Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
20/06/2024, 12:24
General
- Target 05f64ccb6ccd1434a3637770665cad13_JaffaCakes118.exe
- Size 682KB
- Sample240620-plgaas1fll
- SHA256 41728c38b160db9a1807f9d26a2bae8a923d8cf1903281cab19f892c6a6e73c2
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 6 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops file in System32 directory 2 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Program Files directory 3 IoCs
- Program crash 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 30 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\05f64ccb6ccd1434a3637770665cad13_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05f64ccb6ccd1434a3637770665cad13_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\8.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\8.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\7.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\7.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 125⤵
- Program crash
-
-
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupDel.bat""3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4552 -ip 45521⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
SetupDel.bat
7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
suggestions[1].en-US
8.exe
memory/980-42-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-39-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-22-0x0000000003100000-0x0000000003101000-memory.dmp
memory/980-21-0x0000000003100000-0x0000000003101000-memory.dmp
memory/980-29-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-62-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-79-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-78-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-76-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-75-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-74-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-73-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-72-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-71-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-70-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-69-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-68-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-67-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-66-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-65-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-64-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-63-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-61-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-60-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-59-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-58-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-55-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-54-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-53-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-52-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-51-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-50-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-49-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-48-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-47-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-46-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-45-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-44-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-43-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-24-0x0000000003100000-0x0000000003101000-memory.dmp
memory/980-23-0x0000000003100000-0x0000000003101000-memory.dmp
memory/980-41-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-6-0x0000000000650000-0x0000000000651000-memory.dmp
memory/980-38-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-37-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-36-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-35-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-34-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-33-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-32-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-31-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-30-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-57-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-20-0x0000000003100000-0x0000000003101000-memory.dmp
memory/980-19-0x0000000003100000-0x0000000003101000-memory.dmp
memory/980-18-0x0000000003100000-0x0000000003101000-memory.dmp
memory/980-17-0x0000000003110000-0x0000000003111000-memory.dmp
memory/980-16-0x0000000003110000-0x0000000003111000-memory.dmp
memory/980-15-0x0000000003110000-0x0000000003111000-memory.dmp
memory/980-14-0x0000000003110000-0x0000000003111000-memory.dmp
memory/980-13-0x0000000003110000-0x0000000003111000-memory.dmp
memory/980-12-0x0000000003110000-0x0000000003111000-memory.dmp
memory/980-11-0x0000000003110000-0x0000000003111000-memory.dmp
memory/980-10-0x0000000000680000-0x0000000000681000-memory.dmp
memory/980-9-0x00000000006F0000-0x00000000006F1000-memory.dmp
memory/980-8-0x00000000006C0000-0x00000000006C1000-memory.dmp
memory/980-7-0x00000000006D0000-0x00000000006D1000-memory.dmp
memory/980-40-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-5-0x0000000000660000-0x0000000000661000-memory.dmp
memory/980-4-0x00000000006E0000-0x00000000006E1000-memory.dmp
memory/980-3-0x0000000000690000-0x0000000000691000-memory.dmp
memory/980-2-0x00000000006B0000-0x00000000006B1000-memory.dmp
memory/980-98-0x00000000004E0000-0x0000000000534000-memory.dmp
memory/980-99-0x0000000001000000-0x000000000110E000-memory.dmp
memory/980-1-0x00000000004E0000-0x0000000000534000-memory.dmp
memory/980-26-0x0000000003100000-0x000000000311B000-memory.dmp
memory/980-25-0x0000000003100000-0x0000000003101000-memory.dmp
memory/980-0-0x0000000001000000-0x000000000110E000-memory.dmp
memory/2884-91-0x0000000000CE0000-0x0000000000DA4000-memory.dmp
memory/3048-81-0x0000000000400000-0x00000000004C3200-memory.dmp
memory/3048-96-0x0000000000400000-0x00000000004C3200-memory.dmp
memory/4552-89-0x00000000004C0000-0x0000000000584000-memory.dmp
memory/4820-94-0x0000000000400000-0x00000000004C3200-memory.dmp