Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 16:30

General

  • Target

    07c1c5bcb1cd1add57fc61db4acc25ab_JaffaCakes118.exe

  • Size

    646KB

  • MD5

    07c1c5bcb1cd1add57fc61db4acc25ab

  • SHA1

    b6eda21fd0d090258eb3f3f5e298990fb9fdae9e

  • SHA256

    569d8d3d1e0a999f19dfb6b0a90172734c209b5b8123e2581b837d4c612c4cdf

  • SHA512

    13eba47ff72aca6219f04c9349be0c8474c585d42cdf7e4f77b2e313b446e538a29158e8342514ecc622be03cc485ef86eb9f6e520721caefc6d91bcde99e40a

  • SSDEEP

    12288:oa4iYr9Im0kJRkCPj1Qa0woiegYGnpKDVlSlCEwsKf0:oaPYr9ImpR9/ppegYJZlSlCEwsP

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 2 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\07c1c5bcb1cd1add57fc61db4acc25ab_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\07c1c5bcb1cd1add57fc61db4acc25ab_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1288
    • C:\Program Files\Common Files\Microsoft Shared\MSINFO\LSSRC.EXE
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\LSSRC.EXE"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3068
      • C:\Windows\SysWOW64\calc.exe
        "C:\Windows\system32\calc.exe"
        3⤵
          PID:2808
        • C:\Windows\SysWOW64\mstsc.exe
          "C:\Windows\system32\mstsc.exe"
          3⤵
            PID:2564
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat""
          2⤵
          • Deletes itself
          PID:2296

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files\Common Files\Microsoft Shared\MSInfo\DelSvel.bat

        Filesize

        212B

        MD5

        d2aeae54294fa4b356021a8b67300bc8

        SHA1

        63d838516e334191a3232bdca6af85373018a0f8

        SHA256

        f26b206555a0ad11f2ffec69061cb0db3a430ed78758cb89e1d9ad6c2c295db4

        SHA512

        cc16be86bc2761ba3e2ca033702d75815c1915951c8c57a3120acb8a6ccb0e046799307a16d270c7d53409a83bcbaf00370e18228f771e8240e5a8b200612d39

      • \Program Files\Common Files\Microsoft Shared\MSInfo\LSSRC.EXE

        Filesize

        646KB

        MD5

        07c1c5bcb1cd1add57fc61db4acc25ab

        SHA1

        b6eda21fd0d090258eb3f3f5e298990fb9fdae9e

        SHA256

        569d8d3d1e0a999f19dfb6b0a90172734c209b5b8123e2581b837d4c612c4cdf

        SHA512

        13eba47ff72aca6219f04c9349be0c8474c585d42cdf7e4f77b2e313b446e538a29158e8342514ecc622be03cc485ef86eb9f6e520721caefc6d91bcde99e40a

      • memory/1288-10-0x00000000021C0000-0x00000000021C1000-memory.dmp

        Filesize

        4KB

      • memory/1288-19-0x0000000003440000-0x0000000003441000-memory.dmp

        Filesize

        4KB

      • memory/1288-8-0x0000000001EB0000-0x0000000001EB1000-memory.dmp

        Filesize

        4KB

      • memory/1288-15-0x0000000003520000-0x0000000003521000-memory.dmp

        Filesize

        4KB

      • memory/1288-7-0x00000000006B0000-0x00000000006B1000-memory.dmp

        Filesize

        4KB

      • memory/1288-18-0x00000000002C0000-0x00000000002C1000-memory.dmp

        Filesize

        4KB

      • memory/1288-17-0x00000000002B0000-0x00000000002B1000-memory.dmp

        Filesize

        4KB

      • memory/1288-16-0x0000000003470000-0x0000000003471000-memory.dmp

        Filesize

        4KB

      • memory/1288-14-0x0000000003420000-0x0000000003423000-memory.dmp

        Filesize

        12KB

      • memory/1288-13-0x0000000003430000-0x0000000003431000-memory.dmp

        Filesize

        4KB

      • memory/1288-12-0x0000000003420000-0x0000000003520000-memory.dmp

        Filesize

        1024KB

      • memory/1288-6-0x00000000006C0000-0x00000000006C1000-memory.dmp

        Filesize

        4KB

      • memory/1288-0-0x0000000000400000-0x00000000005C0000-memory.dmp

        Filesize

        1.8MB

      • memory/1288-9-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

        Filesize

        4KB

      • memory/1288-3-0x0000000001E90000-0x0000000001E91000-memory.dmp

        Filesize

        4KB

      • memory/1288-4-0x0000000001E70000-0x0000000001E71000-memory.dmp

        Filesize

        4KB

      • memory/1288-11-0x0000000001E60000-0x0000000001E61000-memory.dmp

        Filesize

        4KB

      • memory/1288-5-0x00000000021B0000-0x00000000021B1000-memory.dmp

        Filesize

        4KB

      • memory/1288-2-0x0000000001E00000-0x0000000001E54000-memory.dmp

        Filesize

        336KB

      • memory/1288-28-0x00000000046F0000-0x00000000048B0000-memory.dmp

        Filesize

        1.8MB

      • memory/1288-30-0x00000000046F0000-0x00000000048B0000-memory.dmp

        Filesize

        1.8MB

      • memory/1288-53-0x0000000001E00000-0x0000000001E54000-memory.dmp

        Filesize

        336KB

      • memory/1288-1-0x0000000000020000-0x0000000000021000-memory.dmp

        Filesize

        4KB

      • memory/1288-52-0x0000000000400000-0x00000000005C0000-memory.dmp

        Filesize

        1.8MB

      • memory/2564-40-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2808-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2808-38-0x0000000000400000-0x00000000005C0000-memory.dmp

        Filesize

        1.8MB

      • memory/3068-51-0x0000000000400000-0x00000000005C0000-memory.dmp

        Filesize

        1.8MB

      • memory/3068-31-0x0000000000400000-0x00000000005C0000-memory.dmp

        Filesize

        1.8MB