-2-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2400-4-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2400-10-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/2400-20-0x00000000002B0000-0x00000000002B1000-memory.dmp

    Filesize

    4KB

  • memory/2400-352-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

  • memory/2400-353-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2400-1492-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2400-354-0x0000000000530000-0x0000000000531000-memory.dmp

    Filesize

    4KB

  • memory/2668-1486-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2668-1495-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2844-775-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2844-791-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB