Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 17:22

General

  • Target

    082e7df418d0867bbb5f8ed37e1f9b1c_JaffaCakes118.exe

  • Size

    860KB

  • MD5

    082e7df418d0867bbb5f8ed37e1f9b1c

  • SHA1

    17230df7e3c2177570724ca1e339121fa244c797

  • SHA256

    dc0e8b5d7ab1dfc366eee9850ca1d0dcc72e08a15cee40393cefd32845fd2c8f

  • SHA512

    0c98edd2fbc4e4cc93ee28ffc8d1f3b46b1dfdeb6cfc339353cbde7c93391ad9581cb1da46c0d56eb8e2d46fecfdeee9a78cc124f968b699972d7de5c2932380

  • SSDEEP

    24576:3INRhwgRaK/jNixBy9zR+IusVgoeAywJvlS38WOobt:3INf1i3qLvObt

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\082e7df418d0867bbb5f8ed37e1f9b1c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\082e7df418d0867bbb5f8ed37e1f9b1c_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    PID:1612
  • C:\Windows\SysWOW64\YServer.exe
    C:\Windows\SysWOW64\YServer.exe -Service
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    PID:2888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\YServer.exe

    Filesize

    860KB

    MD5

    082e7df418d0867bbb5f8ed37e1f9b1c

    SHA1

    17230df7e3c2177570724ca1e339121fa244c797

    SHA256

    dc0e8b5d7ab1dfc366eee9850ca1d0dcc72e08a15cee40393cefd32845fd2c8f

    SHA512

    0c98edd2fbc4e4cc93ee28ffc8d1f3b46b1dfdeb6cfc339353cbde7c93391ad9581cb1da46c0d56eb8e2d46fecfdeee9a78cc124f968b699972d7de5c2932380

  • memory/1612-1-0x00000000004E0000-0x00000000004E1000-memory.dmp

    Filesize

    4KB

  • memory/1612-14-0x0000000000400000-0x00000000004DE000-memory.dmp

    Filesize

    888KB

  • memory/2888-13-0x0000000000400000-0x00000000004DE000-memory.dmp

    Filesize

    888KB