Analysis

  • max time kernel
    141s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2024 16:00

General

  • Target

    0788c37203ee42e831037748ff1ab552_JaffaCakes118.exe

  • Size

    24KB

  • MD5

    0788c37203ee42e831037748ff1ab552

  • SHA1

    979580f8d6458375076a2908e952a8f46e296f7f

  • SHA256

    fc0768c35c5e49f0dd72e7039034d6b5b58cd053532172ca7876cd9b5f3255d4

  • SHA512

    1b24574bd34a77d1bbb15c2a82ae26e1472fcb2f355c4b40ec3b301b1444b3442568a1a77a33bd5deeedf8f129b8f3630316a566afb9ce8dc98049b2e37ef2a0

  • SSDEEP

    384:1Kj7Wmqzu/RQ+mLyvXYu5+z0Y3w9mTKNoHBFe4K08EJCo8UAWP+Pl+HGSR:4jh+upC2/kzw92Fe3zZaAblQ

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0788c37203ee42e831037748ff1ab552_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0788c37203ee42e831037748ff1ab552_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4408
    • C:\Windows\winwl.exe
      C:\Windows\winwl.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      PID:2612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\kulionwl.dll

    Filesize

    27KB

    MD5

    2e5cc49adbc9099c2f4d6a7541efbdc2

    SHA1

    3c816c62b3286f9364c4867e6b2af43806c2a3c9

    SHA256

    f543e782745b63f938546312049acf5707dbf4e16ceeebf25afddb4216eca1bc

    SHA512

    de60f5882c98d16f09557a85d955176700d00f6d004b9acc28976cc415ad0ce7226fe10402bdd5ddbe9d4fbd2697be94e11e56390ef79635726735caad1ed6c7

  • C:\Windows\winwl.exe

    Filesize

    24KB

    MD5

    0788c37203ee42e831037748ff1ab552

    SHA1

    979580f8d6458375076a2908e952a8f46e296f7f

    SHA256

    fc0768c35c5e49f0dd72e7039034d6b5b58cd053532172ca7876cd9b5f3255d4

    SHA512

    1b24574bd34a77d1bbb15c2a82ae26e1472fcb2f355c4b40ec3b301b1444b3442568a1a77a33bd5deeedf8f129b8f3630316a566afb9ce8dc98049b2e37ef2a0

  • memory/2612-11-0x0000000002130000-0x000000000213D000-memory.dmp

    Filesize

    52KB

  • memory/2612-15-0x0000000002130000-0x000000000213D000-memory.dmp

    Filesize

    52KB

  • memory/2612-17-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/4408-0-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/4408-14-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB