Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 17:14

General

  • Target

    081ed0b356460bf4d7e55a0be7291da0_JaffaCakes118.exe

  • Size

    662KB

  • MD5

    081ed0b356460bf4d7e55a0be7291da0

  • SHA1

    04ccaf0ae48b66258362c3d895c09ceda5a903a5

  • SHA256

    b97a7ec81e5386c05b3c6d0987768c292cf286b4b21d50e7b1f2feb8b8a07b5f

  • SHA512

    67fc27eee232055ea4f4e5b31eb9ed8178ae4dd0d54da8f062be09228dc3a09048deb8269124dda5cfdade6823227391b50ba0d7116cc10faa29048031cf0992

  • SSDEEP

    12288:3Dbdy6d5pQB0qod+t5bSGF6jbK88StvhTqpgX32C9Kt/o9KCpPqWWkaZaI:Thz6BoYDbXyG3a2pgX3aRo9KMAkad

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • ModiLoader Second Stage 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\081ed0b356460bf4d7e55a0be7291da0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\081ed0b356460bf4d7e55a0be7291da0_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c date 1980-01-01
      2⤵
        PID:2148
      • C:\windows\ddlho.exe
        C:\windows\ddlho.exe
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2648
        • C:\Program Files\Common Files\Microsoft Shared\MSINFO\svchosl.exe
          "C:\Program Files\Common Files\Microsoft Shared\MSINFO\svchosl.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2444
          • C:\Windows\SysWOW64\svchost.exe
            "C:\Windows\system32\svchost.exe"
            4⤵
              PID:2484
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c date 2024-6-20
          2⤵
            PID:1520

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\ddlho.exe

          Filesize

          636KB

          MD5

          de29a7f4ef0593a6d0c0b4960f923642

          SHA1

          210c6a07e7f0619c509b935e5fce11d4d1641a42

          SHA256

          3059b727ac8ab54a8d1d3ab457de4ac5f1bcd07e1db25a05411cd030a653c98d

          SHA512

          27f531da13f26d26672a6c5a48584224cf14fe3428fdc2f64e0c0c13093b4d3b59292994d9744d388e861536f25dc69962d373bb97810a95eee7a55380f9d864

        • memory/1700-8-0x0000000003AF0000-0x0000000003C09000-memory.dmp

          Filesize

          1.1MB

        • memory/2444-65-0x0000000000350000-0x00000000003A4000-memory.dmp

          Filesize

          336KB

        • memory/2444-63-0x0000000000400000-0x0000000000519000-memory.dmp

          Filesize

          1.1MB

        • memory/2444-51-0x0000000000400000-0x0000000000519000-memory.dmp

          Filesize

          1.1MB

        • memory/2444-52-0x0000000000350000-0x00000000003A4000-memory.dmp

          Filesize

          336KB

        • memory/2484-60-0x0000000000400000-0x0000000000519000-memory.dmp

          Filesize

          1.1MB

        • memory/2484-57-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2648-23-0x0000000003480000-0x0000000003481000-memory.dmp

          Filesize

          4KB

        • memory/2648-18-0x0000000002040000-0x0000000002041000-memory.dmp

          Filesize

          4KB

        • memory/2648-39-0x00000000033D0000-0x00000000033D1000-memory.dmp

          Filesize

          4KB

        • memory/2648-38-0x00000000033E0000-0x00000000033E1000-memory.dmp

          Filesize

          4KB

        • memory/2648-37-0x00000000033A0000-0x00000000033A1000-memory.dmp

          Filesize

          4KB

        • memory/2648-36-0x00000000033B0000-0x00000000033B1000-memory.dmp

          Filesize

          4KB

        • memory/2648-35-0x00000000033C0000-0x00000000033C1000-memory.dmp

          Filesize

          4KB

        • memory/2648-34-0x0000000001D40000-0x0000000001D41000-memory.dmp

          Filesize

          4KB

        • memory/2648-33-0x00000000003F0000-0x00000000003F1000-memory.dmp

          Filesize

          4KB

        • memory/2648-26-0x0000000003480000-0x0000000003481000-memory.dmp

          Filesize

          4KB

        • memory/2648-25-0x0000000003480000-0x0000000003481000-memory.dmp

          Filesize

          4KB

        • memory/2648-24-0x0000000003480000-0x0000000003481000-memory.dmp

          Filesize

          4KB

        • memory/2648-41-0x0000000001FA0000-0x0000000001FA1000-memory.dmp

          Filesize

          4KB

        • memory/2648-22-0x0000000003390000-0x0000000003391000-memory.dmp

          Filesize

          4KB

        • memory/2648-21-0x0000000003380000-0x0000000003480000-memory.dmp

          Filesize

          1024KB

        • memory/2648-20-0x0000000003380000-0x0000000003480000-memory.dmp

          Filesize

          1024KB

        • memory/2648-19-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

          Filesize

          4KB

        • memory/2648-40-0x0000000003410000-0x0000000003411000-memory.dmp

          Filesize

          4KB

        • memory/2648-17-0x0000000002010000-0x0000000002011000-memory.dmp

          Filesize

          4KB

        • memory/2648-16-0x0000000002020000-0x0000000002021000-memory.dmp

          Filesize

          4KB

        • memory/2648-15-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

          Filesize

          4KB

        • memory/2648-14-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

          Filesize

          4KB

        • memory/2648-13-0x0000000002030000-0x0000000002031000-memory.dmp

          Filesize

          4KB

        • memory/2648-12-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

          Filesize

          4KB

        • memory/2648-11-0x0000000002000000-0x0000000002001000-memory.dmp

          Filesize

          4KB

        • memory/2648-50-0x0000000004640000-0x0000000004759000-memory.dmp

          Filesize

          1.1MB

        • memory/2648-27-0x0000000003480000-0x0000000003481000-memory.dmp

          Filesize

          4KB

        • memory/2648-28-0x0000000003480000-0x0000000003481000-memory.dmp

          Filesize

          4KB

        • memory/2648-29-0x0000000003380000-0x0000000003383000-memory.dmp

          Filesize

          12KB

        • memory/2648-30-0x0000000003480000-0x0000000003481000-memory.dmp

          Filesize

          4KB

        • memory/2648-66-0x0000000001DA0000-0x0000000001DF4000-memory.dmp

          Filesize

          336KB

        • memory/2648-10-0x0000000001DA0000-0x0000000001DF4000-memory.dmp

          Filesize

          336KB

        • memory/2648-64-0x0000000000400000-0x0000000000519000-memory.dmp

          Filesize

          1.1MB

        • memory/2648-9-0x0000000000400000-0x0000000000519000-memory.dmp

          Filesize

          1.1MB