Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 01:05
Static task
static1
Behavioral task
behavioral1
Sample
019a7c75a7de917a68c6c3d4a581deba_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
019a7c75a7de917a68c6c3d4a581deba_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
019a7c75a7de917a68c6c3d4a581deba_JaffaCakes118.exe
-
Size
469KB
-
MD5
019a7c75a7de917a68c6c3d4a581deba
-
SHA1
dec92d969fd68b55b5aad02d524f8710514e66bd
-
SHA256
bcc8642447b1112558003498fc5dc963394893c8a2c385abec83b1b2cec89239
-
SHA512
5c37b0614c278dd6d7b43183a1ea66df072cca24bfbce6db7ccb561f48c9b53d4d16ed537f1f4efcc0d83ba64f750f458159d8523f98c477ca64b10280021365
-
SSDEEP
6144:/2/TDu9fQQqMES9u+OimD5F2idZecnl20lHRxp3gLncduD7yB9VCO6Sco4q8+dED:u/TDAfPLZ9EF3Z4mxxkDqVTVOCk
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4532-58-0x0000000013140000-0x000000001321E000-memory.dmp modiloader_stage2 behavioral2/memory/1252-56-0x0000000013140000-0x000000001321E000-memory.dmp modiloader_stage2 behavioral2/memory/1252-60-0x0000000013140000-0x000000001321E000-memory.dmp modiloader_stage2 behavioral2/memory/4532-2-0x0000000013140000-0x000000001321E000-memory.dmp modiloader_stage2 behavioral2/memory/1252-61-0x0000000010410000-0x0000000010468000-memory.dmp modiloader_stage2 behavioral2/memory/1252-743-0x0000000013140000-0x000000001321E000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
netservice.exepid process 1252 netservice.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
netservice.exesvchost.exedescription pid process Token: SeDebugPrivilege 1252 netservice.exe Token: SeIncBasePriorityPrivilege 1924 svchost.exe Token: SeIncBasePriorityPrivilege 1924 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
019a7c75a7de917a68c6c3d4a581deba_JaffaCakes118.exenetservice.exedescription pid process target process PID 4532 wrote to memory of 4204 4532 019a7c75a7de917a68c6c3d4a581deba_JaffaCakes118.exe cmd.exe PID 4532 wrote to memory of 4204 4532 019a7c75a7de917a68c6c3d4a581deba_JaffaCakes118.exe cmd.exe PID 4532 wrote to memory of 4204 4532 019a7c75a7de917a68c6c3d4a581deba_JaffaCakes118.exe cmd.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe PID 1252 wrote to memory of 1924 1252 netservice.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\019a7c75a7de917a68c6c3d4a581deba_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\019a7c75a7de917a68c6c3d4a581deba_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\019a7c75a7de917a68c6c3d4a581deba_JaffaCakes118.exe"2⤵
-
C:\Users\Admin\Favorites\netservice.exeC:\Users\Admin\Favorites\netservice.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Favorites\netservice.exeFilesize
469KB
MD5019a7c75a7de917a68c6c3d4a581deba
SHA1dec92d969fd68b55b5aad02d524f8710514e66bd
SHA256bcc8642447b1112558003498fc5dc963394893c8a2c385abec83b1b2cec89239
SHA5125c37b0614c278dd6d7b43183a1ea66df072cca24bfbce6db7ccb561f48c9b53d4d16ed537f1f4efcc0d83ba64f750f458159d8523f98c477ca64b10280021365
-
memory/1252-56-0x0000000013140000-0x000000001321E000-memory.dmpFilesize
888KB
-
memory/1252-60-0x0000000013140000-0x000000001321E000-memory.dmpFilesize
888KB
-
memory/1252-61-0x0000000010410000-0x0000000010468000-memory.dmpFilesize
352KB
-
memory/1252-743-0x0000000013140000-0x000000001321E000-memory.dmpFilesize
888KB
-
memory/1924-63-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB
-
memory/1924-62-0x0000000000380000-0x0000000000381000-memory.dmpFilesize
4KB
-
memory/4532-30-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-26-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-46-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-53-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-58-0x0000000013140000-0x000000001321E000-memory.dmpFilesize
888KB
-
memory/4532-59-0x0000000002070000-0x00000000020C4000-memory.dmpFilesize
336KB
-
memory/4532-52-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-51-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-50-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-49-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-45-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-44-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-43-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-42-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-41-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-40-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-39-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-38-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-37-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-36-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-34-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-33-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-32-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-3-0x0000000002290000-0x0000000002291000-memory.dmpFilesize
4KB
-
memory/4532-29-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-28-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-27-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-23-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-25-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-24-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-22-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-21-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-20-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-19-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-18-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-17-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-16-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-15-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-14-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-13-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-12-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-11-0x0000000002260000-0x0000000002261000-memory.dmpFilesize
4KB
-
memory/4532-10-0x00000000022D0000-0x00000000022D1000-memory.dmpFilesize
4KB
-
memory/4532-9-0x00000000022A0000-0x00000000022A1000-memory.dmpFilesize
4KB
-
memory/4532-8-0x00000000022B0000-0x00000000022B1000-memory.dmpFilesize
4KB
-
memory/4532-7-0x0000000002240000-0x0000000002241000-memory.dmpFilesize
4KB
-
memory/4532-6-0x0000000002250000-0x0000000002251000-memory.dmpFilesize
4KB
-
memory/4532-5-0x00000000022C0000-0x00000000022C1000-memory.dmpFilesize
4KB
-
memory/4532-4-0x0000000002270000-0x0000000002271000-memory.dmpFilesize
4KB
-
memory/4532-1-0x0000000002070000-0x00000000020C4000-memory.dmpFilesize
336KB
-
memory/4532-0-0x0000000013140000-0x000000001321E000-memory.dmpFilesize
888KB
-
memory/4532-31-0x0000000003230000-0x0000000003270000-memory.dmpFilesize
256KB
-
memory/4532-2-0x0000000013140000-0x000000001321E000-memory.dmpFilesize
888KB