Analysis
-
max time kernel
142s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 21:51
Static task
static1
Behavioral task
behavioral1
Sample
17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe
-
Size
664KB
-
MD5
17a8c6692d30b1d85effe14f203e1606
-
SHA1
16abed5883b965c55fee65750830e7bb8c3b2598
-
SHA256
ee976eb16b543a786b564711df7a818056ea2b362e03c132b373827ace808581
-
SHA512
48ca5f333d8599d3c9620eff41d9ac49c906da1355cd42642c0959041ee58eff57995cce7b73b10a2306ec12b18162746cd668074a52801cce09867f236100d3
-
SSDEEP
12288:lEnXalSA2y+APq9A069Z9REYPN1CYwWdhMbXojF3Z4mxxgorMJ6ZSknsmhSVxjcg:lyhh9q9Z7FPXFwWdhIXojQmXNrMQoGhs
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4812-14-0x00000000034D0000-0x00000000035D0000-memory.dmp modiloader_stage2 behavioral2/memory/4812-50-0x0000000000400000-0x000000000052C000-memory.dmp modiloader_stage2 behavioral2/memory/1768-51-0x0000000000400000-0x000000000052C000-memory.dmp modiloader_stage2 behavioral2/memory/4812-63-0x0000000000400000-0x000000000052C000-memory.dmp modiloader_stage2 behavioral2/memory/1768-67-0x0000000000400000-0x000000000052C000-memory.dmp modiloader_stage2 behavioral2/memory/1768-70-0x0000000000400000-0x000000000052C000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
rejoice101.exepid process 1768 rejoice101.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exedescription ioc process File opened (read-only) \??\U: 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened (read-only) \??\B: 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened (read-only) \??\G: 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened (read-only) \??\I: 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened (read-only) \??\J: 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened (read-only) \??\Q: 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened (read-only) \??\Z: 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened (read-only) \??\X: 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened (read-only) \??\K: 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened (read-only) \??\L: 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened (read-only) \??\M: 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened (read-only) \??\S: 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened (read-only) \??\V: 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened (read-only) \??\P: 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened (read-only) \??\R: 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened (read-only) \??\T: 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened (read-only) \??\A: 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened (read-only) \??\E: 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened (read-only) \??\H: 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened (read-only) \??\N: 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened (read-only) \??\O: 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened (read-only) \??\W: 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened (read-only) \??\Y: 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exedescription ioc process File created C:\AutoRun.inf 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened for modification C:\AutoRun.inf 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File created F:\AutoRun.inf 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened for modification F:\AutoRun.inf 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
Processes:
rejoice101.exedescription ioc process File created C:\Windows\SysWOW64\_rejoice101.exe rejoice101.exe File opened for modification C:\Windows\SysWOW64\_rejoice101.exe rejoice101.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rejoice101.exedescription pid process target process PID 1768 set thread context of 4304 1768 rejoice101.exe calc.exe -
Drops file in Program Files directory 3 IoCs
Processes:
17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice101.exe 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice101.exe 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1100 1768 WerFault.exe rejoice101.exe 2132 1768 WerFault.exe rejoice101.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exerejoice101.exedescription pid process target process PID 4812 wrote to memory of 1768 4812 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe rejoice101.exe PID 4812 wrote to memory of 1768 4812 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe rejoice101.exe PID 4812 wrote to memory of 1768 4812 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe rejoice101.exe PID 1768 wrote to memory of 4304 1768 rejoice101.exe calc.exe PID 1768 wrote to memory of 4304 1768 rejoice101.exe calc.exe PID 1768 wrote to memory of 4304 1768 rejoice101.exe calc.exe PID 1768 wrote to memory of 4304 1768 rejoice101.exe calc.exe PID 1768 wrote to memory of 4304 1768 rejoice101.exe calc.exe PID 1768 wrote to memory of 5100 1768 rejoice101.exe IEXPLORE.EXE PID 1768 wrote to memory of 5100 1768 rejoice101.exe IEXPLORE.EXE PID 1768 wrote to memory of 1100 1768 rejoice101.exe WerFault.exe PID 1768 wrote to memory of 1100 1768 rejoice101.exe WerFault.exe PID 1768 wrote to memory of 1100 1768 rejoice101.exe WerFault.exe PID 4812 wrote to memory of 1592 4812 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe cmd.exe PID 4812 wrote to memory of 1592 4812 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe cmd.exe PID 4812 wrote to memory of 1592 4812 17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\17a8c6692d30b1d85effe14f203e1606_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice101.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice101.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 6643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 6643⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat""2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3932 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4304 -ip 43041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1768 -ip 17681⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.batFilesize
212B
MD53af7d3d472a9ab4003024fd0ca8476c1
SHA193e16397dd7163cc42f905b52b142025044da32a
SHA256a34a278e23b98599a45c3fd926836f7483e7573c498ddb715abfce57eadd589c
SHA51289f6ffea79c895cb261f2652dd24afd75263863b5bbdbe71940cc887693f771c7d3de9ba0887b65d9393ba148d3abbbebc1ea8fe9a11a028cb467f6196e491c6
-
F:\rejoice101.exeFilesize
664KB
MD517a8c6692d30b1d85effe14f203e1606
SHA116abed5883b965c55fee65750830e7bb8c3b2598
SHA256ee976eb16b543a786b564711df7a818056ea2b362e03c132b373827ace808581
SHA51248ca5f333d8599d3c9620eff41d9ac49c906da1355cd42642c0959041ee58eff57995cce7b73b10a2306ec12b18162746cd668074a52801cce09867f236100d3
-
memory/1768-70-0x0000000000400000-0x000000000052C000-memory.dmpFilesize
1.2MB
-
memory/1768-67-0x0000000000400000-0x000000000052C000-memory.dmpFilesize
1.2MB
-
memory/1768-51-0x0000000000400000-0x000000000052C000-memory.dmpFilesize
1.2MB
-
memory/4304-48-0x0000000000400000-0x000000000052C000-memory.dmpFilesize
1.2MB
-
memory/4812-28-0x0000000003520000-0x0000000003521000-memory.dmpFilesize
4KB
-
memory/4812-11-0x0000000002540000-0x0000000002541000-memory.dmpFilesize
4KB
-
memory/4812-31-0x00000000022B0000-0x00000000022B1000-memory.dmpFilesize
4KB
-
memory/4812-30-0x00000000006C0000-0x00000000006C1000-memory.dmpFilesize
4KB
-
memory/4812-29-0x00000000034E0000-0x00000000034E1000-memory.dmpFilesize
4KB
-
memory/4812-0-0x0000000000400000-0x000000000052C000-memory.dmpFilesize
1.2MB
-
memory/4812-25-0x00000000034D0000-0x00000000034D1000-memory.dmpFilesize
4KB
-
memory/4812-24-0x00000000034D0000-0x00000000034D1000-memory.dmpFilesize
4KB
-
memory/4812-23-0x00000000035D0000-0x00000000035D1000-memory.dmpFilesize
4KB
-
memory/4812-22-0x00000000035D0000-0x00000000035D1000-memory.dmpFilesize
4KB
-
memory/4812-21-0x00000000035D0000-0x00000000035D1000-memory.dmpFilesize
4KB
-
memory/4812-20-0x00000000034D0000-0x00000000034D1000-memory.dmpFilesize
4KB
-
memory/4812-19-0x00000000034E0000-0x00000000034E1000-memory.dmpFilesize
4KB
-
memory/4812-18-0x00000000034E0000-0x00000000034E1000-memory.dmpFilesize
4KB
-
memory/4812-17-0x00000000034E0000-0x00000000034E1000-memory.dmpFilesize
4KB
-
memory/4812-16-0x00000000034E0000-0x00000000034E1000-memory.dmpFilesize
4KB
-
memory/4812-15-0x00000000034E0000-0x00000000034E1000-memory.dmpFilesize
4KB
-
memory/4812-13-0x0000000002500000-0x0000000002501000-memory.dmpFilesize
4KB
-
memory/4812-12-0x0000000002570000-0x0000000002571000-memory.dmpFilesize
4KB
-
memory/4812-32-0x00000000034F0000-0x00000000034F1000-memory.dmpFilesize
4KB
-
memory/4812-10-0x0000000002550000-0x0000000002551000-memory.dmpFilesize
4KB
-
memory/4812-4-0x0000000000400000-0x000000000052C000-memory.dmpFilesize
1.2MB
-
memory/4812-9-0x00000000024E0000-0x00000000024E1000-memory.dmpFilesize
4KB
-
memory/4812-8-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/4812-7-0x0000000002560000-0x0000000002561000-memory.dmpFilesize
4KB
-
memory/4812-6-0x0000000002510000-0x0000000002511000-memory.dmpFilesize
4KB
-
memory/4812-5-0x0000000002530000-0x0000000002531000-memory.dmpFilesize
4KB
-
memory/4812-27-0x00000000034D0000-0x00000000034D3000-memory.dmpFilesize
12KB
-
memory/4812-26-0x00000000035D0000-0x00000000035D1000-memory.dmpFilesize
4KB
-
memory/4812-50-0x0000000000400000-0x000000000052C000-memory.dmpFilesize
1.2MB
-
memory/4812-14-0x00000000034D0000-0x00000000035D0000-memory.dmpFilesize
1024KB
-
memory/4812-52-0x0000000002310000-0x0000000002364000-memory.dmpFilesize
336KB
-
memory/4812-53-0x00000000034D0000-0x00000000035D0000-memory.dmpFilesize
1024KB
-
memory/4812-55-0x00000000035D0000-0x00000000035D1000-memory.dmpFilesize
4KB
-
memory/4812-54-0x00000000034D0000-0x00000000034D1000-memory.dmpFilesize
4KB
-
memory/4812-3-0x0000000002310000-0x0000000002364000-memory.dmpFilesize
336KB
-
memory/4812-63-0x0000000000400000-0x000000000052C000-memory.dmpFilesize
1.2MB
-
memory/4812-64-0x0000000002310000-0x0000000002364000-memory.dmpFilesize
336KB
-
memory/4812-2-0x0000000000400000-0x000000000052C000-memory.dmpFilesize
1.2MB
-
memory/4812-1-0x0000000000400000-0x000000000052C000-memory.dmpFilesize
1.2MB