Analysis
-
max time kernel
95s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 20:51
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_4392aa94cdcbc149255da7fd3b7c5ce3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_4392aa94cdcbc149255da7fd3b7c5ce3.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_4392aa94cdcbc149255da7fd3b7c5ce3.exe
-
Size
184KB
-
MD5
4392aa94cdcbc149255da7fd3b7c5ce3
-
SHA1
36cee175effed400666486c72d08ea6ba06930fa
-
SHA256
c6b8d4ccff474538b855894be5afe5cf0a5ffec5382d7350af6e0b06525c1376
-
SHA512
fe75a3e6bf1ec43a160fe18d347d8742986e00101d9612a2ab3c20ed2a2dbee1e9375c75365000c4203fd293c7a0594f37680864688a33531ae9b50b0200a9ac
-
SSDEEP
3072:K2n+9E5MTxw7HeVk18ctLDxNckysDFD8XulT1TaJAYmbQ:O6qcZDTcwDV8gImb
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 3 IoCs
resource yara_rule behavioral2/memory/2212-6-0x0000000000400000-0x000000000046C000-memory.dmp modiloader_stage2 behavioral2/memory/2212-5-0x0000000000400000-0x000000000046C000-memory.dmp modiloader_stage2 behavioral2/memory/2212-18-0x0000000000400000-0x000000000046C000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 3604 Winservices.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SysServices = "C:\\Windows\\Winservices.exe" cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5076 set thread context of 2212 5076 JaffaCakes118_4392aa94cdcbc149255da7fd3b7c5ce3.exe 83 -
resource yara_rule behavioral2/memory/2212-2-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2212-3-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2212-4-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2212-6-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2212-5-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2212-18-0x0000000000400000-0x000000000046C000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Winservices.exe cmd.exe File opened for modification C:\Windows\Winservices.exe cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winservices.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_4392aa94cdcbc149255da7fd3b7c5ce3.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5076 JaffaCakes118_4392aa94cdcbc149255da7fd3b7c5ce3.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 5076 wrote to memory of 2212 5076 JaffaCakes118_4392aa94cdcbc149255da7fd3b7c5ce3.exe 83 PID 5076 wrote to memory of 2212 5076 JaffaCakes118_4392aa94cdcbc149255da7fd3b7c5ce3.exe 83 PID 5076 wrote to memory of 2212 5076 JaffaCakes118_4392aa94cdcbc149255da7fd3b7c5ce3.exe 83 PID 5076 wrote to memory of 2212 5076 JaffaCakes118_4392aa94cdcbc149255da7fd3b7c5ce3.exe 83 PID 5076 wrote to memory of 2212 5076 JaffaCakes118_4392aa94cdcbc149255da7fd3b7c5ce3.exe 83 PID 5076 wrote to memory of 2212 5076 JaffaCakes118_4392aa94cdcbc149255da7fd3b7c5ce3.exe 83 PID 5076 wrote to memory of 2212 5076 JaffaCakes118_4392aa94cdcbc149255da7fd3b7c5ce3.exe 83 PID 5076 wrote to memory of 2212 5076 JaffaCakes118_4392aa94cdcbc149255da7fd3b7c5ce3.exe 83 PID 2212 wrote to memory of 3604 2212 cmd.exe 84 PID 2212 wrote to memory of 3604 2212 cmd.exe 84 PID 2212 wrote to memory of 3604 2212 cmd.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4392aa94cdcbc149255da7fd3b7c5ce3.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4392aa94cdcbc149255da7fd3b7c5ce3.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\Winservices.exe"C:\Windows\Winservices.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3604
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231KB
MD5d0fce3afa6aa1d58ce9fa336cc2b675b
SHA14048488de6ba4bfef9edf103755519f1f762668f
SHA2564d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22
SHA51280e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2