Overview

overview

10

Static

static

10

JaffaCakes...03.exe

windows7-x64

10

JaffaCakes...03.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-01-2025 07:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_1f14c963165d9a014e8403581ad8f503.exe

  • Size

    812KB

  • MD5

    1f14c963165d9a014e8403581ad8f503

  • SHA1

    b86ba60b11919afbe5b7365d37ea6fc899972800

  • SHA256

    4fe2982a52d3d315432d45ac13c6e0025c8dd69ea10da7916ab141833c27417b

  • SHA512

    0c0bf955e34d7e1e317f7db4f67c38a9067299255b01613adda01a5e90e69b65f9eb61406955da2751f7c24e8312c14cb76fa4a5de93577ed2bb6431f4720530

  • SSDEEP

    12288:4YknjLpcBNoLE126lU1tMGjYIFW4+zyZGumGgTtrDJrPsfL4oTO27uqULG1R:4Ykjlcr+8lUCpeZM3BDhPC5u/G

Score
10/10
modiloaderdefense_evasiondiscoverypersistencetrojanupx

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Modiloader family
    modiloader
  • ModiLoader Second Stage 9 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Adds Run key to start application 2 TTPs 53 IoCs
    persistence
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 4 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1f14c963165d9a014e8403581ad8f503.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1f14c963165d9a014e8403581ad8f503.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:812
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1f14c963165d9a014e8403581ad8f503.exe
      JaffaCakes118_1f14c963165d9a014e8403581ad8f503.exe
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2396
      • C:\Users\Admin\bxpTXK8W.exe
        C:\Users\Admin\bxpTXK8W.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1572
        • C:\Users\Admin\swraop.exe
          "C:\Users\Admin\swraop.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:400
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del bxpTXK8W.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3508
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:1472
      • C:\Users\Admin\akhost.exe
        C:\Users\Admin\akhost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1344
        • C:\Users\Admin\akhost.exe
          akhost.exe
          4⤵
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Suspicious behavior: EnumeratesProcesses
          PID:2712
      • C:\Users\Admin\bkhost.exe
        C:\Users\Admin\bkhost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1592
        • C:\Users\Admin\bkhost.exe
          bkhost.exe
          4⤵
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Suspicious behavior: EnumeratesProcesses
          PID:4516
      • C:\Users\Admin\ckhost.exe
        C:\Users\Admin\ckhost.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2944
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 396
          4⤵
          • Program crash
          PID:3612
      • C:\Users\Admin\dkhost.exe
        C:\Users\Admin\dkhost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1352
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe"
          4⤵
            PID:4440
        • C:\Users\Admin\ekhost.exe
          C:\Users\Admin\ekhost.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3076
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del JaffaCakes118_1f14c963165d9a014e8403581ad8f503.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3896
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            4⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:684
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2944 -ip 2944
      1⤵
        PID:2660

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\akhost.exe
        Filesize

        229KB

        MD5

        2c895814249b3630f5ef87aef065a6d2

        SHA1

        785a02f3a3c958fb2f3fa7ce26860b65da34939d

        SHA256

        cc6377f8d451bd5ceb97d95409b74c9589f86edd47fead3db05e3a3dbfc6204a

        SHA512

        14e786deb9917c57dbdb6468a5b6b05ef0aacaa5a9efc962bac691648c1059c99537a85f9bd65013bb2765ebcbd1fa97027c6f2069ae2e1cc901d4247c7f404c

        Download Submit

      • C:\Users\Admin\bkhost.exe
        Filesize

        122KB

        MD5

        6adba45c3cd86e3e4179c2489adc3ed0

        SHA1

        c856828981816a028d9948d4e90e83779ba00cc6

        SHA256

        e1432e8564f1a32df65a2cb433d4968e2109fef1508ad150a89e7c31227d3de8

        SHA512

        13404f5c2a311bc87e96d550674c9a7c6fda0f7808db1b901747d4e7a2e4c76bea268e38a17d3206ae419144981a060d29f916f676e586cc4376ad81717de672

        Download Submit

      • C:\Users\Admin\bxpTXK8W.exe
        Filesize

        184KB

        MD5

        2261c2411c6e581bf496a0be8d46c6d8

        SHA1

        79e709807dff36c8d9936db05c0adcce54a1a290

        SHA256

        20e4fb3c4086c725feafdd50d8c8e405b20f6a9b868422455ca0b9cd007eb418

        SHA512

        622f86d976e9c140b29a1b29c21ac26415acab2762bac6d429123cb73af002377a0ecc62afaea0ef06dea689ebb6e70a1c7251186a260eae279cc8587622cefd

        Download Submit

      • C:\Users\Admin\ckhost.exe
        Filesize

        279KB

        MD5

        b4004c548fec0ae0f7264b509b95e4d8

        SHA1

        6142664dc2b3ce927fecb96fa18a1dbc5219ae8f

        SHA256

        3f4aae3b2ec5b1d842841e76a963f26b471ed15e9933c40d48469a48ed04ee56

        SHA512

        750223d1cf30812b4c9dba9f21893f2ce34b717c17da2befe47f13e8d623c5098f5133053cb1a909da5e4ebc07b68979e72fa8f36c26c6c191665b213e838d90

        Download Submit

      • C:\Users\Admin\dkhost.exe
        Filesize

        240KB

        MD5

        0a67782f34b335fe42be835ad4542124

        SHA1

        c1838a364f27ed7b8a463edefeabf8d762d1f149

        SHA256

        4f1d17a99aaf1719a96778e06edb417de118672ad3b0193a3fd2706a8e6f699c

        SHA512

        4dd56baf20ad532e7c1933d83889c649ffe4069a23dde43486c32105c0df67ebc8f670cb54c13a902105d38f5efea06c3a7f6481aec49c4af1b40bc8cfa7b086

        Download Submit

      • C:\Users\Admin\ekhost.exe
        Filesize

        32KB

        MD5

        49e105d54bf4201e39ef974f9e5c24dc

        SHA1

        70737f6e75e250cfa335f8ef10be4b934f6fa1af

        SHA256

        a7d86eb136f345db624f4ddc577b61a2bb54f24c6b83a1de66dbdc167f3bb119

        SHA512

        7b9c210b69535ffca2280bd54b88bb2644e39fb1db487fbf8d83ea420c6db7d05b2373bef172a07b3090139e29110c593b09151e39ff6358d1fc62c0e91783fe

        Download Submit

      • C:\Users\Admin\swraop.exe
        Filesize

        184KB

        MD5

        6f4314ec5167e7e4131a713909427df9

        SHA1

        9ddfcc92a43c84cb33f78d4886fef9cc8ca941c0

        SHA256

        3fb5d0a845e1f45098abeefb3118b6ad0f0a70a4255b99ec59029df06010d4db

        SHA512

        cca6cf78be34d3eb259c25c573f883988a0041792b341598df12e4633155003c1055bb28371899d38bd1c930f3ffeab07254471659c0e8417b722b48ae850074

        Download Submit

      • memory/812-4-0x0000000000400000-0x0000000000417000-memory.dmp

        Filesize

        92KB

        Download

      • memory/1344-48-0x0000000000400000-0x0000000000416000-memory.dmp

        Filesize

        88KB

        Download

      • memory/1352-75-0x0000000000400000-0x000000000045D000-memory.dmp

        Filesize

        372KB

        Download

      • memory/1352-72-0x0000000000400000-0x000000000045D000-memory.dmp

        Filesize

        372KB

        Download

      • memory/1592-60-0x0000000000400000-0x0000000000417000-memory.dmp

        Filesize

        92KB

        Download

      • memory/2396-68-0x0000000000400000-0x0000000000516000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2396-6-0x0000000000400000-0x0000000000516000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2396-1-0x0000000000400000-0x0000000000516000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2396-7-0x0000000000400000-0x0000000000516000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2396-91-0x0000000000400000-0x0000000000516000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2396-0-0x0000000000400000-0x0000000000516000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2396-5-0x0000000000400000-0x0000000000516000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2712-70-0x0000000000400000-0x0000000000437000-memory.dmp

        Filesize

        220KB

        Download

      • memory/2712-43-0x0000000000400000-0x0000000000437000-memory.dmp

        Filesize

        220KB

        Download

      • memory/2712-41-0x0000000000400000-0x0000000000437000-memory.dmp

        Filesize

        220KB

        Download

      • memory/2712-42-0x0000000000400000-0x0000000000437000-memory.dmp

        Filesize

        220KB

        Download

      • memory/2712-44-0x0000000000400000-0x0000000000437000-memory.dmp

        Filesize

        220KB

        Download

      • memory/2712-46-0x0000000000400000-0x0000000000437000-memory.dmp

        Filesize

        220KB

        Download

      • memory/4516-53-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/4516-58-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/4516-57-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/4516-56-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/4516-52-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download