Analysis

  • max time kernel
    151s
  • max time network
    164s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2024 17:09

General

  • Target

    0812ca75d13ff0ed86bc29edbed3cc94_JaffaCakes118.exe

  • Size

    682KB

  • MD5

    0812ca75d13ff0ed86bc29edbed3cc94

  • SHA1

    f05fa0e094648ad88340858e105e30b9b95699d1

  • SHA256

    c3a2a615367c4146d9d18fbf212469599fec07f8ccdb38e5e8fa5036f899a6eb

  • SHA512

    5cbdfcbb7e5bf6acb7f8bc245fed032a7914d68760b55f359d35a4b5fbfcb350a0a6989c0f7f6f815c2c658d79e821f38f25f5d2b620d643a94a49fc984849d1

  • SSDEEP

    12288:GCak3wugOJ63b6colgOcIdA6cyhnUF3Z4mxxnsqWmXAnMECUQIZ1D6BF:Fa9ugOUr6TKsWSUQmXsPyAnMECT4gF

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0812ca75d13ff0ed86bc29edbed3cc94_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0812ca75d13ff0ed86bc29edbed3cc94_JaffaCakes118.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:4284
    • C:\Program Files\Common Files\Microsoft Shared\MSINFO\winrars32.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\winrars32.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:4228
      • C:\Windows\SysWOW64\calc.exe
        "C:\Windows\system32\calc.exe"
        3⤵
          PID:2744
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 664
          3⤵
          • Program crash
          PID:5028
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 664
          3⤵
          • Program crash
          PID:1612
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat""
        2⤵
          PID:1392
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4228 -ip 4228
        1⤵
          PID:2656
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
          1⤵
            PID:400

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat

            Filesize

            212B

            MD5

            b82da111a58e6027bafaac4780c2f6cc

            SHA1

            e56bae62ddf649ff2ce0821f56e8d90f6b86cdc8

            SHA256

            960591688dcd69c1d915791a81dead50030848054ff1ab124219faffa4d7ea1f

            SHA512

            8228a6018af6c6ddb4380bcc8342bd9c62e960c3697839ff0db6a4c986e757855ab994fe0934821ab8a790e27ee5866116ee1dce2e302c527bbd129dd5033f11

          • C:\Program Files\Common Files\microsoft shared\MSInfo\winrars32.exe

            Filesize

            682KB

            MD5

            0812ca75d13ff0ed86bc29edbed3cc94

            SHA1

            f05fa0e094648ad88340858e105e30b9b95699d1

            SHA256

            c3a2a615367c4146d9d18fbf212469599fec07f8ccdb38e5e8fa5036f899a6eb

            SHA512

            5cbdfcbb7e5bf6acb7f8bc245fed032a7914d68760b55f359d35a4b5fbfcb350a0a6989c0f7f6f815c2c658d79e821f38f25f5d2b620d643a94a49fc984849d1

          • memory/4228-46-0x0000000000400000-0x0000000000523000-memory.dmp

            Filesize

            1.1MB

          • memory/4228-45-0x0000000000400000-0x0000000000523000-memory.dmp

            Filesize

            1.1MB

          • memory/4228-33-0x0000000000400000-0x0000000000523000-memory.dmp

            Filesize

            1.1MB

          • memory/4284-10-0x00000000023F0000-0x00000000023F1000-memory.dmp

            Filesize

            4KB

          • memory/4284-6-0x00000000023D0000-0x00000000023D1000-memory.dmp

            Filesize

            4KB

          • memory/4284-21-0x00000000006F0000-0x00000000006F1000-memory.dmp

            Filesize

            4KB

          • memory/4284-20-0x0000000003520000-0x0000000003521000-memory.dmp

            Filesize

            4KB

          • memory/4284-17-0x00000000035D0000-0x00000000035D1000-memory.dmp

            Filesize

            4KB

          • memory/4284-16-0x00000000035D0000-0x00000000035D1000-memory.dmp

            Filesize

            4KB

          • memory/4284-15-0x00000000034D0000-0x00000000034D3000-memory.dmp

            Filesize

            12KB

          • memory/4284-14-0x00000000034E0000-0x00000000034E1000-memory.dmp

            Filesize

            4KB

          • memory/4284-13-0x00000000034E0000-0x00000000034E1000-memory.dmp

            Filesize

            4KB

          • memory/4284-12-0x00000000034E0000-0x00000000034E1000-memory.dmp

            Filesize

            4KB

          • memory/4284-11-0x00000000034D0000-0x00000000035D0000-memory.dmp

            Filesize

            1024KB

          • memory/4284-0-0x0000000000400000-0x0000000000523000-memory.dmp

            Filesize

            1.1MB

          • memory/4284-9-0x0000000002580000-0x0000000002581000-memory.dmp

            Filesize

            4KB

          • memory/4284-8-0x0000000002550000-0x0000000002551000-memory.dmp

            Filesize

            4KB

          • memory/4284-7-0x0000000002560000-0x0000000002561000-memory.dmp

            Filesize

            4KB

          • memory/4284-22-0x00000000034F0000-0x00000000034F1000-memory.dmp

            Filesize

            4KB

          • memory/4284-5-0x00000000023E0000-0x00000000023E1000-memory.dmp

            Filesize

            4KB

          • memory/4284-4-0x0000000002570000-0x0000000002571000-memory.dmp

            Filesize

            4KB

          • memory/4284-2-0x0000000002430000-0x0000000002431000-memory.dmp

            Filesize

            4KB

          • memory/4284-3-0x0000000002400000-0x0000000002401000-memory.dmp

            Filesize

            4KB

          • memory/4284-23-0x00000000035D0000-0x00000000035D1000-memory.dmp

            Filesize

            4KB

          • memory/4284-32-0x0000000000400000-0x0000000000523000-memory.dmp

            Filesize

            1.1MB

          • memory/4284-24-0x0000000000700000-0x0000000000701000-memory.dmp

            Filesize

            4KB

          • memory/4284-35-0x0000000002340000-0x0000000002394000-memory.dmp

            Filesize

            336KB

          • memory/4284-36-0x00000000034D0000-0x00000000035D0000-memory.dmp

            Filesize

            1024KB

          • memory/4284-42-0x0000000000400000-0x0000000000523000-memory.dmp

            Filesize

            1.1MB

          • memory/4284-43-0x0000000002340000-0x0000000002394000-memory.dmp

            Filesize

            336KB

          • memory/4284-18-0x00000000035D0000-0x00000000035D1000-memory.dmp

            Filesize

            4KB

          • memory/4284-19-0x00000000035D0000-0x00000000035D1000-memory.dmp

            Filesize

            4KB

          • memory/4284-1-0x0000000002340000-0x0000000002394000-memory.dmp

            Filesize

            336KB