Analysis
-
max time kernel
51s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 06:11
Behavioral task
behavioral1
Sample
a845de7e8d88bb394683f055d5c539f1_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
a845de7e8d88bb394683f055d5c539f1_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
a845de7e8d88bb394683f055d5c539f1_JaffaCakes118.exe
-
Size
104KB
-
MD5
a845de7e8d88bb394683f055d5c539f1
-
SHA1
341ea7996fe18db12ab960b54e58e5d13483fc19
-
SHA256
f61291715f368c2089c99aff3811382b17314750e6f3088fa1c96bdfb37ed383
-
SHA512
8ba77d7225c562fe5d720aeb959facf7cf4b445c8a788bd84c9351a61cab417b51b1a01d8eb2ec865704a1c3a3d45b8eaa962f7af3372f40d111bfe7a7595f80
-
SSDEEP
3072:PLCnfuTOxhDd5CufhHXZPXnPryHd9UykJ65MMCY:PcxdCufBXx/md9Uy7MM
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
Processes:
resource yara_rule C:\Windows\apocalyps32.exe modiloader_stage2 behavioral2/memory/3152-4-0x0000000000010000-0x0000000000030000-memory.dmp modiloader_stage2 behavioral2/memory/4644-5-0x0000000000010000-0x0000000000030000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
apocalyps32.exepid process 4644 apocalyps32.exe -
Drops file in Windows directory 3 IoCs
Processes:
a845de7e8d88bb394683f055d5c539f1_JaffaCakes118.exeapocalyps32.exedescription ioc process File created C:\Windows\apocalyps32.exe a845de7e8d88bb394683f055d5c539f1_JaffaCakes118.exe File opened for modification C:\Windows\apocalyps32.exe a845de7e8d88bb394683f055d5c539f1_JaffaCakes118.exe File created C:\Windows\apocalyps32.exe apocalyps32.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
a845de7e8d88bb394683f055d5c539f1_JaffaCakes118.exeapocalyps32.exedescription pid process target process PID 3152 wrote to memory of 4644 3152 a845de7e8d88bb394683f055d5c539f1_JaffaCakes118.exe apocalyps32.exe PID 3152 wrote to memory of 4644 3152 a845de7e8d88bb394683f055d5c539f1_JaffaCakes118.exe apocalyps32.exe PID 3152 wrote to memory of 4644 3152 a845de7e8d88bb394683f055d5c539f1_JaffaCakes118.exe apocalyps32.exe PID 4644 wrote to memory of 6052 4644 apocalyps32.exe msedge.exe PID 4644 wrote to memory of 6052 4644 apocalyps32.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a845de7e8d88bb394683f055d5c539f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a845de7e8d88bb394683f055d5c539f1_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\apocalyps32.exe-bs2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe-bs3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\apocalyps32.exeFilesize
104KB
MD5a845de7e8d88bb394683f055d5c539f1
SHA1341ea7996fe18db12ab960b54e58e5d13483fc19
SHA256f61291715f368c2089c99aff3811382b17314750e6f3088fa1c96bdfb37ed383
SHA5128ba77d7225c562fe5d720aeb959facf7cf4b445c8a788bd84c9351a61cab417b51b1a01d8eb2ec865704a1c3a3d45b8eaa962f7af3372f40d111bfe7a7595f80
-
memory/3152-4-0x0000000000010000-0x0000000000030000-memory.dmpFilesize
128KB
-
memory/4644-5-0x0000000000010000-0x0000000000030000-memory.dmpFilesize
128KB