Analysis
-
max time kernel
145s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-06-2024 09:56
Behavioral task
behavioral1
Sample
b803cbdebe97b11bf1315129362e6cb9_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b803cbdebe97b11bf1315129362e6cb9_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
b803cbdebe97b11bf1315129362e6cb9_JaffaCakes118.exe
-
Size
84KB
-
MD5
b803cbdebe97b11bf1315129362e6cb9
-
SHA1
9c88cd51078c8f6b61fda47fae6a39ecd111f1e0
-
SHA256
4d6b7109a4c1640f0c68a06c53d54f64425d6cbe6c84d88fc18a0c5adedeb187
-
SHA512
fda931c19cb7ccc0768365087892be4619e9ece8546c185ab706ebfc907573fccccd4daeaa9f3a269c667bde3867f5a491381482418cd1d4b585f7a2ba397bb5
-
SSDEEP
1536:BeP5NJ2OOnVZV9+QwdiHbzXShcpNYAAroExqs:BW5P4RvOiHnXSOpNErx0
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 16 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\chost.exe modiloader_stage2 behavioral1/memory/1520-8-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral1/memory/1664-10-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral1/memory/1664-11-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral1/memory/1664-12-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral1/memory/1664-13-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral1/memory/1664-14-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral1/memory/1664-15-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral1/memory/1664-16-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral1/memory/1664-17-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral1/memory/1664-18-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral1/memory/1664-19-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral1/memory/1664-20-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral1/memory/1664-21-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral1/memory/1664-22-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral1/memory/1664-23-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
chost.exepid process 1664 chost.exe -
Loads dropped DLL 2 IoCs
Processes:
b803cbdebe97b11bf1315129362e6cb9_JaffaCakes118.exepid process 1520 b803cbdebe97b11bf1315129362e6cb9_JaffaCakes118.exe 1520 b803cbdebe97b11bf1315129362e6cb9_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
chost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\host = "C:\\Users\\Admin\\AppData\\Local\\chost.exe" chost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
chost.exepid process 1664 chost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
b803cbdebe97b11bf1315129362e6cb9_JaffaCakes118.exedescription pid process target process PID 1520 wrote to memory of 1664 1520 b803cbdebe97b11bf1315129362e6cb9_JaffaCakes118.exe chost.exe PID 1520 wrote to memory of 1664 1520 b803cbdebe97b11bf1315129362e6cb9_JaffaCakes118.exe chost.exe PID 1520 wrote to memory of 1664 1520 b803cbdebe97b11bf1315129362e6cb9_JaffaCakes118.exe chost.exe PID 1520 wrote to memory of 1664 1520 b803cbdebe97b11bf1315129362e6cb9_JaffaCakes118.exe chost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b803cbdebe97b11bf1315129362e6cb9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b803cbdebe97b11bf1315129362e6cb9_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\chost.exe"C:\Users\Admin\AppData\Local\chost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\chost.exeFilesize
84KB
MD5b803cbdebe97b11bf1315129362e6cb9
SHA19c88cd51078c8f6b61fda47fae6a39ecd111f1e0
SHA2564d6b7109a4c1640f0c68a06c53d54f64425d6cbe6c84d88fc18a0c5adedeb187
SHA512fda931c19cb7ccc0768365087892be4619e9ece8546c185ab706ebfc907573fccccd4daeaa9f3a269c667bde3867f5a491381482418cd1d4b585f7a2ba397bb5
-
memory/1520-8-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1664-10-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1664-11-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1664-12-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1664-13-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1664-14-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1664-15-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1664-16-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1664-17-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1664-18-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1664-19-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1664-20-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1664-21-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1664-22-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1664-23-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB