Analysis
-
max time kernel
94s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03-01-2025 00:37
Behavioral task
behavioral1
Sample
JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe
-
Size
656KB
-
MD5
692cd0a0b5d8fb53dbdbb993409e507a
-
SHA1
25bac15e915bbeabfa4985077c9e6b9292d3dbda
-
SHA256
c5c4d407089d0103018235ac0d079b3d57923e6dcd94d17cf06cda138b38ab29
-
SHA512
9b44230a4c1852195ab3300ca80923ba42ba15b851bd0cda874c2d8b6863650fb1bf7dc66f6779b78e8c57217c8ce7a3a006485aa84bb7db86f3d1ec0eb1806c
-
SSDEEP
12288:hBMmKGnhDT+JlCdjpw8T1uxp62KW8CcCzyU56RZv+F4a4:XMmnDC+d28Ev8W8CcQy2U1q4p
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 6 IoCs
resource yara_rule behavioral2/memory/3420-1-0x0000000000400000-0x000000000044C000-memory.dmp modiloader_stage2 behavioral2/memory/3420-2-0x0000000000400000-0x000000000044C000-memory.dmp modiloader_stage2 behavioral2/memory/3420-3-0x0000000000400000-0x000000000044C000-memory.dmp modiloader_stage2 behavioral2/memory/3420-6-0x0000000000400000-0x000000000044C000-memory.dmp modiloader_stage2 behavioral2/memory/3420-7-0x0000000000400000-0x000000000044C000-memory.dmp modiloader_stage2 behavioral2/memory/3420-11-0x0000000000400000-0x000000000044C000-memory.dmp modiloader_stage2 -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1284-5-0x0000000000400000-0x00000000004E6000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1284 set thread context of 3420 1284 JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe 83 -
resource yara_rule behavioral2/memory/1284-0-0x0000000000400000-0x00000000004E6000-memory.dmp upx behavioral2/memory/1284-5-0x0000000000400000-0x00000000004E6000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\apostila JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe File opened for modification C:\Windows\apostila JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3420 JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe Token: SeBackupPrivilege 4700 vssvc.exe Token: SeRestorePrivilege 4700 vssvc.exe Token: SeAuditPrivilege 4700 vssvc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3288 OpenWith.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1284 wrote to memory of 3420 1284 JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe 83 PID 1284 wrote to memory of 3420 1284 JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe 83 PID 1284 wrote to memory of 3420 1284 JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe 83 PID 1284 wrote to memory of 3420 1284 JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe 83 PID 1284 wrote to memory of 3420 1284 JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe 83 PID 1284 wrote to memory of 3420 1284 JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe 83 PID 1284 wrote to memory of 3420 1284 JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe 83 PID 1284 wrote to memory of 3420 1284 JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe 83 PID 1284 wrote to memory of 3420 1284 JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe 83 PID 1284 wrote to memory of 3420 1284 JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe 83 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_692cd0a0b5d8fb53dbdbb993409e507a.exe"2⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3420
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4700
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3288