Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-06-2024 19:05
Static task
static1
Behavioral task
behavioral1
Sample
0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
-
Size
584KB
-
MD5
0016bdd1e1bdadcdbdc86c8ce3523502
-
SHA1
0837fbd506aaa8910a3c91b4f69a2e2b2b844bb2
-
SHA256
a65a9e13d34e41f5544f5a1e3690b95c1f4394d65de86c42afaaa9496a4b9981
-
SHA512
3f85a80bbc4ef5badb71817c349ceb8f724634f38c4ba50258a40eeaf3a855cd957d727ce69bdd34a13bd21088953c51936dfbef392554333b7d36768c8f4864
-
SSDEEP
12288:SQCvNHO+/uCmJ4Cl8hqHd77tF3Z4mxx0o3ABt4QCdeOf:SQHHCm47Q9XtQmX0Qut4QCde+
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2916-11-0x0000000003270000-0x000000000331B000-memory.dmp modiloader_stage2 behavioral1/memory/2916-67-0x0000000000400000-0x0000000000559000-memory.dmp modiloader_stage2 -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exedescription ioc process File opened (read-only) \??\L: 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe File opened (read-only) \??\N: 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe File opened (read-only) \??\Q: 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe File opened (read-only) \??\U: 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe File opened (read-only) \??\B: 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe File opened (read-only) \??\E: 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe File opened (read-only) \??\G: 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe File opened (read-only) \??\I: 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe File opened (read-only) \??\X: 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe File opened (read-only) \??\Z: 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe File opened (read-only) \??\H: 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe File opened (read-only) \??\K: 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe File opened (read-only) \??\V: 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe File opened (read-only) \??\W: 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe File opened (read-only) \??\R: 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe File opened (read-only) \??\S: 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe File opened (read-only) \??\T: 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe File opened (read-only) \??\A: 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe File opened (read-only) \??\J: 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe File opened (read-only) \??\O: 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe File opened (read-only) \??\P: 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe File opened (read-only) \??\M: 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe File opened (read-only) \??\Y: 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exedescription ioc process File opened for modification C:\AutoRun.inf 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe File opened for modification F:\AutoRun.inf 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe -
Drops file in Program Files directory 1 IoCs
Processes:
0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\paramstr.txt 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2416 2916 WerFault.exe 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exedescription pid process target process PID 2916 wrote to memory of 2668 2916 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe IEXPLORE.EXE PID 2916 wrote to memory of 2668 2916 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe IEXPLORE.EXE PID 2916 wrote to memory of 2668 2916 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe IEXPLORE.EXE PID 2916 wrote to memory of 2668 2916 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe IEXPLORE.EXE PID 2916 wrote to memory of 2416 2916 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe WerFault.exe PID 2916 wrote to memory of 2416 2916 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe WerFault.exe PID 2916 wrote to memory of 2416 2916 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe WerFault.exe PID 2916 wrote to memory of 2416 2916 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 3122⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\AutoRun.infFilesize
169B
MD51da0b273a8dd7961b24c6163e6ae0de2
SHA17a4f5e9a6934cc9ef9166d3ef3adf2535ccad6b2
SHA256705ff32cb59644357122365403e7b6ed3ed6a4e9789836321468b5cb5db97cae
SHA512d4f7e3dedd726988ebef8fd0ea93dc380ba50862257ceae1c30e0e974402d850a057d74ef995d2ed909a70f5479437539396911d0ea05fc80669e2ef57c74cdb
-
memory/2916-38-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-1-0x0000000000280000-0x00000000002D4000-memory.dmpFilesize
336KB
-
memory/2916-10-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2916-9-0x00000000005C0000-0x00000000005C1000-memory.dmpFilesize
4KB
-
memory/2916-7-0x00000000005A0000-0x00000000005A1000-memory.dmpFilesize
4KB
-
memory/2916-6-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/2916-5-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/2916-4-0x00000000005B0000-0x00000000005B1000-memory.dmpFilesize
4KB
-
memory/2916-3-0x0000000000560000-0x0000000000561000-memory.dmpFilesize
4KB
-
memory/2916-2-0x0000000000580000-0x0000000000581000-memory.dmpFilesize
4KB
-
memory/2916-11-0x0000000003270000-0x000000000331B000-memory.dmpFilesize
684KB
-
memory/2916-18-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-19-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-17-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-16-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-15-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-14-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-13-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-20-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-22-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-24-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-27-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-37-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-25-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-23-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-21-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-12-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-29-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-28-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-30-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-32-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-31-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-33-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-36-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-35-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-34-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-44-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-45-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-43-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-42-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-41-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-40-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-47-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/2916-39-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-98-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-8-0x0000000000590000-0x0000000000591000-memory.dmpFilesize
4KB
-
memory/2916-26-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-46-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-67-0x0000000000400000-0x0000000000559000-memory.dmpFilesize
1.3MB
-
memory/2916-69-0x0000000000280000-0x00000000002D4000-memory.dmpFilesize
336KB
-
memory/2916-70-0x0000000003270000-0x000000000331B000-memory.dmpFilesize
684KB
-
memory/2916-86-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-110-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-109-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-108-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-107-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-106-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-105-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-104-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-103-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-102-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-101-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-100-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-99-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-0-0x0000000000400000-0x0000000000559000-memory.dmpFilesize
1.3MB
-
memory/2916-97-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-96-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-95-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-94-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-93-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-92-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-91-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-90-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-89-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-88-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-87-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-85-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-84-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-83-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-82-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-81-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-80-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-79-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-78-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-77-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-76-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-75-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-74-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-73-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-72-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/2916-71-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB