Overview

overview

10

Static

static

10

JaffaCakes...d6.exe

windows7-x64

10

JaffaCakes...d6.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-01-2025 00:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_08b4bebcf4bda9e48c61d7f31cbac4d6.exe

  • Size

    812KB

  • MD5

    08b4bebcf4bda9e48c61d7f31cbac4d6

  • SHA1

    dc007ab37f9c26daa5368602e7ae22c23d86e44c

  • SHA256

    b93296b02018089da2625165cc46ad7826e7477df358eab5869fad8ba8d0cb79

  • SHA512

    0a7a76acb80023302ea6271b3102fa088f0cc95a9979821c17093c782c5bd86b54836e643bacaeae3d0da11ec42714e7d8d4e36e41ac1e2c8c353c5d143668f7

  • SSDEEP

    12288:4YknjLpDBNoLE126lU1tMGjYIFW4+zyZGumGgTtrDJrPsfL4oTO27uqULG1R:4YkjlDr+8lUCpeZM3BDhPC5u/G

Score
10/10
modiloaderdefense_evasiondiscoverypersistencetrojanupx

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Modiloader family
    modiloader
  • ModiLoader Second Stage 9 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Adds Run key to start application 2 TTPs 50 IoCs
    persistence
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 4 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_08b4bebcf4bda9e48c61d7f31cbac4d6.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_08b4bebcf4bda9e48c61d7f31cbac4d6.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1284
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_08b4bebcf4bda9e48c61d7f31cbac4d6.exe
      JaffaCakes118_08b4bebcf4bda9e48c61d7f31cbac4d6.exe
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3208
      • C:\Users\Admin\bxpTXK8W.exe
        C:\Users\Admin\bxpTXK8W.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3992
        • C:\Users\Admin\quexae.exe
          "C:\Users\Admin\quexae.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:700
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del bxpTXK8W.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1400
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2728
      • C:\Users\Admin\akhost.exe
        C:\Users\Admin\akhost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:316
        • C:\Users\Admin\akhost.exe
          akhost.exe
          4⤵
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Suspicious behavior: EnumeratesProcesses
          PID:3096
      • C:\Users\Admin\bkhost.exe
        C:\Users\Admin\bkhost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1860
        • C:\Users\Admin\bkhost.exe
          bkhost.exe
          4⤵
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Suspicious behavior: EnumeratesProcesses
          PID:3172
      • C:\Users\Admin\ckhost.exe
        C:\Users\Admin\ckhost.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2568
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 396
          4⤵
          • Program crash
          PID:2836
      • C:\Users\Admin\dkhost.exe
        C:\Users\Admin\dkhost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4028
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe"
          4⤵
            PID:2128
        • C:\Users\Admin\ekhost.exe
          C:\Users\Admin\ekhost.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4636
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del JaffaCakes118_08b4bebcf4bda9e48c61d7f31cbac4d6.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:724
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            4⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:3076
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2568 -ip 2568
      1⤵
        PID:3684

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\akhost.exe
        Filesize

        229KB

        MD5

        2c895814249b3630f5ef87aef065a6d2

        SHA1

        785a02f3a3c958fb2f3fa7ce26860b65da34939d

        SHA256

        cc6377f8d451bd5ceb97d95409b74c9589f86edd47fead3db05e3a3dbfc6204a

        SHA512

        14e786deb9917c57dbdb6468a5b6b05ef0aacaa5a9efc962bac691648c1059c99537a85f9bd65013bb2765ebcbd1fa97027c6f2069ae2e1cc901d4247c7f404c

        Download Submit

      • C:\Users\Admin\bkhost.exe
        Filesize

        122KB

        MD5

        6adba45c3cd86e3e4179c2489adc3ed0

        SHA1

        c856828981816a028d9948d4e90e83779ba00cc6

        SHA256

        e1432e8564f1a32df65a2cb433d4968e2109fef1508ad150a89e7c31227d3de8

        SHA512

        13404f5c2a311bc87e96d550674c9a7c6fda0f7808db1b901747d4e7a2e4c76bea268e38a17d3206ae419144981a060d29f916f676e586cc4376ad81717de672

        Download Submit

      • C:\Users\Admin\bxpTXK8W.exe
        Filesize

        184KB

        MD5

        2261c2411c6e581bf496a0be8d46c6d8

        SHA1

        79e709807dff36c8d9936db05c0adcce54a1a290

        SHA256

        20e4fb3c4086c725feafdd50d8c8e405b20f6a9b868422455ca0b9cd007eb418

        SHA512

        622f86d976e9c140b29a1b29c21ac26415acab2762bac6d429123cb73af002377a0ecc62afaea0ef06dea689ebb6e70a1c7251186a260eae279cc8587622cefd

        Download Submit

      • C:\Users\Admin\ckhost.exe
        Filesize

        279KB

        MD5

        b4004c548fec0ae0f7264b509b95e4d8

        SHA1

        6142664dc2b3ce927fecb96fa18a1dbc5219ae8f

        SHA256

        3f4aae3b2ec5b1d842841e76a963f26b471ed15e9933c40d48469a48ed04ee56

        SHA512

        750223d1cf30812b4c9dba9f21893f2ce34b717c17da2befe47f13e8d623c5098f5133053cb1a909da5e4ebc07b68979e72fa8f36c26c6c191665b213e838d90

        Download Submit

      • C:\Users\Admin\dkhost.exe
        Filesize

        240KB

        MD5

        0a67782f34b335fe42be835ad4542124

        SHA1

        c1838a364f27ed7b8a463edefeabf8d762d1f149

        SHA256

        4f1d17a99aaf1719a96778e06edb417de118672ad3b0193a3fd2706a8e6f699c

        SHA512

        4dd56baf20ad532e7c1933d83889c649ffe4069a23dde43486c32105c0df67ebc8f670cb54c13a902105d38f5efea06c3a7f6481aec49c4af1b40bc8cfa7b086

        Download Submit

      • C:\Users\Admin\ekhost.exe
        Filesize

        32KB

        MD5

        49e105d54bf4201e39ef974f9e5c24dc

        SHA1

        70737f6e75e250cfa335f8ef10be4b934f6fa1af

        SHA256

        a7d86eb136f345db624f4ddc577b61a2bb54f24c6b83a1de66dbdc167f3bb119

        SHA512

        7b9c210b69535ffca2280bd54b88bb2644e39fb1db487fbf8d83ea420c6db7d05b2373bef172a07b3090139e29110c593b09151e39ff6358d1fc62c0e91783fe

        Download Submit

      • C:\Users\Admin\quexae.exe
        Filesize

        184KB

        MD5

        626112ab08dc26abe30b9d1c78f64b31

        SHA1

        f30a34e231b51af90ade143a3d2903eb1ccd2d8d

        SHA256

        1cf391cf75ab5c190edf16848a548c72d4d20987199cb70fb3ff793b3c1fb193

        SHA512

        249aa221fbf7e08bcd61a29925e345acb62019e8aa200fae5d96e353d40124ad0431b47e1c38e56f372db06436fbe882ed5760f74b73dfb0965b1c6da458a84a

        Download Submit

      • memory/316-49-0x0000000000400000-0x0000000000416000-memory.dmp

        Filesize

        88KB

        Download

      • memory/1284-5-0x0000000000400000-0x0000000000417000-memory.dmp

        Filesize

        92KB

        Download

      • memory/1860-58-0x0000000000400000-0x0000000000417000-memory.dmp

        Filesize

        92KB

        Download

      • memory/3096-43-0x0000000000400000-0x0000000000437000-memory.dmp

        Filesize

        220KB

        Download

      • memory/3096-47-0x0000000000400000-0x0000000000437000-memory.dmp

        Filesize

        220KB

        Download

      • memory/3096-44-0x0000000000400000-0x0000000000437000-memory.dmp

        Filesize

        220KB

        Download

      • memory/3096-45-0x0000000000400000-0x0000000000437000-memory.dmp

        Filesize

        220KB

        Download

      • memory/3096-42-0x0000000000400000-0x0000000000437000-memory.dmp

        Filesize

        220KB

        Download

      • memory/3096-70-0x0000000000400000-0x0000000000437000-memory.dmp

        Filesize

        220KB

        Download

      • memory/3172-71-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/3172-60-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/3172-53-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/3172-54-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/3172-59-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/3208-68-0x0000000000400000-0x0000000000516000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/3208-0-0x0000000000400000-0x0000000000516000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/3208-1-0x0000000000400000-0x0000000000516000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/3208-6-0x0000000000400000-0x0000000000516000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/3208-8-0x0000000000400000-0x0000000000516000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/3208-4-0x0000000000400000-0x0000000000516000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/3208-90-0x0000000000400000-0x0000000000516000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/4028-74-0x0000000000400000-0x000000000045D000-memory.dmp

        Filesize

        372KB

        Download

      • memory/4028-72-0x0000000000400000-0x000000000045D000-memory.dmp

        Filesize

        372KB

        Download