Analysis

  • max time kernel
    140s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 18:15

General

  • Target

    088f96da0ea3e133d21f7a688343cb55_JaffaCakes118.exe

  • Size

    768KB

  • MD5

    088f96da0ea3e133d21f7a688343cb55

  • SHA1

    58b72da06274150851534394c395844a2e38b7ac

  • SHA256

    03691a29229b13311064b1244ed3f15236410d0e073d854bda6e568f74788cd7

  • SHA512

    1ba8d584871a9a36b8dc17bb61c8d6ec17b0f534580b18351db087295fd5e0e42d4eed3d1d4e6d9dea59a588a4ab82738cf1e4ff0240f395d446ac6d1e4e5e64

  • SSDEEP

    24576:tOOauuf6iLF6KhLuoTC4QGFsR9PNmIXCL:LtuSE0OB23GFUVohL

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\wininit.exe
    wininit.exe
    1⤵
      PID:388
      • C:\Windows\system32\services.exe
        C:\Windows\system32\services.exe
        2⤵
          PID:484
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k DcomLaunch
            3⤵
              PID:592
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k RPCSS
              3⤵
                PID:668
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                3⤵
                  PID:736
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                  3⤵
                    PID:808
                    • C:\Windows\system32\Dwm.exe
                      "C:\Windows\system32\Dwm.exe"
                      4⤵
                        PID:1324
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs
                      3⤵
                        PID:856
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService
                        3⤵
                          PID:988
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k NetworkService
                          3⤵
                            PID:300
                          • C:\Windows\System32\spoolsv.exe
                            C:\Windows\System32\spoolsv.exe
                            3⤵
                              PID:1020
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                              3⤵
                                PID:340
                              • C:\Windows\system32\taskhost.exe
                                "taskhost.exe"
                                3⤵
                                  PID:1232
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                                  3⤵
                                    PID:2360
                                  • C:\Windows\system32\sppsvc.exe
                                    C:\Windows\system32\sppsvc.exe
                                    3⤵
                                      PID:2160
                                  • C:\Windows\system32\lsass.exe
                                    C:\Windows\system32\lsass.exe
                                    2⤵
                                      PID:492
                                    • C:\Windows\system32\lsm.exe
                                      C:\Windows\system32\lsm.exe
                                      2⤵
                                        PID:500
                                    • C:\Windows\system32\csrss.exe
                                      %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                      1⤵
                                        PID:400
                                      • C:\Windows\system32\winlogon.exe
                                        winlogon.exe
                                        1⤵
                                          PID:436
                                        • C:\Windows\Explorer.EXE
                                          C:\Windows\Explorer.EXE
                                          1⤵
                                            PID:1356
                                            • C:\Users\Admin\AppData\Local\Temp\088f96da0ea3e133d21f7a688343cb55_JaffaCakes118.exe
                                              "C:\Users\Admin\AppData\Local\Temp\088f96da0ea3e133d21f7a688343cb55_JaffaCakes118.exe"
                                              2⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of SetWindowsHookEx
                                              • Suspicious use of WriteProcessMemory
                                              PID:1684
                                              • C:\61538 PM.exe
                                                "C:\61538 PM.exe"
                                                3⤵
                                                • Executes dropped EXE
                                                • Drops file in System32 directory
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious behavior: MapViewOfSection
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of WriteProcessMemory
                                                PID:1696

                                          Network

                                          MITRE ATT&CK Matrix

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\61538 PM.exe

                                            Filesize

                                            724KB

                                            MD5

                                            f79e3f6362341b72df91556204bf96f4

                                            SHA1

                                            a685ed0d50e847f0170c6f312c38894695564450

                                            SHA256

                                            80420bcb88bf82c7add9e7418662f558d70a090347cc4ad3ab0af5a6f5b3a09c

                                            SHA512

                                            28b7994a80baa3d03a91002a73ef13ec47f6b4c919a85ba113a524717e0e28af396d1c1f74b14aaf823717539bffb1e09206814b9438ae5313939b9232cf8024

                                          • memory/1684-8-0x0000000000400000-0x000000000040A000-memory.dmp

                                            Filesize

                                            40KB

                                          • memory/1684-10-0x0000000002AC0000-0x0000000002B82000-memory.dmp

                                            Filesize

                                            776KB

                                          • memory/1684-9-0x0000000002AC0000-0x0000000002B82000-memory.dmp

                                            Filesize

                                            776KB

                                          • memory/1684-21-0x0000000002AC0000-0x0000000002B82000-memory.dmp

                                            Filesize

                                            776KB

                                          • memory/1684-29-0x000000007EFA0000-0x000000007EFA7000-memory.dmp

                                            Filesize

                                            28KB

                                          • memory/1684-28-0x0000000000400000-0x000000000040A000-memory.dmp

                                            Filesize

                                            40KB

                                          • memory/1696-11-0x0000000000400000-0x00000000004C2000-memory.dmp

                                            Filesize

                                            776KB

                                          • memory/1696-16-0x0000000000330000-0x0000000000331000-memory.dmp

                                            Filesize

                                            4KB

                                          • memory/1696-15-0x00000000779EF000-0x00000000779F0000-memory.dmp

                                            Filesize

                                            4KB

                                          • memory/1696-14-0x00000000779F0000-0x00000000779F1000-memory.dmp

                                            Filesize

                                            4KB

                                          • memory/1696-18-0x0000000000400000-0x00000000004C2000-memory.dmp

                                            Filesize

                                            776KB