Analysis

  • max time kernel
    140s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 17:42

General

  • Target

    08521b4a7057cef60d8281f50a7bdc58_JaffaCakes118.exe

  • Size

    683KB

  • MD5

    08521b4a7057cef60d8281f50a7bdc58

  • SHA1

    2543185e7052bf667bda9886bca838c8a3374a3e

  • SHA256

    d3e8b9e99e2e1c7580d0664798cac729328e8cea50aba3dd64aa8ce3a8cb451e

  • SHA512

    50e86cc8f508ee91574efff05f8fd03e71e608d264da642e2cde5c700b90231b314208f0e6ffe706d59d9ddb7aa15feeb04d8e28f11ac7efb65f3eaea72182a9

  • SSDEEP

    12288:nPZGLM/Ipi1jH2To8A0K0Aced4AMBKVr8pQAR+ChGtF3Z4mxxRrWPH+efOvsbVU:nPPIpaHmo8M0ARbMB44pHR+ChGtQmX0c

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\08521b4a7057cef60d8281f50a7bdc58_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\08521b4a7057cef60d8281f50a7bdc58_JaffaCakes118.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2184
    • C:\program files\internet explorer\IEXPLORE.EXE
      "C:\program files\internet explorer\IEXPLORE.EXE"
      2⤵
        PID:2716
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 312
        2⤵
        • Program crash
        PID:2752

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2184-1-0x0000000000340000-0x0000000000394000-memory.dmp

      Filesize

      336KB

    • memory/2184-0-0x0000000000400000-0x000000000056F000-memory.dmp

      Filesize

      1.4MB

    • memory/2184-55-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-63-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-62-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-61-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-60-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-59-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-58-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-57-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-56-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-54-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-53-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-52-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-51-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-50-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-49-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-48-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-47-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-46-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-45-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-44-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-43-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-42-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-41-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-40-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-39-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-38-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-37-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-36-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-35-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-34-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-33-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-32-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-31-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-30-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-29-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-28-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-27-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-26-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-25-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-24-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-23-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-22-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-21-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-20-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-19-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-18-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/2184-17-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2184-16-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2184-15-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2184-14-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2184-13-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2184-12-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2184-11-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/2184-10-0x00000000003F0000-0x00000000003F1000-memory.dmp

      Filesize

      4KB

    • memory/2184-9-0x00000000005D0000-0x00000000005D1000-memory.dmp

      Filesize

      4KB

    • memory/2184-8-0x00000000005A0000-0x00000000005A1000-memory.dmp

      Filesize

      4KB

    • memory/2184-7-0x00000000005B0000-0x00000000005B1000-memory.dmp

      Filesize

      4KB

    • memory/2184-6-0x00000000003D0000-0x00000000003D1000-memory.dmp

      Filesize

      4KB

    • memory/2184-5-0x00000000003E0000-0x00000000003E1000-memory.dmp

      Filesize

      4KB

    • memory/2184-4-0x00000000005C0000-0x00000000005C1000-memory.dmp

      Filesize

      4KB

    • memory/2184-3-0x0000000000570000-0x0000000000571000-memory.dmp

      Filesize

      4KB

    • memory/2184-2-0x0000000000590000-0x0000000000591000-memory.dmp

      Filesize

      4KB

    • memory/2184-65-0x0000000000400000-0x000000000056F000-memory.dmp

      Filesize

      1.4MB

    • memory/2184-67-0x0000000000340000-0x0000000000394000-memory.dmp

      Filesize

      336KB

    • memory/2184-68-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB