Analysis
-
max time kernel
142s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
05-04-2024 01:27
Static task
static1
Behavioral task
behavioral1
Sample
c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
c7131b447e17a0039db67f70ee4626b6
-
SHA1
6a0d4aaa2749cbba3c6eb0c4ccc05657dcce8990
-
SHA256
e9b50067a26025a6110c82102e647c90df0bfa92e30ee31d4bfd11e80491b42a
-
SHA512
3a41c7128a342ed469c0a1e477daa8bded6780be49084f513798f2bc563bd8192495dd187a1a3cc5c377efd4a63731543e2ff61e5eef097008f74b62b75e18d8
-
SSDEEP
24576:/D55sKlQYGmptTxu2HGurlc78tvlwSG8qmY0mD0zCkRc158sN3zsoISEgHY8Ul:/DwwGmpXu2w6lZGtmYN0B4WsN3tZEb8
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1848-1-0x0000000000400000-0x0000000000726000-memory.dmp modiloader_stage2 behavioral1/memory/1848-644-0x0000000000400000-0x0000000000726000-memory.dmp modiloader_stage2 behavioral1/memory/1776-647-0x0000000002B70000-0x0000000002E96000-memory.dmp modiloader_stage2 behavioral1/memory/1776-660-0x0000000002B70000-0x0000000002E96000-memory.dmp modiloader_stage2 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exedescription pid process target process PID 1848 set thread context of 2512 1848 c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exepid process 1848 c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe 1848 c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 2512 c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exec7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exedescription pid process target process PID 1848 wrote to memory of 2512 1848 c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe PID 1848 wrote to memory of 2512 1848 c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe PID 1848 wrote to memory of 2512 1848 c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe PID 1848 wrote to memory of 2512 1848 c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe PID 1848 wrote to memory of 2512 1848 c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe PID 1848 wrote to memory of 2512 1848 c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe PID 1848 wrote to memory of 2512 1848 c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe PID 1848 wrote to memory of 2512 1848 c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe PID 1848 wrote to memory of 2512 1848 c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe PID 2512 wrote to memory of 1776 2512 c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe dw20.exe PID 2512 wrote to memory of 1776 2512 c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe dw20.exe PID 2512 wrote to memory of 1776 2512 c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe dw20.exe PID 2512 wrote to memory of 1776 2512 c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c7131b447e17a0039db67f70ee4626b6_JaffaCakes118.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7563⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1776-645-0x0000000001E40000-0x0000000002166000-memory.dmpFilesize
3.1MB
-
memory/1776-646-0x0000000001E40000-0x0000000002166000-memory.dmpFilesize
3.1MB
-
memory/1776-660-0x0000000002B70000-0x0000000002E96000-memory.dmpFilesize
3.1MB
-
memory/1776-649-0x0000000000440000-0x0000000000441000-memory.dmpFilesize
4KB
-
memory/1776-647-0x0000000002B70000-0x0000000002E96000-memory.dmpFilesize
3.1MB
-
memory/1848-1-0x0000000000400000-0x0000000000726000-memory.dmpFilesize
3.1MB
-
memory/1848-0-0x0000000000400000-0x0000000000726000-memory.dmpFilesize
3.1MB
-
memory/1848-2-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1848-5-0x0000000004460000-0x0000000004786000-memory.dmpFilesize
3.1MB
-
memory/1848-644-0x0000000000400000-0x0000000000726000-memory.dmpFilesize
3.1MB
-
memory/1848-648-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2512-51-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-57-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-14-0x0000000000400000-0x000000000049E000-memory.dmpFilesize
632KB
-
memory/2512-17-0x0000000000400000-0x000000000049E000-memory.dmpFilesize
632KB
-
memory/2512-19-0x0000000000400000-0x000000000049E000-memory.dmpFilesize
632KB
-
memory/2512-18-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-28-0x0000000076F00000-0x0000000077010000-memory.dmpFilesize
1.1MB
-
memory/2512-29-0x0000000076F00000-0x0000000077010000-memory.dmpFilesize
1.1MB
-
memory/2512-30-0x0000000076F00000-0x0000000077010000-memory.dmpFilesize
1.1MB
-
memory/2512-33-0x0000000000810000-0x0000000000820000-memory.dmpFilesize
64KB
-
memory/2512-32-0x0000000000810000-0x0000000000820000-memory.dmpFilesize
64KB
-
memory/2512-31-0x0000000000810000-0x0000000000820000-memory.dmpFilesize
64KB
-
memory/2512-35-0x00000000020F0000-0x0000000002130000-memory.dmpFilesize
256KB
-
memory/2512-34-0x00000000749E0000-0x0000000074F8B000-memory.dmpFilesize
5.7MB
-
memory/2512-36-0x00000000749E0000-0x0000000074F8B000-memory.dmpFilesize
5.7MB
-
memory/2512-37-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-38-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-39-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-40-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-43-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-41-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-42-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-44-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-45-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-46-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-49-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-47-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-48-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-50-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-10-0x0000000000400000-0x000000000049E000-memory.dmpFilesize
632KB
-
memory/2512-52-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-53-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-54-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-55-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-56-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-8-0x0000000000400000-0x000000000049E000-memory.dmpFilesize
632KB
-
memory/2512-58-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-61-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-59-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-62-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-63-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-60-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-66-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-69-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-67-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-68-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-70-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-72-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-73-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-74-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-75-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-76-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-82-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-80-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-81-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-83-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-84-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-78-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-79-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-12-0x0000000000400000-0x000000000049E000-memory.dmpFilesize
632KB
-
memory/2512-6-0x0000000000400000-0x000000000049E000-memory.dmpFilesize
632KB
-
memory/2512-77-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-71-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-64-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-65-0x00000000004A0000-0x0000000000534000-memory.dmpFilesize
592KB
-
memory/2512-652-0x0000000000400000-0x000000000049E000-memory.dmpFilesize
632KB
-
memory/2512-653-0x0000000000810000-0x0000000000820000-memory.dmpFilesize
64KB
-
memory/2512-654-0x0000000000810000-0x0000000000820000-memory.dmpFilesize
64KB
-
memory/2512-655-0x0000000000810000-0x0000000000820000-memory.dmpFilesize
64KB
-
memory/2512-656-0x00000000749E0000-0x0000000074F8B000-memory.dmpFilesize
5.7MB
-
memory/2512-658-0x00000000020F0000-0x0000000002130000-memory.dmpFilesize
256KB
-
memory/2512-3-0x0000000000400000-0x000000000049E000-memory.dmpFilesize
632KB