Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07/04/2024, 23:02

General

  • Target

    e60f3e023405f91bf40a324441163477_JaffaCakes118.exe

  • Size

    3.4MB

  • MD5

    e60f3e023405f91bf40a324441163477

  • SHA1

    786838d2c03900038a0e84fb71dc6e63330f9810

  • SHA256

    62b524c500c62010924f1d1affb3b47e7e5dd1e84519ec2e5f35ffc6a11cfe01

  • SHA512

    defe98aafd2fc9a1092f9563498310e6ef968841f8d30c5f7f7bd028388575f4180d45723cd6ec7d3a75cb382fec1dd839c1ecd014ec7de5f97b6c12969be1eb

  • SSDEEP

    49152:agWMKS9blZgboINq8396BYbTS+pxUCp0R6S4PxJoUiTX7Hg2qKx3EexkF:KMKM1f8oB4TZpB08JUvA2JBkF

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 2 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e60f3e023405f91bf40a324441163477_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e60f3e023405f91bf40a324441163477_JaffaCakes118.exe"
    1⤵
    • Identifies Wine through registry keys
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2880
    • C:\Users\Admin\AppData\Local\Temp\e60f3e023405f91bf40a324441163477_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\e60f3e023405f91bf40a324441163477_JaffaCakes118.exe
      2⤵
      • Identifies Wine through registry keys
      • Suspicious behavior: EnumeratesProcesses
      PID:2732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2732-30-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-53-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-62-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-57-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-58-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-56-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-54-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-55-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-52-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-36-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-47-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-19-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-51-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2732-50-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-49-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-25-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-29-0x0000000020000000-0x00000000204E6000-memory.dmp

    Filesize

    4.9MB

  • memory/2732-28-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-48-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-31-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-33-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-34-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/2732-32-0x0000000001ED0000-0x0000000002016000-memory.dmp

    Filesize

    1.3MB

  • memory/2732-46-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-45-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-37-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-35-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-38-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-39-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-40-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-41-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-42-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-43-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2732-44-0x0000000000400000-0x0000000000737000-memory.dmp

    Filesize

    3.2MB

  • memory/2880-13-0x0000000004230000-0x0000000004231000-memory.dmp

    Filesize

    4KB

  • memory/2880-9-0x0000000004220000-0x0000000004221000-memory.dmp

    Filesize

    4KB

  • memory/2880-27-0x0000000020000000-0x00000000204E6000-memory.dmp

    Filesize

    4.9MB

  • memory/2880-15-0x0000000004240000-0x0000000004241000-memory.dmp

    Filesize

    4KB

  • memory/2880-22-0x0000000003EB0000-0x0000000003EB1000-memory.dmp

    Filesize

    4KB

  • memory/2880-0-0x0000000020000000-0x00000000204E6000-memory.dmp

    Filesize

    4.9MB

  • memory/2880-2-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/2880-18-0x0000000000680000-0x0000000000681000-memory.dmp

    Filesize

    4KB

  • memory/2880-21-0x00000000048F0000-0x0000000004DD6000-memory.dmp

    Filesize

    4.9MB

  • memory/2880-11-0x0000000004200000-0x0000000004201000-memory.dmp

    Filesize

    4KB

  • memory/2880-17-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2880-7-0x0000000004210000-0x0000000004211000-memory.dmp

    Filesize

    4KB

  • memory/2880-6-0x0000000020000000-0x00000000204E6000-memory.dmp

    Filesize

    4.9MB

  • memory/2880-3-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2880-1-0x0000000001C30000-0x0000000001D87000-memory.dmp

    Filesize

    1.3MB