Analysis
-
max time kernel
138s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 21:30
Static task
static1
Behavioral task
behavioral1
Sample
17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe
-
Size
709KB
-
MD5
17998d24af97abd9c3be708782a2bbc7
-
SHA1
42fa7d132fec95e079531a3c2125f9802dc91bab
-
SHA256
28c93ea949a20acdd994bee18d49b3ba06d4de65c267c118d1bb4b6fa426fe88
-
SHA512
c79ed098462649163879b0301362d96ff868a043bc197a1ed2c54d34a8883de743ab56f4d9debb80fcd14f272d93c7c214c08cc9efad53aed6cf779ce023a54d
-
SSDEEP
12288:IuVPp3it+wX+jrslZO0bO8d/8+JaeCzF3Z4mxxexyIypeJiLbfjtWLI:HAZrbli+JSQmXK1Qf5
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2656-34-0x0000000000400000-0x0000000000527000-memory.dmp modiloader_stage2 behavioral2/memory/3076-37-0x0000000000400000-0x0000000000527000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
ctfm0n.exepid process 2656 ctfm0n.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exedescription ioc process File opened (read-only) \??\J: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\L: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\N: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\Q: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\T: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\W: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\H: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\I: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\P: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\U: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\V: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\K: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\O: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\G: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\M: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\R: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\Z: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\A: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\B: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\X: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\Y: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\E: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened (read-only) \??\S: 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exedescription ioc process File created C:\AutoRun.inf 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened for modification C:\AutoRun.inf 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File created F:\AutoRun.inf 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened for modification F:\AutoRun.inf 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe -
Drops file in System32 directory 4 IoCs
Processes:
17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exectfm0n.exedescription ioc process File created C:\Windows\SysWOW64\ctfm0n.exe 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ctfm0n.exe 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ctfm0n.exe ctfm0n.exe File created C:\Windows\SysWOW64\SxingDel.bat 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exedescription pid process target process PID 3076 wrote to memory of 2656 3076 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe ctfm0n.exe PID 3076 wrote to memory of 2656 3076 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe ctfm0n.exe PID 3076 wrote to memory of 2656 3076 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe ctfm0n.exe PID 3076 wrote to memory of 404 3076 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe cmd.exe PID 3076 wrote to memory of 404 3076 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe cmd.exe PID 3076 wrote to memory of 404 3076 17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\17998d24af97abd9c3be708782a2bbc7_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ctfm0n.exeC:\Windows\system32\ctfm0n.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\SxingDel.bat2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\SxingDel.batFilesize
212B
MD537c2cd999be51859c0cfc7a5663b8b8d
SHA15e3731c1c8ba3899991ea4eff59ade3c766d2d9e
SHA25679592845d5a5220e557f2f3f360aad7c2d14c84e63d939778f3c842df9e780b0
SHA5122b26864b4174b1edac3621922a58d7b0fd0b6d7052e282db0372ccc7ddd91d47c248eb9e13e26588732b241f2a6b11da9855369a01375c3bbb269b8adc4633e2
-
F:\ctfm0n.exeFilesize
709KB
MD517998d24af97abd9c3be708782a2bbc7
SHA142fa7d132fec95e079531a3c2125f9802dc91bab
SHA25628c93ea949a20acdd994bee18d49b3ba06d4de65c267c118d1bb4b6fa426fe88
SHA512c79ed098462649163879b0301362d96ff868a043bc197a1ed2c54d34a8883de743ab56f4d9debb80fcd14f272d93c7c214c08cc9efad53aed6cf779ce023a54d
-
memory/2656-34-0x0000000000400000-0x0000000000527000-memory.dmpFilesize
1.2MB
-
memory/2656-31-0x0000000000400000-0x0000000000527000-memory.dmpFilesize
1.2MB
-
memory/3076-14-0x0000000003520000-0x0000000003521000-memory.dmpFilesize
4KB
-
memory/3076-7-0x0000000002550000-0x0000000002551000-memory.dmpFilesize
4KB
-
memory/3076-0-0x0000000000400000-0x0000000000527000-memory.dmpFilesize
1.2MB
-
memory/3076-13-0x00000000035D0000-0x00000000035D1000-memory.dmpFilesize
4KB
-
memory/3076-12-0x00000000034D0000-0x00000000034D3000-memory.dmpFilesize
12KB
-
memory/3076-11-0x00000000034E0000-0x00000000034E1000-memory.dmpFilesize
4KB
-
memory/3076-10-0x0000000002500000-0x0000000002501000-memory.dmpFilesize
4KB
-
memory/3076-9-0x0000000002570000-0x0000000002571000-memory.dmpFilesize
4KB
-
memory/3076-8-0x0000000002540000-0x0000000002541000-memory.dmpFilesize
4KB
-
memory/3076-15-0x0000000000B00000-0x0000000000B01000-memory.dmpFilesize
4KB
-
memory/3076-6-0x00000000024E0000-0x00000000024E1000-memory.dmpFilesize
4KB
-
memory/3076-5-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/3076-3-0x0000000002510000-0x0000000002511000-memory.dmpFilesize
4KB
-
memory/3076-2-0x0000000002530000-0x0000000002531000-memory.dmpFilesize
4KB
-
memory/3076-16-0x0000000000B10000-0x0000000000B11000-memory.dmpFilesize
4KB
-
memory/3076-17-0x00000000034F0000-0x00000000034F1000-memory.dmpFilesize
4KB
-
memory/3076-4-0x0000000002560000-0x0000000002561000-memory.dmpFilesize
4KB
-
memory/3076-37-0x0000000000400000-0x0000000000527000-memory.dmpFilesize
1.2MB
-
memory/3076-38-0x0000000002360000-0x00000000023B4000-memory.dmpFilesize
336KB
-
memory/3076-1-0x0000000002360000-0x00000000023B4000-memory.dmpFilesize
336KB