Analysis
-
max time kernel
142s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04-07-2024 23:35
Static task
static1
Behavioral task
behavioral1
Sample
26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe
-
Size
632KB
-
MD5
26a66e7ed75cd48d20f7b148e0727437
-
SHA1
1b47d0a30c4bfe438fd14837d24ad878b57eeff8
-
SHA256
f1b34ff2a0b9b9977690d0d767f674b3ce4bde6dd6857125ac6facf6159c59ec
-
SHA512
b8c4634480aaf996b60d990b802d653831575a6f8880d983144d971a4ae0bcc3a97112a80d0fa1189d99a9c0b16e95d41f7e4664026ffc082aee12bd95975153
-
SSDEEP
12288:NjGmweNbClZcqvKKrogJhmkRjrnNtF3Z4mxxvDqVTVOCf2vR:xNNb7yJroyhm6ltQmXuVTzf2vR
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1796-60-0x0000000000400000-0x000000000051C000-memory.dmp modiloader_stage2 behavioral1/memory/1668-63-0x0000000000400000-0x000000000051C000-memory.dmp modiloader_stage2 behavioral1/memory/1796-78-0x0000000000400000-0x000000000051C000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2828 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
a1g.exepid process 1668 a1g.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exedescription ioc process File opened (read-only) \??\Z: 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File opened (read-only) \??\H: 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File opened (read-only) \??\T: 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File opened (read-only) \??\X: 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File opened (read-only) \??\L: 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File opened (read-only) \??\O: 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File opened (read-only) \??\Q: 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File opened (read-only) \??\S: 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File opened (read-only) \??\U: 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File opened (read-only) \??\A: 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File opened (read-only) \??\E: 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File opened (read-only) \??\J: 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File opened (read-only) \??\W: 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File opened (read-only) \??\N: 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File opened (read-only) \??\R: 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File opened (read-only) \??\Y: 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File opened (read-only) \??\B: 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File opened (read-only) \??\I: 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File opened (read-only) \??\K: 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File opened (read-only) \??\V: 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File opened (read-only) \??\G: 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File opened (read-only) \??\M: 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File opened (read-only) \??\P: 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exedescription ioc process File opened for modification F:\AutoRun.inf 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File created C:\AutoRun.inf 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File opened for modification C:\AutoRun.inf 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File created F:\AutoRun.inf 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
Processes:
a1g.exedescription ioc process File created C:\Windows\SysWOW64\_a1g.exe a1g.exe File opened for modification C:\Windows\SysWOW64\_a1g.exe a1g.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a1g.exedescription pid process target process PID 1668 set thread context of 2764 1668 a1g.exe mmc.exe -
Drops file in Windows directory 3 IoCs
Processes:
26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exedescription ioc process File created C:\Windows\a1g.exe 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File opened for modification C:\Windows\a1g.exe 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe File created C:\Windows\DelSvel.bat 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2528 1668 WerFault.exe a1g.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exea1g.exedescription pid process target process PID 1796 wrote to memory of 1668 1796 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe a1g.exe PID 1796 wrote to memory of 1668 1796 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe a1g.exe PID 1796 wrote to memory of 1668 1796 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe a1g.exe PID 1796 wrote to memory of 1668 1796 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe a1g.exe PID 1668 wrote to memory of 2764 1668 a1g.exe mmc.exe PID 1668 wrote to memory of 2764 1668 a1g.exe mmc.exe PID 1668 wrote to memory of 2764 1668 a1g.exe mmc.exe PID 1668 wrote to memory of 2764 1668 a1g.exe mmc.exe PID 1668 wrote to memory of 2764 1668 a1g.exe mmc.exe PID 1668 wrote to memory of 2764 1668 a1g.exe mmc.exe PID 1668 wrote to memory of 2528 1668 a1g.exe WerFault.exe PID 1668 wrote to memory of 2528 1668 a1g.exe WerFault.exe PID 1668 wrote to memory of 2528 1668 a1g.exe WerFault.exe PID 1668 wrote to memory of 2528 1668 a1g.exe WerFault.exe PID 1796 wrote to memory of 2828 1796 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe cmd.exe PID 1796 wrote to memory of 2828 1796 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe cmd.exe PID 1796 wrote to memory of 2828 1796 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe cmd.exe PID 1796 wrote to memory of 2828 1796 26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\26a66e7ed75cd48d20f7b148e0727437_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\a1g.exeC:\Windows\a1g.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mmc.exe"C:\Windows\system32\mmc.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 3003⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\DelSvel.bat2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\DelSvel.batFilesize
212B
MD544edb8375b35298b9b264c20890c1d5d
SHA1c4d0e3ae16f6f104aab97b7df213dfa1b8f1eea1
SHA25642ab9b8e4645fca1aacb44e0ea4529ba844bcda08fc8feb890f13b91f2936103
SHA512ede591abc0ad61760e1adbb3283e50d4fef4508981ea3a54df76139ea2a8091908567567d990424300b976b8ec02803278b20e408f1594ef54d65c87f465a89a
-
F:\a1g.exeFilesize
632KB
MD526a66e7ed75cd48d20f7b148e0727437
SHA11b47d0a30c4bfe438fd14837d24ad878b57eeff8
SHA256f1b34ff2a0b9b9977690d0d767f674b3ce4bde6dd6857125ac6facf6159c59ec
SHA512b8c4634480aaf996b60d990b802d653831575a6f8880d983144d971a4ae0bcc3a97112a80d0fa1189d99a9c0b16e95d41f7e4664026ffc082aee12bd95975153
-
memory/1668-69-0x00000000002C0000-0x0000000000314000-memory.dmpFilesize
336KB
-
memory/1668-63-0x0000000000400000-0x000000000051C000-memory.dmpFilesize
1.1MB
-
memory/1668-51-0x00000000002C0000-0x0000000000314000-memory.dmpFilesize
336KB
-
memory/1668-49-0x0000000000400000-0x000000000051C000-memory.dmpFilesize
1.1MB
-
memory/1796-2-0x0000000001FC0000-0x0000000001FC1000-memory.dmpFilesize
4KB
-
memory/1796-30-0x00000000033A0000-0x00000000033A1000-memory.dmpFilesize
4KB
-
memory/1796-13-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/1796-23-0x0000000003480000-0x0000000003481000-memory.dmpFilesize
4KB
-
memory/1796-22-0x0000000003480000-0x0000000003481000-memory.dmpFilesize
4KB
-
memory/1796-24-0x0000000003380000-0x0000000003383000-memory.dmpFilesize
12KB
-
memory/1796-10-0x0000000000670000-0x0000000000671000-memory.dmpFilesize
4KB
-
memory/1796-21-0x0000000003480000-0x0000000003481000-memory.dmpFilesize
4KB
-
memory/1796-20-0x0000000003380000-0x0000000003381000-memory.dmpFilesize
4KB
-
memory/1796-19-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/1796-18-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/1796-17-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/1796-16-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/1796-15-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/1796-14-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/1796-12-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/1796-11-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/1796-3-0x0000000000680000-0x0000000000681000-memory.dmpFilesize
4KB
-
memory/1796-0-0x0000000000400000-0x000000000051C000-memory.dmpFilesize
1.1MB
-
memory/1796-32-0x0000000000630000-0x0000000000631000-memory.dmpFilesize
4KB
-
memory/1796-31-0x0000000003410000-0x0000000003411000-memory.dmpFilesize
4KB
-
memory/1796-4-0x0000000001FF0000-0x0000000001FF1000-memory.dmpFilesize
4KB
-
memory/1796-29-0x00000000033B0000-0x00000000033B1000-memory.dmpFilesize
4KB
-
memory/1796-28-0x00000000033C0000-0x00000000033C1000-memory.dmpFilesize
4KB
-
memory/1796-27-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1796-26-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1796-25-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/1796-5-0x0000000000660000-0x0000000000661000-memory.dmpFilesize
4KB
-
memory/1796-6-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1796-48-0x0000000004650000-0x000000000476C000-memory.dmpFilesize
1.1MB
-
memory/1796-7-0x0000000001FE0000-0x0000000001FE1000-memory.dmpFilesize
4KB
-
memory/1796-50-0x0000000004650000-0x000000000476C000-memory.dmpFilesize
1.1MB
-
memory/1796-79-0x00000000002D0000-0x0000000000324000-memory.dmpFilesize
336KB
-
memory/1796-78-0x0000000000400000-0x000000000051C000-memory.dmpFilesize
1.1MB
-
memory/1796-60-0x0000000000400000-0x000000000051C000-memory.dmpFilesize
1.1MB
-
memory/1796-62-0x00000000002D0000-0x0000000000324000-memory.dmpFilesize
336KB
-
memory/1796-65-0x0000000003480000-0x0000000003481000-memory.dmpFilesize
4KB
-
memory/1796-64-0x0000000003380000-0x0000000003381000-memory.dmpFilesize
4KB
-
memory/1796-8-0x0000000001FD0000-0x0000000001FD1000-memory.dmpFilesize
4KB
-
memory/1796-66-0x0000000000630000-0x0000000000631000-memory.dmpFilesize
4KB
-
memory/1796-9-0x0000000002000000-0x0000000002001000-memory.dmpFilesize
4KB
-
memory/1796-1-0x00000000002D0000-0x0000000000324000-memory.dmpFilesize
336KB
-
memory/2764-55-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2764-58-0x0000000000400000-0x000000000051C000-memory.dmpFilesize
1.1MB