Analysis

  • max time kernel
    140s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 17:36

General

  • Target

    0848d5dc5126f2408164f41c6161ef13_JaffaCakes118.exe

  • Size

    632KB

  • MD5

    0848d5dc5126f2408164f41c6161ef13

  • SHA1

    cc00ee2c6516b7b6b1048769ae5666788f526a10

  • SHA256

    613bc88c22cbaac5ae9d3cb7c1b68b37ef48662201bed7ad386ad1df80250f97

  • SHA512

    ddcdcf3a72385269f6993954869dd7404d15d489b4cd5c5e940e48a2344abc5301e37a54cd83368a8beab1fc78d5e9acf90166c867328018ca57b8f381560de3

  • SSDEEP

    12288:1hwQclhOmYTB1Cffopg/u66DLIxHM4zCma65kqpkZpIXdUZyu:1qLlhm1CIvDKsy8qyZO

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0848d5dc5126f2408164f41c6161ef13_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0848d5dc5126f2408164f41c6161ef13_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1848
    • C:\program files\internet explorer\IEXPLORE.EXE
      "C:\program files\internet explorer\IEXPLORE.EXE"
      2⤵
        PID:2668
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 312
        2⤵
        • Program crash
        PID:2660

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1848-0-0x0000000000340000-0x0000000000394000-memory.dmp

      Filesize

      336KB

    • memory/1848-32-0x0000000003380000-0x0000000003383000-memory.dmp

      Filesize

      12KB

    • memory/1848-31-0x0000000003380000-0x0000000003381000-memory.dmp

      Filesize

      4KB

    • memory/1848-30-0x0000000003380000-0x0000000003381000-memory.dmp

      Filesize

      4KB

    • memory/1848-29-0x0000000003380000-0x0000000003381000-memory.dmp

      Filesize

      4KB

    • memory/1848-28-0x0000000003380000-0x0000000003381000-memory.dmp

      Filesize

      4KB

    • memory/1848-27-0x0000000003380000-0x0000000003381000-memory.dmp

      Filesize

      4KB

    • memory/1848-26-0x0000000003380000-0x0000000003381000-memory.dmp

      Filesize

      4KB

    • memory/1848-25-0x0000000003380000-0x0000000003381000-memory.dmp

      Filesize

      4KB

    • memory/1848-24-0x0000000003380000-0x0000000003381000-memory.dmp

      Filesize

      4KB

    • memory/1848-23-0x0000000003380000-0x0000000003381000-memory.dmp

      Filesize

      4KB

    • memory/1848-22-0x0000000003380000-0x0000000003381000-memory.dmp

      Filesize

      4KB

    • memory/1848-21-0x0000000003480000-0x0000000003481000-memory.dmp

      Filesize

      4KB

    • memory/1848-20-0x0000000003480000-0x0000000003481000-memory.dmp

      Filesize

      4KB

    • memory/1848-19-0x0000000003480000-0x0000000003481000-memory.dmp

      Filesize

      4KB

    • memory/1848-18-0x0000000003380000-0x0000000003381000-memory.dmp

      Filesize

      4KB

    • memory/1848-17-0x0000000003390000-0x0000000003391000-memory.dmp

      Filesize

      4KB

    • memory/1848-16-0x0000000003390000-0x0000000003391000-memory.dmp

      Filesize

      4KB

    • memory/1848-15-0x0000000003390000-0x0000000003391000-memory.dmp

      Filesize

      4KB

    • memory/1848-14-0x0000000003390000-0x0000000003391000-memory.dmp

      Filesize

      4KB

    • memory/1848-13-0x0000000003390000-0x0000000003391000-memory.dmp

      Filesize

      4KB

    • memory/1848-12-0x0000000003390000-0x0000000003391000-memory.dmp

      Filesize

      4KB

    • memory/1848-11-0x0000000003390000-0x0000000003391000-memory.dmp

      Filesize

      4KB

    • memory/1848-10-0x0000000003390000-0x0000000003391000-memory.dmp

      Filesize

      4KB

    • memory/1848-9-0x0000000001F80000-0x0000000001F81000-memory.dmp

      Filesize

      4KB

    • memory/1848-8-0x0000000002110000-0x0000000002111000-memory.dmp

      Filesize

      4KB

    • memory/1848-7-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

      Filesize

      4KB

    • memory/1848-6-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

      Filesize

      4KB

    • memory/1848-5-0x0000000000830000-0x0000000000831000-memory.dmp

      Filesize

      4KB

    • memory/1848-4-0x0000000001F70000-0x0000000001F71000-memory.dmp

      Filesize

      4KB

    • memory/1848-3-0x0000000002100000-0x0000000002101000-memory.dmp

      Filesize

      4KB

    • memory/1848-2-0x0000000001F90000-0x0000000001F91000-memory.dmp

      Filesize

      4KB

    • memory/1848-1-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

      Filesize

      4KB

    • memory/1848-39-0x00000000033E0000-0x00000000033E1000-memory.dmp

      Filesize

      4KB

    • memory/1848-42-0x0000000000620000-0x0000000000621000-memory.dmp

      Filesize

      4KB

    • memory/1848-41-0x0000000003410000-0x0000000003411000-memory.dmp

      Filesize

      4KB

    • memory/1848-40-0x00000000033D0000-0x00000000033D1000-memory.dmp

      Filesize

      4KB

    • memory/1848-38-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/1848-37-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/1848-36-0x00000000033C0000-0x00000000033C1000-memory.dmp

      Filesize

      4KB

    • memory/1848-35-0x0000000000270000-0x0000000000271000-memory.dmp

      Filesize

      4KB

    • memory/1848-34-0x0000000000260000-0x0000000000261000-memory.dmp

      Filesize

      4KB

    • memory/1848-33-0x0000000003390000-0x0000000003391000-memory.dmp

      Filesize

      4KB

    • memory/1848-44-0x0000000000400000-0x0000000000515000-memory.dmp

      Filesize

      1.1MB

    • memory/1848-45-0x0000000000340000-0x0000000000394000-memory.dmp

      Filesize

      336KB

    • memory/1848-47-0x0000000003380000-0x0000000003381000-memory.dmp

      Filesize

      4KB

    • memory/1848-46-0x0000000003480000-0x0000000003481000-memory.dmp

      Filesize

      4KB

    • memory/1848-49-0x0000000000620000-0x0000000000621000-memory.dmp

      Filesize

      4KB