Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 21:30
Static task
static1
Behavioral task
behavioral1
Sample
17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe
-
Size
709KB
-
MD5
17998d24af97abd9c3be708782a2bbc7
-
SHA1
42fa7d132fec95e079531a3c2125f9802dc91bab
-
SHA256
28c93ea949a20acdd994bee18d49b3ba06d4de65c267c118d1bb4b6fa426fe88
-
SHA512
c79ed098462649163879b0301362d96ff868a043bc197a1ed2c54d34a8883de743ab56f4d9debb80fcd14f272d93c7c214c08cc9efad53aed6cf779ce023a54d
-
SSDEEP
12288:IuVPp3it+wX+jrslZO0bO8d/8+JaeCzF3Z4mxxexyIypeJiLbfjtWLI:HAZrbli+JSQmXK1Qf5
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2724-55-0x0000000000400000-0x0000000000527000-memory.dmp modiloader_stage2 behavioral1/memory/2432-63-0x0000000000400000-0x0000000000527000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2556 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
ctfm0n.exepid process 2724 ctfm0n.exe -
Loads dropped DLL 2 IoCs
Processes:
17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exepid process 2432 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe 2432 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exedescription ioc process File opened (read-only) \??\S: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\Z: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\I: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\J: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\K: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\P: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\Q: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\T: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\V: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\W: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\E: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\H: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\L: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\M: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\X: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\A: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\O: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\R: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\U: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\B: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\G: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\N: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\Y: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exedescription ioc process File created C:\AutoRun.inf 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened for modification C:\AutoRun.inf 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File created F:\AutoRun.inf 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened for modification F:\AutoRun.inf 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe -
Drops file in System32 directory 4 IoCs
Processes:
17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exectfm0n.exedescription ioc process File created C:\Windows\SysWOW64\ctfm0n.exe 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ctfm0n.exe 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ctfm0n.exe ctfm0n.exe File created C:\Windows\SysWOW64\SxingDel.bat 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exedescription pid process target process PID 2432 wrote to memory of 2724 2432 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe ctfm0n.exe PID 2432 wrote to memory of 2724 2432 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe ctfm0n.exe PID 2432 wrote to memory of 2724 2432 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe ctfm0n.exe PID 2432 wrote to memory of 2724 2432 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe ctfm0n.exe PID 2432 wrote to memory of 2556 2432 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe cmd.exe PID 2432 wrote to memory of 2556 2432 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe cmd.exe PID 2432 wrote to memory of 2556 2432 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe cmd.exe PID 2432 wrote to memory of 2556 2432 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ctfm0n.exeC:\Windows\system32\ctfm0n.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\system32\SxingDel.bat2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\SxingDel.batFilesize
212B
MD537c2cd999be51859c0cfc7a5663b8b8d
SHA15e3731c1c8ba3899991ea4eff59ade3c766d2d9e
SHA25679592845d5a5220e557f2f3f360aad7c2d14c84e63d939778f3c842df9e780b0
SHA5122b26864b4174b1edac3621922a58d7b0fd0b6d7052e282db0372ccc7ddd91d47c248eb9e13e26588732b241f2a6b11da9855369a01375c3bbb269b8adc4633e2
-
F:\ctfm0n.exeFilesize
709KB
MD517998d24af97abd9c3be708782a2bbc7
SHA142fa7d132fec95e079531a3c2125f9802dc91bab
SHA25628c93ea949a20acdd994bee18d49b3ba06d4de65c267c118d1bb4b6fa426fe88
SHA512c79ed098462649163879b0301362d96ff868a043bc197a1ed2c54d34a8883de743ab56f4d9debb80fcd14f272d93c7c214c08cc9efad53aed6cf779ce023a54d
-
memory/2432-9-0x0000000002130000-0x0000000002131000-memory.dmpFilesize
4KB
-
memory/2432-64-0x0000000000910000-0x0000000000964000-memory.dmpFilesize
336KB
-
memory/2432-26-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2432-25-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2432-24-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2432-23-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2432-22-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2432-21-0x0000000003490000-0x0000000003491000-memory.dmpFilesize
4KB
-
memory/2432-0-0x0000000000400000-0x0000000000527000-memory.dmpFilesize
1.2MB
-
memory/2432-19-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2432-18-0x00000000033A0000-0x00000000033A1000-memory.dmpFilesize
4KB
-
memory/2432-16-0x00000000033A0000-0x00000000033A1000-memory.dmpFilesize
4KB
-
memory/2432-15-0x00000000033A0000-0x00000000033A1000-memory.dmpFilesize
4KB
-
memory/2432-14-0x00000000033A0000-0x00000000033A1000-memory.dmpFilesize
4KB
-
memory/2432-13-0x00000000033A0000-0x00000000033A1000-memory.dmpFilesize
4KB
-
memory/2432-12-0x00000000033A0000-0x00000000033A1000-memory.dmpFilesize
4KB
-
memory/2432-11-0x00000000033A0000-0x00000000033A1000-memory.dmpFilesize
4KB
-
memory/2432-10-0x0000000001FA0000-0x0000000001FA1000-memory.dmpFilesize
4KB
-
memory/2432-20-0x0000000003490000-0x0000000003491000-memory.dmpFilesize
4KB
-
memory/2432-27-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2432-2-0x0000000001FD0000-0x0000000001FD1000-memory.dmpFilesize
4KB
-
memory/2432-6-0x0000000001F80000-0x0000000001F81000-memory.dmpFilesize
4KB
-
memory/2432-5-0x0000000001F90000-0x0000000001F91000-memory.dmpFilesize
4KB
-
memory/2432-4-0x0000000002120000-0x0000000002121000-memory.dmpFilesize
4KB
-
memory/2432-3-0x0000000001FB0000-0x0000000001FB1000-memory.dmpFilesize
4KB
-
memory/2432-7-0x0000000001FF0000-0x0000000001FF1000-memory.dmpFilesize
4KB
-
memory/2432-28-0x0000000003390000-0x0000000003393000-memory.dmpFilesize
12KB
-
memory/2432-29-0x00000000033E0000-0x00000000033E1000-memory.dmpFilesize
4KB
-
memory/2432-33-0x00000000033B0000-0x00000000033B1000-memory.dmpFilesize
4KB
-
memory/2432-32-0x00000000006D0000-0x00000000006D1000-memory.dmpFilesize
4KB
-
memory/2432-31-0x00000000006C0000-0x00000000006C1000-memory.dmpFilesize
4KB
-
memory/2432-30-0x00000000033A0000-0x00000000033A1000-memory.dmpFilesize
4KB
-
memory/2432-17-0x00000000033A0000-0x00000000033A1000-memory.dmpFilesize
4KB
-
memory/2432-45-0x00000000046C0000-0x00000000047E7000-memory.dmpFilesize
1.2MB
-
memory/2432-63-0x0000000000400000-0x0000000000527000-memory.dmpFilesize
1.2MB
-
memory/2432-1-0x0000000000910000-0x0000000000964000-memory.dmpFilesize
336KB
-
memory/2432-8-0x0000000001FE0000-0x0000000001FE1000-memory.dmpFilesize
4KB
-
memory/2724-55-0x0000000000400000-0x0000000000527000-memory.dmpFilesize
1.2MB