Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 21:27

General

  • Target

    0971d66032eea65229912a66a407f0f4_JaffaCakes118.exe

  • Size

    370KB

  • MD5

    0971d66032eea65229912a66a407f0f4

  • SHA1

    8596505166e950c404b8ee17dd2a75a4174a1d6f

  • SHA256

    4f2fa7465b436705948981e5d7857513c41246750ac01bc06d5298193f328f71

  • SHA512

    a3a2c497448679aeab45a7b3c1599c399c92a5d00f3ab866206b5dc1e7542406824fd8b444d0fa94eb659e9898879e220b4f6625f046d72678fcb7746c1a0cfc

  • SSDEEP

    6144:SneX48vxqhd/fXttTk9f17rvQpDFyUF24z5IyGUksTBvSNlt0:SeI8v0hdHXXkl17424zvGFsTt6K

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 2 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0971d66032eea65229912a66a407f0f4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0971d66032eea65229912a66a407f0f4_JaffaCakes118.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1696
    • C:\Users\Admin\AppData\Local\Temp\tempdir.exe
      C:\Users\Admin\AppData\Local\Temp\tempdir.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:2168
      • C:\program files\internet explorer\IEXPLORE.EXE
        "C:\program files\internet explorer\IEXPLORE.EXE"
        3⤵
          PID:2920

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\tempdir.exe

      Filesize

      362KB

      MD5

      e93b9cb0d9258820eb108889327d1284

      SHA1

      5384059f00d378aabf9bd5082d100f75ca442cbf

      SHA256

      450ecac14e98b43be31d8672d0f48bf3ebc2dfd3a7edfc8bb80629bf3b1139e5

      SHA512

      8677067371868f3ba509d1322748c78baa0207b3918c7513dc11ec39987cecc1f564ed79e8fd07559a378c847ac3742ef66e89c042f97f25338b63d20210c6a8

    • memory/1696-0-0x0000000000400000-0x0000000000460000-memory.dmp

      Filesize

      384KB

    • memory/1696-11-0x0000000001C30000-0x0000000001CE8000-memory.dmp

      Filesize

      736KB

    • memory/1696-10-0x0000000001C30000-0x0000000001CE8000-memory.dmp

      Filesize

      736KB

    • memory/1696-17-0x0000000000400000-0x0000000000460000-memory.dmp

      Filesize

      384KB

    • memory/2168-12-0x0000000000400000-0x00000000004B7400-memory.dmp

      Filesize

      733KB

    • memory/2168-15-0x0000000000260000-0x0000000000261000-memory.dmp

      Filesize

      4KB

    • memory/2168-18-0x0000000000400000-0x00000000004B7400-memory.dmp

      Filesize

      733KB