Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 15:05
Static task
static1
Behavioral task
behavioral1
Sample
0718c590352a10a5fb647c775059f447_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0718c590352a10a5fb647c775059f447_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0718c590352a10a5fb647c775059f447_JaffaCakes118.exe
-
Size
589KB
-
MD5
0718c590352a10a5fb647c775059f447
-
SHA1
ef7037a97789c9670c60a02395aaebcc739652fc
-
SHA256
bb60fd410e1a3fd36f5d8e43ff0e5534dc2a2765ae2a3000a8d14b9304d1bd92
-
SHA512
169985b972ec6a9d62618dbd6912bd446ac0b452d935c95340fa3cc3450f8f59b5f82ac4def5ab2e58da2dfb1190af8f56e42911d2c128321f2bf243231b9d07
-
SSDEEP
12288:Let/IVLAmSdWnrdDWK+XRHWPKcPn+vF3Z4mxxvYJphAR2USG4:LcgOmqWrdDWfHWScwQmXvYaR2USG4
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2952-78-0x0000000000400000-0x0000000000557000-memory.dmp modiloader_stage2 behavioral1/memory/2168-91-0x0000000000400000-0x0000000000557000-memory.dmp modiloader_stage2 behavioral1/memory/2168-112-0x0000000000400000-0x0000000000557000-memory.dmp modiloader_stage2 behavioral1/memory/2952-114-0x0000000000400000-0x0000000000557000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2840 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
time.exepid process 2168 time.exe -
Loads dropped DLL 2 IoCs
Processes:
0718c590352a10a5fb647c775059f447_JaffaCakes118.exepid process 2952 0718c590352a10a5fb647c775059f447_JaffaCakes118.exe 2952 0718c590352a10a5fb647c775059f447_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
Processes:
time.exedescription ioc process File created C:\Windows\SysWOW64\_time.exe time.exe File opened for modification C:\Windows\SysWOW64\_time.exe time.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
time.exedescription pid process target process PID 2168 set thread context of 1584 2168 time.exe calc.exe PID 2168 set thread context of 2644 2168 time.exe svchost.exe -
Drops file in Program Files directory 3 IoCs
Processes:
0718c590352a10a5fb647c775059f447_JaffaCakes118.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\time.exe 0718c590352a10a5fb647c775059f447_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\time.exe 0718c590352a10a5fb647c775059f447_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat 0718c590352a10a5fb647c775059f447_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
0718c590352a10a5fb647c775059f447_JaffaCakes118.exetime.exedescription pid process target process PID 2952 wrote to memory of 2168 2952 0718c590352a10a5fb647c775059f447_JaffaCakes118.exe time.exe PID 2952 wrote to memory of 2168 2952 0718c590352a10a5fb647c775059f447_JaffaCakes118.exe time.exe PID 2952 wrote to memory of 2168 2952 0718c590352a10a5fb647c775059f447_JaffaCakes118.exe time.exe PID 2952 wrote to memory of 2168 2952 0718c590352a10a5fb647c775059f447_JaffaCakes118.exe time.exe PID 2168 wrote to memory of 1584 2168 time.exe calc.exe PID 2168 wrote to memory of 1584 2168 time.exe calc.exe PID 2168 wrote to memory of 1584 2168 time.exe calc.exe PID 2168 wrote to memory of 1584 2168 time.exe calc.exe PID 2168 wrote to memory of 1584 2168 time.exe calc.exe PID 2168 wrote to memory of 1584 2168 time.exe calc.exe PID 2168 wrote to memory of 2644 2168 time.exe svchost.exe PID 2168 wrote to memory of 2644 2168 time.exe svchost.exe PID 2168 wrote to memory of 2644 2168 time.exe svchost.exe PID 2168 wrote to memory of 2644 2168 time.exe svchost.exe PID 2168 wrote to memory of 2644 2168 time.exe svchost.exe PID 2168 wrote to memory of 2644 2168 time.exe svchost.exe PID 2952 wrote to memory of 2840 2952 0718c590352a10a5fb647c775059f447_JaffaCakes118.exe cmd.exe PID 2952 wrote to memory of 2840 2952 0718c590352a10a5fb647c775059f447_JaffaCakes118.exe cmd.exe PID 2952 wrote to memory of 2840 2952 0718c590352a10a5fb647c775059f447_JaffaCakes118.exe cmd.exe PID 2952 wrote to memory of 2840 2952 0718c590352a10a5fb647c775059f447_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0718c590352a10a5fb647c775059f447_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0718c590352a10a5fb647c775059f447_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Program Files\Common Files\Microsoft Shared\MSINFO\time.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\time.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:1584
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"3⤵PID:2644
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat""2⤵
- Deletes itself
PID:2840
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD576f4f64c36235149e1b93f1420e29311
SHA1d918584788206e19231cc084ad545940f41528a0
SHA256daa33e8c3a34e27a56ad316be88e45c739a13934e43e6057510d547c04833b6f
SHA512503be45fa1ff869ed51586254b4d8cdfd28dd0b642e5db8290ec5b8c5624bd68cf2c4c25310052bc2179358f9bc002189b23ed246b993e122d3d788bbf10abc7
-
Filesize
589KB
MD50718c590352a10a5fb647c775059f447
SHA1ef7037a97789c9670c60a02395aaebcc739652fc
SHA256bb60fd410e1a3fd36f5d8e43ff0e5534dc2a2765ae2a3000a8d14b9304d1bd92
SHA512169985b972ec6a9d62618dbd6912bd446ac0b452d935c95340fa3cc3450f8f59b5f82ac4def5ab2e58da2dfb1190af8f56e42911d2c128321f2bf243231b9d07