Analysis

  • max time kernel
    143s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 21:36

General

  • Target

    097d297d04200e1094a2ca5694303587_JaffaCakes118.exe

  • Size

    636KB

  • MD5

    097d297d04200e1094a2ca5694303587

  • SHA1

    ffae1a3f4e314d6f7783fff3b70ba638e8653131

  • SHA256

    09fa9e5b270fb1e33ade2295bd56dd00194013f5b42e8618ed8eb733798290ef

  • SHA512

    d1238e5430360f83ad8c32527657e819af356d5ac8fd6f958a3751ca0d8cf6b754b95f352d658dd1da7596a13aed8f8a74269ef676366281b62002b24b57d604

  • SSDEEP

    12288:LJkV9+yzCWv4nS+MPxcnc5g/ftF3Z4mxxz7Zm1jGmYae4mrRO:VSBrvRDPyc5g3tQmXzlmlGmI4

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 3 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\097d297d04200e1094a2ca5694303587_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\097d297d04200e1094a2ca5694303587_JaffaCakes118.exe"
    1⤵
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Windows\rejoice101.exe
      C:\Windows\rejoice101.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:2664
      • C:\Windows\SysWOW64\calc.exe
        "C:\Windows\system32\calc.exe"
        3⤵
          PID:2972
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 320
          3⤵
          • Program crash
          PID:2356
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c C:\Windows\DelSvel.bat
        2⤵
        • Deletes itself
        PID:472

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\DelSvel.bat

      Filesize

      212B

      MD5

      9c6aa0178ed69baf465d5c56165677d8

      SHA1

      e0ecec3a676b3e50255e601d5c12d738857e1557

      SHA256

      d259521aebc4733592ec7ee5baba7f9dc64aa670b61945e755c0cee38e5f15b9

      SHA512

      27d2cef660399fababd6b1f4918fb04cc3b10b3410962ca732748d802bce14ea3e77bb6ffa798ce321bed6acacb893a3d6865698c678ab31cb950afea6c5aa07

    • F:\rejoice101.exe

      Filesize

      636KB

      MD5

      097d297d04200e1094a2ca5694303587

      SHA1

      ffae1a3f4e314d6f7783fff3b70ba638e8653131

      SHA256

      09fa9e5b270fb1e33ade2295bd56dd00194013f5b42e8618ed8eb733798290ef

      SHA512

      d1238e5430360f83ad8c32527657e819af356d5ac8fd6f958a3751ca0d8cf6b754b95f352d658dd1da7596a13aed8f8a74269ef676366281b62002b24b57d604

    • memory/1672-17-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1672-70-0x0000000001E80000-0x0000000001ED4000-memory.dmp

      Filesize

      336KB

    • memory/1672-6-0x00000000003E0000-0x00000000003E1000-memory.dmp

      Filesize

      4KB

    • memory/1672-5-0x00000000003F0000-0x00000000003F1000-memory.dmp

      Filesize

      4KB

    • memory/1672-12-0x0000000003370000-0x0000000003371000-memory.dmp

      Filesize

      4KB

    • memory/1672-14-0x0000000003460000-0x0000000003461000-memory.dmp

      Filesize

      4KB

    • memory/1672-13-0x0000000003360000-0x0000000003364000-memory.dmp

      Filesize

      16KB

    • memory/1672-11-0x0000000003360000-0x0000000003460000-memory.dmp

      Filesize

      1024KB

    • memory/1672-0-0x0000000000400000-0x000000000051D000-memory.dmp

      Filesize

      1.1MB

    • memory/1672-9-0x0000000002100000-0x0000000002101000-memory.dmp

      Filesize

      4KB

    • memory/1672-4-0x00000000020F0000-0x00000000020F1000-memory.dmp

      Filesize

      4KB

    • memory/1672-3-0x0000000001E50000-0x0000000001E51000-memory.dmp

      Filesize

      4KB

    • memory/1672-2-0x00000000020C0000-0x00000000020C1000-memory.dmp

      Filesize

      4KB

    • memory/1672-21-0x00000000033D0000-0x00000000033D1000-memory.dmp

      Filesize

      4KB

    • memory/1672-20-0x00000000033E0000-0x00000000033E1000-memory.dmp

      Filesize

      4KB

    • memory/1672-19-0x0000000003380000-0x0000000003381000-memory.dmp

      Filesize

      4KB

    • memory/1672-18-0x0000000003390000-0x0000000003391000-memory.dmp

      Filesize

      4KB

    • memory/1672-22-0x00000000003D0000-0x00000000003D1000-memory.dmp

      Filesize

      4KB

    • memory/1672-10-0x0000000001E40000-0x0000000001E41000-memory.dmp

      Filesize

      4KB

    • memory/1672-7-0x00000000020E0000-0x00000000020E1000-memory.dmp

      Filesize

      4KB

    • memory/1672-69-0x0000000000400000-0x000000000051D000-memory.dmp

      Filesize

      1.1MB

    • memory/1672-8-0x00000000020D0000-0x00000000020D1000-memory.dmp

      Filesize

      4KB

    • memory/1672-39-0x0000000004270000-0x000000000438D000-memory.dmp

      Filesize

      1.1MB

    • memory/1672-38-0x0000000004270000-0x000000000438D000-memory.dmp

      Filesize

      1.1MB

    • memory/1672-16-0x00000000002A0000-0x00000000002A1000-memory.dmp

      Filesize

      4KB

    • memory/1672-15-0x0000000000290000-0x0000000000291000-memory.dmp

      Filesize

      4KB

    • memory/1672-1-0x0000000001E80000-0x0000000001ED4000-memory.dmp

      Filesize

      336KB

    • memory/1672-56-0x0000000004270000-0x000000000438D000-memory.dmp

      Filesize

      1.1MB

    • memory/1672-50-0x0000000000400000-0x000000000051D000-memory.dmp

      Filesize

      1.1MB

    • memory/1672-51-0x0000000001E80000-0x0000000001ED4000-memory.dmp

      Filesize

      336KB

    • memory/1672-52-0x0000000003360000-0x0000000003460000-memory.dmp

      Filesize

      1024KB

    • memory/1672-55-0x00000000003D0000-0x00000000003D1000-memory.dmp

      Filesize

      4KB

    • memory/2664-54-0x0000000000400000-0x000000000051D000-memory.dmp

      Filesize

      1.1MB

    • memory/2664-58-0x0000000000330000-0x0000000000384000-memory.dmp

      Filesize

      336KB

    • memory/2664-41-0x0000000000330000-0x0000000000384000-memory.dmp

      Filesize

      336KB

    • memory/2664-40-0x0000000000400000-0x000000000051D000-memory.dmp

      Filesize

      1.1MB

    • memory/2972-45-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2972-48-0x0000000000400000-0x000000000051D000-memory.dmp

      Filesize

      1.1MB