Analysis

  • max time kernel
    142s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 16:32

General

  • Target

    07c570dd70589229a0421d681977a743_JaffaCakes118.exe

  • Size

    732KB

  • MD5

    07c570dd70589229a0421d681977a743

  • SHA1

    2aed17a0a83135117cf59278b5d46ba293c45380

  • SHA256

    f0913c4ceef7752db1bdda7e70617512da8e6ab399f329c0c77eb01d1aa199b1

  • SHA512

    0ceb158f1009d4b8e7ac022a7ad15c001abd2b73959ec513abc2851e32abd8fc5544e1b9564bcfeee7985bf078f23b9b36f61770122e78e1502798abebb17a48

  • SSDEEP

    12288:JPdsCAmVw2f+LEXLjDk3aXDlkd3dTw6X6tF3Z4mxxJ4H8tcFA8WS:JPpVw2f+LEppwdU6X6tQmX+H8mH

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 2 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\07c570dd70589229a0421d681977a743_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\07c570dd70589229a0421d681977a743_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Users\Admin\AppData\Local\Temp\07c570dd70589229a0421d681977a743_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\07c570dd70589229a0421d681977a743_JaffaCakes118.exe
      2⤵
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:2092
      • C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice101.exe
        "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice101.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2784
        • C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice101.exe
          "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice101.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2852
          • C:\Windows\SysWOW64\calc.exe
            "C:\Windows\system32\calc.exe"
            5⤵
              PID:2484
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 280
              5⤵
              • Loads dropped DLL
              • Program crash
              PID:2560
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat""
          3⤵
          • Deletes itself
          PID:2652

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\DelSvel.bat

      Filesize

      212B

      MD5

      0dcca9fd2a7303501e9a819f0969d91c

      SHA1

      5b71dd6267b8f905aeb2260a1b9c25683e4686bc

      SHA256

      1d139972ca03486b6379293282ebeb3aa30b6087af9f3972974f55de367a4b77

      SHA512

      81d847c0d215d6357eec4f6e27fe515b69c37070275aab2e4c46fe03965694bd5dc5f44728f5009046ff2a02b55869c2a8b5c795bd507825e0b160b651b883ee

    • \Program Files\Common Files\Microsoft Shared\MSInfo\rejoice101.exe

      Filesize

      732KB

      MD5

      07c570dd70589229a0421d681977a743

      SHA1

      2aed17a0a83135117cf59278b5d46ba293c45380

      SHA256

      f0913c4ceef7752db1bdda7e70617512da8e6ab399f329c0c77eb01d1aa199b1

      SHA512

      0ceb158f1009d4b8e7ac022a7ad15c001abd2b73959ec513abc2851e32abd8fc5544e1b9564bcfeee7985bf078f23b9b36f61770122e78e1502798abebb17a48

    • memory/1936-29-0x0000000003230000-0x0000000003231000-memory.dmp

      Filesize

      4KB

    • memory/1936-12-0x00000000031E0000-0x00000000031E2000-memory.dmp

      Filesize

      8KB

    • memory/1936-10-0x0000000000510000-0x0000000000511000-memory.dmp

      Filesize

      4KB

    • memory/1936-27-0x0000000003230000-0x0000000003231000-memory.dmp

      Filesize

      4KB

    • memory/1936-8-0x0000000001D70000-0x0000000001D71000-memory.dmp

      Filesize

      4KB

    • memory/1936-7-0x0000000001D80000-0x0000000001D81000-memory.dmp

      Filesize

      4KB

    • memory/1936-6-0x00000000004F0000-0x00000000004F1000-memory.dmp

      Filesize

      4KB

    • memory/1936-5-0x0000000000500000-0x0000000000501000-memory.dmp

      Filesize

      4KB

    • memory/1936-4-0x0000000001D90000-0x0000000001D91000-memory.dmp

      Filesize

      4KB

    • memory/1936-3-0x0000000000520000-0x0000000000521000-memory.dmp

      Filesize

      4KB

    • memory/1936-2-0x0000000000540000-0x0000000000541000-memory.dmp

      Filesize

      4KB

    • memory/1936-13-0x0000000003230000-0x0000000003330000-memory.dmp

      Filesize

      1024KB

    • memory/1936-14-0x0000000003230000-0x0000000003330000-memory.dmp

      Filesize

      1024KB

    • memory/1936-36-0x0000000003930000-0x00000000039F3000-memory.dmp

      Filesize

      780KB

    • memory/1936-35-0x0000000000400000-0x00000000004C3000-memory.dmp

      Filesize

      780KB

    • memory/1936-34-0x0000000003200000-0x0000000003201000-memory.dmp

      Filesize

      4KB

    • memory/1936-33-0x0000000003210000-0x0000000003211000-memory.dmp

      Filesize

      4KB

    • memory/1936-25-0x0000000003230000-0x0000000003231000-memory.dmp

      Filesize

      4KB

    • memory/1936-31-0x00000000002B0000-0x00000000002B1000-memory.dmp

      Filesize

      4KB

    • memory/1936-30-0x0000000000220000-0x0000000000221000-memory.dmp

      Filesize

      4KB

    • memory/1936-1-0x0000000000310000-0x0000000000364000-memory.dmp

      Filesize

      336KB

    • memory/1936-28-0x0000000003230000-0x0000000003231000-memory.dmp

      Filesize

      4KB

    • memory/1936-9-0x0000000001DA0000-0x0000000001DA1000-memory.dmp

      Filesize

      4KB

    • memory/1936-75-0x0000000003930000-0x00000000039F3000-memory.dmp

      Filesize

      780KB

    • memory/1936-32-0x0000000003220000-0x0000000003221000-memory.dmp

      Filesize

      4KB

    • memory/1936-24-0x0000000003230000-0x0000000003231000-memory.dmp

      Filesize

      4KB

    • memory/1936-23-0x0000000003230000-0x0000000003231000-memory.dmp

      Filesize

      4KB

    • memory/1936-22-0x0000000003230000-0x0000000003231000-memory.dmp

      Filesize

      4KB

    • memory/1936-21-0x0000000003230000-0x0000000003231000-memory.dmp

      Filesize

      4KB

    • memory/1936-20-0x0000000003230000-0x0000000003231000-memory.dmp

      Filesize

      4KB

    • memory/1936-19-0x0000000003230000-0x0000000003231000-memory.dmp

      Filesize

      4KB

    • memory/1936-18-0x0000000003230000-0x0000000003231000-memory.dmp

      Filesize

      4KB

    • memory/1936-17-0x0000000000310000-0x0000000000364000-memory.dmp

      Filesize

      336KB

    • memory/1936-26-0x0000000003230000-0x0000000003231000-memory.dmp

      Filesize

      4KB

    • memory/1936-11-0x00000000031F0000-0x00000000031F1000-memory.dmp

      Filesize

      4KB

    • memory/1936-0-0x0000000000400000-0x00000000004C3000-memory.dmp

      Filesize

      780KB

    • memory/2092-47-0x0000000003040000-0x0000000003103000-memory.dmp

      Filesize

      780KB

    • memory/2092-41-0x0000000003040000-0x0000000003103000-memory.dmp

      Filesize

      780KB

    • memory/2092-61-0x0000000000400000-0x00000000004C0000-memory.dmp

      Filesize

      768KB

    • memory/2092-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2484-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2484-68-0x0000000000400000-0x00000000004C3000-memory.dmp

      Filesize

      780KB

    • memory/2784-48-0x0000000000400000-0x00000000004C3000-memory.dmp

      Filesize

      780KB

    • memory/2784-62-0x0000000000400000-0x00000000004C3000-memory.dmp

      Filesize

      780KB

    • memory/2852-74-0x0000000000400000-0x00000000004C0000-memory.dmp

      Filesize

      768KB