Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27/01/2025, 20:35

General

  • Target

    JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe

  • Size

    844KB

  • MD5

    4374ffe3395196ca313993c5b6337d2e

  • SHA1

    a52a9c1ac7f67a844a3299fbb170f067ffdd4758

  • SHA256

    36bb9292501433a0931ca14fc3e32cf8ced0c83da8a32b6bdc2e39e1fb6de157

  • SHA512

    3fbe39cd0819cdc1554908b75e521c8924f3dbb466c9ca262a412618d6a4be2460729d92c55df9d5e6b4cb41ea41f2a9fcb6032fb61da2b75d43012569d5a806

  • SSDEEP

    24576:fvX0CqJm7lpD2KXQztsFvKlH0jmr5WisTzjle5U5TIDV+DwLQk9Qd:3X05Jm7sAKF0GELm8IDVGqQV

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modiloader family
  • ModiLoader Second Stage 2 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 16 IoCs
  • Adds Run key to start application 2 TTPs 53 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Drops desktop.ini file(s)
    • Suspicious use of UnmapMainImage
    PID:336
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:848
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies WinLogon for persistence
    • Executes dropped EXE
    PID:1124
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2516
      • C:\Users\Admin\srRTMxaDv9.exe
        C:\Users\Admin\srRTMxaDv9.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2084
        • C:\Users\Admin\woauy.exe
          "C:\Users\Admin\woauy.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:2056
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del srRTMxaDv9.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2912
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2760
      • C:\Users\Admin\amhost.exe
        C:\Users\Admin\amhost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2640
        • C:\Users\Admin\amhost.exe
          amhost.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2780
      • C:\Users\Admin\bmhost.exe
        C:\Users\Admin\bmhost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2412
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1180
      • C:\Users\Admin\cmhost.exe
        C:\Users\Admin\cmhost.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1188
        • C:\Users\Admin\AppData\Local\1be398f8\X
          176.53.17.24:80
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2884
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1544
      • C:\Users\Admin\dmhost.exe
        C:\Users\Admin\dmhost.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2588
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:344
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2244
  • C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe -Embedding
    1⤵
      PID:708

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\1be398f8\@

            Filesize

            2KB

            MD5

            f5e66a93bc297ba83db0e7b5564ced3f

            SHA1

            863c519546cfba7531b8ecbf10ae5bede6d2193d

            SHA256

            94257ae4c040d8487cb44bc23030193944c72c12678dcd8b80684a3721b21231

            SHA512

            b7ee82bdc3057df90eed61a9d0d6d52420fb8baf6cc8f12f30144ecdd1f298f13d89e14bfa474ea939bd734440f185d7bba72d1140080a3ef975253191adaea3

          • C:\Windows\system32\consrv.dll

            Filesize

            53KB

            MD5

            4d7cde615a0f534bd5e359951829554b

            SHA1

            c885d00d9000f2a5dbc78f6193a052b36f4fe968

            SHA256

            414fdf9bdcae5136c1295d6d24740c50a484acd81f1f7d0fb5d5c138607cb80a

            SHA512

            33d632f9fbb694440a1ca568c90518784278efd1dc9ee2b57028149d56ebe1f7346d5b59dcfafee2eeaa10091dda05f48958e909d6bfc891e037ae1cfbd048d4

          • \??\globalroot\systemroot\assembly\temp\@

            Filesize

            2KB

            MD5

            c9c375e4592e4f72fc80d8673aa484e3

            SHA1

            565b0a395671b12a77d006b7b17a54d20932f28a

            SHA256

            f6b79b69ca9f5047bed4631c79b6ea737fb03125e185b2114f4986a366f8b9c2

            SHA512

            e412db5ec4003861a02e04b564e3f6ae6f93f2d052615fab96b4560ca74989891a610fd6062b14cef96785c9866b34c72470f158918af161870942fe5153ee65

          • \Users\Admin\AppData\Local\1be398f8\X

            Filesize

            41KB

            MD5

            be40a2578e862f1cecc9b9194f524201

            SHA1

            0c379f375f9bcfab2e8d86161cec07fe4a7dbc12

            SHA256

            2c0f19272baa42d1af85a395fe8cd687c50e91450abc5911f6806c317a25b6a6

            SHA512

            25fbee1dce99c0ca80cd11bbe0d9fceaa07bf8a8b9b3ebc04e55645c0a733dafc83a7922975c31bc9fdff6f413257ac8b9ff72628c78b48a5b7ab669eab369f8

          • \Users\Admin\amhost.exe

            Filesize

            80KB

            MD5

            8ccbe4f27f9710f3e7f75e1d1de57e49

            SHA1

            272e95e476477cd4a1715ee0bcf32318e0351718

            SHA256

            3d36ee15c25b2308f8552e121d885c26b46b4e7fc6dbb41a684bec53e0ae3b5d

            SHA512

            334f56b5158839f521513aff9de334536c86da633bf1a3b78592529275457973ed67fd55a54bef8f88ce918c2863c365cababfbd0ef888a27272906e281105d0

          • \Users\Admin\bmhost.exe

            Filesize

            258KB

            MD5

            2da0070a7c50f3a078b73b4fb7ee7c02

            SHA1

            999b4860a80b908622fadfc8fae27db66b200932

            SHA256

            f8a0f1b5b3f320f01173f151305dc780eac51bf78e7405fd2c0b9b3ba58945bf

            SHA512

            2d488508e785d92c5cf9f0abee8153d984d8dd8f1d59880643764f499e151fccc9572a9ad1fe0a82412b8ed230d25bd849a0beeded12325dc21839ed53512630

          • \Users\Admin\cmhost.exe

            Filesize

            358KB

            MD5

            03102e4338eb16e0c4dfe106830557e3

            SHA1

            4fdb5baf0900e44e95acdeee1c947be3b0518b39

            SHA256

            7dd28bddc46daddc8f7e14906f50ef991d3d7f1ffb785388fb5c42be9e162139

            SHA512

            c7d4b4b3766c0b4cdc3d16f56effe1b36cacd4a48f728cf1a33360eb6c48362587186dc0be45f098cd3117bc10c7113d51262939bfe018c6f963b36d59cd97c9

          • \Users\Admin\dmhost.exe

            Filesize

            32KB

            MD5

            e5a8cc5176a71d1fb82d8790db0c20f0

            SHA1

            6d0c76a9e94151d84241bdf99033524daf4346ed

            SHA256

            3b324891d70636e38cfc4c080a91fc83b387013af03ef9d2d6aa36376e1d6c8c

            SHA512

            ccbd5e3f98ff202c8a7753208d588bfef183eb37a6da3fbcf733dab0112408b1a05836ebbc24d6a17e9b72260ba9682e53628d20f130b10d8ec76cf9f1a51f9c

          • \Users\Admin\srRTMxaDv9.exe

            Filesize

            344KB

            MD5

            57a5743f47b3a874773041195600909c

            SHA1

            74f5c16a6ca03baea7c684e40d351f1ec484a70d

            SHA256

            eecfb7541cf571d34882ebeb19c3c396ed53243e23060d45e1f1b033e061da90

            SHA512

            66c4621663db921b7a18b843197ea6611e9473abca6b2a653d1f228146129434a7f643f598e0fdfbe300f2ea91168135de59a69f02f52245c71f12e4364e2954

          • \Users\Admin\woauy.exe

            Filesize

            344KB

            MD5

            07fde06b6fa5b5aac1b1f829f239c149

            SHA1

            493ea55103ec11486e424ce65b18b0b1627cc704

            SHA256

            3f3810d49d52695fb564da70161034b5c433804288ca6dd1fe2220fd60722e10

            SHA512

            b7c2f8aef0cdac030c4c7f8f1f80ffdf777472e70f885ba3709076703095fabd7fd3a9c2d9121ad31922d402cb418f6d95a0933c53b7f0638750c75e354a6368

          • \Windows\assembly\GAC_32\Desktop.ini

            Filesize

            4KB

            MD5

            878f9b6da85cb98fcbdf6abd1730a32f

            SHA1

            343007e658ea541f4680b4edf4513e69e1cc18a6

            SHA256

            75b5a460ed6f47fca8ec1bcd8a11b22f24fb33de4d5f307b851ad20c7f831b7d

            SHA512

            5425844e34ad5e717b08830020526f5c9465f654f3e9e29967b2983d5cb8dc225be2b89cd29a8e4cc99fcfc99e05556f66eefa0539283ab4569e603413a37293

          • \Windows\assembly\GAC_64\Desktop.ini

            Filesize

            5KB

            MD5

            9d7ec1e355ac35cbe6991721ef5ae3b8

            SHA1

            c35a00bd35c6e4a7516b93947be08ead966347e8

            SHA256

            68a3cec42215323100398a8eb2cbb37da7d58fe0fa9c6312e954e0f50a95ca98

            SHA512

            b7c4be28d8e179974672205a50e72fa1ec9e2e8170b3b8ee763e1751a3397c35afec7a72c88f0a79a8566749b2af1ff054660a96c3a6d6508c545d316a035dc0

          • memory/336-87-0x0000000002540000-0x0000000002552000-memory.dmp

            Filesize

            72KB

          • memory/1124-120-0x0000000002540000-0x000000000254B000-memory.dmp

            Filesize

            44KB

          • memory/1124-121-0x0000000002550000-0x000000000255B000-memory.dmp

            Filesize

            44KB

          • memory/1124-115-0x0000000002540000-0x000000000254B000-memory.dmp

            Filesize

            44KB

          • memory/1124-111-0x0000000002540000-0x000000000254B000-memory.dmp

            Filesize

            44KB

          • memory/1124-73-0x0000000002520000-0x0000000002526000-memory.dmp

            Filesize

            24KB

          • memory/1124-77-0x0000000002520000-0x0000000002526000-memory.dmp

            Filesize

            24KB

          • memory/1124-81-0x0000000002520000-0x0000000002526000-memory.dmp

            Filesize

            24KB

          • memory/1188-128-0x0000000000400000-0x0000000000465C48-memory.dmp

            Filesize

            407KB

          • memory/1188-135-0x0000000000400000-0x0000000000465C48-memory.dmp

            Filesize

            407KB

          • memory/2412-72-0x0000000000360000-0x00000000003A1000-memory.dmp

            Filesize

            260KB

          • memory/2412-91-0x0000000000400000-0x0000000000446000-memory.dmp

            Filesize

            280KB

          • memory/2412-69-0x0000000000360000-0x00000000003A1000-memory.dmp

            Filesize

            260KB

          • memory/2412-60-0x0000000000360000-0x00000000003A1000-memory.dmp

            Filesize

            260KB

          • memory/2412-68-0x0000000000360000-0x00000000003A1000-memory.dmp

            Filesize

            260KB

          • memory/2412-64-0x0000000000360000-0x00000000003A1000-memory.dmp

            Filesize

            260KB

          • memory/2412-70-0x0000000000360000-0x00000000003A1000-memory.dmp

            Filesize

            260KB

          • memory/2640-46-0x0000000000400000-0x0000000000417000-memory.dmp

            Filesize

            92KB

          • memory/2780-51-0x0000000000400000-0x000000000040E000-memory.dmp

            Filesize

            56KB

          • memory/2780-50-0x0000000000400000-0x000000000040E000-memory.dmp

            Filesize

            56KB

          • memory/2780-36-0x0000000000400000-0x000000000040E000-memory.dmp

            Filesize

            56KB

          • memory/2780-38-0x0000000000400000-0x000000000040E000-memory.dmp

            Filesize

            56KB

          • memory/2780-43-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/2780-52-0x0000000000400000-0x000000000040E000-memory.dmp

            Filesize

            56KB

          • memory/2780-47-0x0000000000400000-0x000000000040E000-memory.dmp

            Filesize

            56KB

          • memory/2780-40-0x0000000000400000-0x000000000040E000-memory.dmp

            Filesize

            56KB