Analysis
- max time kernel
147s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
20/06/2024, 13:34
General
- Target 0676a4274247f6a643409f26ba2a9f82_JaffaCakes118.exe
- Size 711KB
- Sample240620-qvapjsvapn
- SHA256 a34d912a7741568d4bae092927bfea529396c59a9cd6458d0a9e1446b6493b39
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 7 IoCs
- Drops file in System32 directory 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0676a4274247f6a643409f26ba2a9f82_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0676a4274247f6a643409f26ba2a9f82_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\system32\mstsc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 123⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2744 -ip 27441⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/380-0-0x0000000000400000-0x000000000056E016-memory.dmp
memory/380-3-0x0000000000400000-0x000000000056E016-memory.dmp
memory/380-9-0x0000000000400000-0x000000000056E016-memory.dmp
memory/380-8-0x0000000000400000-0x000000000056E016-memory.dmp
memory/380-5-0x0000000000400000-0x000000000056E016-memory.dmp
memory/380-7-0x00000000004BD000-0x0000000000566000-memory.dmp
memory/380-13-0x0000000000400000-0x000000000056E016-memory.dmp
memory/380-6-0x0000000000400000-0x000000000056E016-memory.dmp
memory/380-1-0x0000000000400000-0x000000000056E016-memory.dmp
memory/2744-11-0x0000000000400000-0x000000000056F000-memory.dmp