Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2024 17:14

General

  • Target

    081ed0b356460bf4d7e55a0be7291da0_JaffaCakes118.exe

  • Size

    662KB

  • MD5

    081ed0b356460bf4d7e55a0be7291da0

  • SHA1

    04ccaf0ae48b66258362c3d895c09ceda5a903a5

  • SHA256

    b97a7ec81e5386c05b3c6d0987768c292cf286b4b21d50e7b1f2feb8b8a07b5f

  • SHA512

    67fc27eee232055ea4f4e5b31eb9ed8178ae4dd0d54da8f062be09228dc3a09048deb8269124dda5cfdade6823227391b50ba0d7116cc10faa29048031cf0992

  • SSDEEP

    12288:3Dbdy6d5pQB0qod+t5bSGF6jbK88StvhTqpgX32C9Kt/o9KCpPqWWkaZaI:Thz6BoYDbXyG3a2pgX3aRo9KMAkad

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • ModiLoader Second Stage 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\081ed0b356460bf4d7e55a0be7291da0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\081ed0b356460bf4d7e55a0be7291da0_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2468
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c date 1980-01-01
      2⤵
        PID:1132
      • C:\windows\ddlho.exe
        C:\windows\ddlho.exe
        2⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:3104
        • C:\Program Files\Common Files\Microsoft Shared\MSINFO\svchosl.exe
          "C:\Program Files\Common Files\Microsoft Shared\MSINFO\svchosl.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:3628
          • C:\Windows\SysWOW64\svchost.exe
            "C:\Windows\system32\svchost.exe"
            4⤵
              PID:60
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 12
                5⤵
                • Program crash
                PID:2668
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c date 2024-6-20
          2⤵
            PID:3808
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 60 -ip 60
          1⤵
            PID:4644

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\ddlho.exe

            Filesize

            636KB

            MD5

            de29a7f4ef0593a6d0c0b4960f923642

            SHA1

            210c6a07e7f0619c509b935e5fce11d4d1641a42

            SHA256

            3059b727ac8ab54a8d1d3ab457de4ac5f1bcd07e1db25a05411cd030a653c98d

            SHA512

            27f531da13f26d26672a6c5a48584224cf14fe3428fdc2f64e0c0c13093b4d3b59292994d9744d388e861536f25dc69962d373bb97810a95eee7a55380f9d864

          • memory/60-60-0x0000000000400000-0x0000000000519000-memory.dmp

            Filesize

            1.1MB

          • memory/3104-6-0x0000000000400000-0x0000000000519000-memory.dmp

            Filesize

            1.1MB

          • memory/3104-7-0x0000000002330000-0x0000000002384000-memory.dmp

            Filesize

            336KB

          • memory/3104-38-0x0000000003500000-0x0000000003501000-memory.dmp

            Filesize

            4KB

          • memory/3104-37-0x0000000003500000-0x0000000003501000-memory.dmp

            Filesize

            4KB

          • memory/3104-41-0x0000000003500000-0x0000000003503000-memory.dmp

            Filesize

            12KB

          • memory/3104-50-0x0000000003590000-0x0000000003591000-memory.dmp

            Filesize

            4KB

          • memory/3104-51-0x0000000002720000-0x0000000002721000-memory.dmp

            Filesize

            4KB

          • memory/3104-49-0x0000000003550000-0x0000000003551000-memory.dmp

            Filesize

            4KB

          • memory/3104-48-0x0000000003560000-0x0000000003561000-memory.dmp

            Filesize

            4KB

          • memory/3104-47-0x0000000003520000-0x0000000003521000-memory.dmp

            Filesize

            4KB

          • memory/3104-46-0x0000000003530000-0x0000000003531000-memory.dmp

            Filesize

            4KB

          • memory/3104-45-0x0000000003540000-0x0000000003541000-memory.dmp

            Filesize

            4KB

          • memory/3104-44-0x00000000022D0000-0x00000000022D1000-memory.dmp

            Filesize

            4KB

          • memory/3104-43-0x0000000000820000-0x0000000000821000-memory.dmp

            Filesize

            4KB

          • memory/3104-42-0x0000000003510000-0x0000000003511000-memory.dmp

            Filesize

            4KB

          • memory/3104-36-0x0000000003600000-0x0000000003601000-memory.dmp

            Filesize

            4KB

          • memory/3104-35-0x0000000003500000-0x0000000003501000-memory.dmp

            Filesize

            4KB

          • memory/3104-34-0x0000000003500000-0x0000000003501000-memory.dmp

            Filesize

            4KB

          • memory/3104-33-0x0000000003500000-0x0000000003501000-memory.dmp

            Filesize

            4KB

          • memory/3104-32-0x0000000003600000-0x0000000003601000-memory.dmp

            Filesize

            4KB

          • memory/3104-31-0x0000000003600000-0x0000000003601000-memory.dmp

            Filesize

            4KB

          • memory/3104-30-0x0000000003600000-0x0000000003601000-memory.dmp

            Filesize

            4KB

          • memory/3104-29-0x0000000003600000-0x0000000003601000-memory.dmp

            Filesize

            4KB

          • memory/3104-28-0x0000000003600000-0x0000000003601000-memory.dmp

            Filesize

            4KB

          • memory/3104-27-0x0000000003600000-0x0000000003601000-memory.dmp

            Filesize

            4KB

          • memory/3104-26-0x0000000003500000-0x0000000003501000-memory.dmp

            Filesize

            4KB

          • memory/3104-25-0x0000000003510000-0x0000000003511000-memory.dmp

            Filesize

            4KB

          • memory/3104-24-0x0000000003510000-0x0000000003511000-memory.dmp

            Filesize

            4KB

          • memory/3104-23-0x0000000003510000-0x0000000003511000-memory.dmp

            Filesize

            4KB

          • memory/3104-22-0x0000000003510000-0x0000000003511000-memory.dmp

            Filesize

            4KB

          • memory/3104-21-0x0000000003510000-0x0000000003511000-memory.dmp

            Filesize

            4KB

          • memory/3104-20-0x0000000003510000-0x0000000003511000-memory.dmp

            Filesize

            4KB

          • memory/3104-19-0x0000000003510000-0x0000000003511000-memory.dmp

            Filesize

            4KB

          • memory/3104-18-0x0000000003510000-0x0000000003511000-memory.dmp

            Filesize

            4KB

          • memory/3104-17-0x0000000003510000-0x0000000003511000-memory.dmp

            Filesize

            4KB

          • memory/3104-16-0x0000000002520000-0x0000000002521000-memory.dmp

            Filesize

            4KB

          • memory/3104-15-0x00000000025A0000-0x00000000025A1000-memory.dmp

            Filesize

            4KB

          • memory/3104-14-0x0000000002560000-0x0000000002561000-memory.dmp

            Filesize

            4KB

          • memory/3104-13-0x0000000002580000-0x0000000002581000-memory.dmp

            Filesize

            4KB

          • memory/3104-12-0x0000000002500000-0x0000000002501000-memory.dmp

            Filesize

            4KB

          • memory/3104-11-0x0000000002510000-0x0000000002511000-memory.dmp

            Filesize

            4KB

          • memory/3104-10-0x0000000002590000-0x0000000002591000-memory.dmp

            Filesize

            4KB

          • memory/3104-9-0x0000000002530000-0x0000000002531000-memory.dmp

            Filesize

            4KB

          • memory/3104-8-0x0000000002550000-0x0000000002551000-memory.dmp

            Filesize

            4KB

          • memory/3104-66-0x0000000002330000-0x0000000002384000-memory.dmp

            Filesize

            336KB

          • memory/3104-65-0x0000000000400000-0x0000000000519000-memory.dmp

            Filesize

            1.1MB

          • memory/3628-55-0x0000000000400000-0x0000000000519000-memory.dmp

            Filesize

            1.1MB

          • memory/3628-56-0x00000000021A0000-0x00000000021F4000-memory.dmp

            Filesize

            336KB

          • memory/3628-63-0x00000000021A0000-0x00000000021F4000-memory.dmp

            Filesize

            336KB

          • memory/3628-62-0x0000000000400000-0x0000000000519000-memory.dmp

            Filesize

            1.1MB