Analysis

  • max time kernel
    51s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2024 15:05

General

  • Target

    0718c590352a10a5fb647c775059f447_JaffaCakes118.exe

  • Size

    589KB

  • MD5

    0718c590352a10a5fb647c775059f447

  • SHA1

    ef7037a97789c9670c60a02395aaebcc739652fc

  • SHA256

    bb60fd410e1a3fd36f5d8e43ff0e5534dc2a2765ae2a3000a8d14b9304d1bd92

  • SHA512

    169985b972ec6a9d62618dbd6912bd446ac0b452d935c95340fa3cc3450f8f59b5f82ac4def5ab2e58da2dfb1190af8f56e42911d2c128321f2bf243231b9d07

  • SSDEEP

    12288:Let/IVLAmSdWnrdDWK+XRHWPKcPn+vF3Z4mxxvYJphAR2USG4:LcgOmqWrdDWfHWScwQmXvYaR2USG4

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0718c590352a10a5fb647c775059f447_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0718c590352a10a5fb647c775059f447_JaffaCakes118.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:4692
    • C:\Program Files\Common Files\Microsoft Shared\MSINFO\time.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\time.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:316
      • C:\Windows\SysWOW64\calc.exe
        "C:\Windows\system32\calc.exe"
        3⤵
          PID:2564
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 12
            4⤵
            • Program crash
            PID:412
        • C:\Windows\SysWOW64\svchost.exe
          "C:\Windows\system32\svchost.exe"
          3⤵
            PID:3188
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 684
            3⤵
            • Program crash
            PID:2544
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat""
          2⤵
            PID:4760
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 316 -ip 316
          1⤵
            PID:4812
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2564 -ip 2564
            1⤵
              PID:3888

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat

              Filesize

              212B

              MD5

              76f4f64c36235149e1b93f1420e29311

              SHA1

              d918584788206e19231cc084ad545940f41528a0

              SHA256

              daa33e8c3a34e27a56ad316be88e45c739a13934e43e6057510d547c04833b6f

              SHA512

              503be45fa1ff869ed51586254b4d8cdfd28dd0b642e5db8290ec5b8c5624bd68cf2c4c25310052bc2179358f9bc002189b23ed246b993e122d3d788bbf10abc7

            • C:\Program Files\Common Files\microsoft shared\MSInfo\time.exe

              Filesize

              589KB

              MD5

              0718c590352a10a5fb647c775059f447

              SHA1

              ef7037a97789c9670c60a02395aaebcc739652fc

              SHA256

              bb60fd410e1a3fd36f5d8e43ff0e5534dc2a2765ae2a3000a8d14b9304d1bd92

              SHA512

              169985b972ec6a9d62618dbd6912bd446ac0b452d935c95340fa3cc3450f8f59b5f82ac4def5ab2e58da2dfb1190af8f56e42911d2c128321f2bf243231b9d07

            • memory/316-81-0x0000000000400000-0x0000000000557000-memory.dmp

              Filesize

              1.3MB

            • memory/316-82-0x0000000000400000-0x0000000000557000-memory.dmp

              Filesize

              1.3MB

            • memory/316-93-0x0000000000400000-0x0000000000557000-memory.dmp

              Filesize

              1.3MB

            • memory/2564-85-0x0000000000400000-0x0000000000557000-memory.dmp

              Filesize

              1.3MB

            • memory/4692-40-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-9-0x0000000002470000-0x0000000002471000-memory.dmp

              Filesize

              4KB

            • memory/4692-74-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-73-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-72-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-71-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-70-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-68-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-67-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-69-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-66-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-65-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-64-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-63-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-62-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-61-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-60-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-59-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-58-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-57-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-56-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-55-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-54-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-53-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-52-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-51-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-50-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-49-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-48-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-38-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-46-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-45-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-44-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-43-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-36-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-41-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-1-0x0000000002200000-0x0000000002254000-memory.dmp

              Filesize

              336KB

            • memory/4692-39-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-47-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-26-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-42-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-35-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-34-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-33-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-32-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-31-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-30-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-29-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-28-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-27-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-25-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-24-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-23-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-22-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-21-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-20-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-19-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-18-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-17-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-16-0x00000000033D0000-0x00000000033D1000-memory.dmp

              Filesize

              4KB

            • memory/4692-15-0x00000000033D0000-0x00000000033D1000-memory.dmp

              Filesize

              4KB

            • memory/4692-14-0x00000000033D0000-0x00000000033D1000-memory.dmp

              Filesize

              4KB

            • memory/4692-13-0x00000000033D0000-0x00000000033D1000-memory.dmp

              Filesize

              4KB

            • memory/4692-12-0x00000000033D0000-0x00000000033D1000-memory.dmp

              Filesize

              4KB

            • memory/4692-11-0x00000000033D0000-0x00000000033D1000-memory.dmp

              Filesize

              4KB

            • memory/4692-10-0x00000000022F0000-0x00000000022F1000-memory.dmp

              Filesize

              4KB

            • memory/4692-37-0x00000000033C0000-0x00000000033C1000-memory.dmp

              Filesize

              4KB

            • memory/4692-8-0x0000000002440000-0x0000000002441000-memory.dmp

              Filesize

              4KB

            • memory/4692-7-0x0000000002450000-0x0000000002451000-memory.dmp

              Filesize

              4KB

            • memory/4692-6-0x00000000022D0000-0x00000000022D1000-memory.dmp

              Filesize

              4KB

            • memory/4692-5-0x00000000022E0000-0x00000000022E1000-memory.dmp

              Filesize

              4KB

            • memory/4692-4-0x0000000002460000-0x0000000002461000-memory.dmp

              Filesize

              4KB

            • memory/4692-3-0x0000000002300000-0x0000000002301000-memory.dmp

              Filesize

              4KB

            • memory/4692-2-0x0000000002430000-0x0000000002431000-memory.dmp

              Filesize

              4KB

            • memory/4692-75-0x0000000000400000-0x0000000000557000-memory.dmp

              Filesize

              1.3MB

            • memory/4692-89-0x0000000000400000-0x0000000000557000-memory.dmp

              Filesize

              1.3MB

            • memory/4692-0-0x0000000000400000-0x0000000000557000-memory.dmp

              Filesize

              1.3MB

            • memory/4692-90-0x0000000002200000-0x0000000002254000-memory.dmp

              Filesize

              336KB