Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 19:23
Static task
static1
Behavioral task
behavioral1
Sample
0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe
-
Size
178KB
-
MD5
0911995cf1ba233e13a4958846f9a1c0
-
SHA1
055724f98727a5332bf1e6a2499a896a9e74ca2c
-
SHA256
fd4fddbfca5fd959b445e1b0aa0f9b8e4364a815e12c084abfc46307925d3777
-
SHA512
e344e0cafeecb6e44a407f34c7329ba739ecd62e90520b1802d2c7de2e65a1b5c11fc21547bb16043f171076994d1fa53566e753e31f49098d4f1a9fdc6e07d1
-
SSDEEP
3072:KWqiyhc/IcXbJSGOuQwwixlxTJ4Y3R6iXcK0ImNZJ2iECIfeJ0LuCMd8l5pO/YP:whcxbQDbw/j4lImNZJ2TCQ6+uC15pOM
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2052-23-0x0000000000400000-0x0000000000494000-memory.dmp modiloader_stage2 behavioral1/memory/756-24-0x0000000000400000-0x0000000000494000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
rascetrs.exepid process 2052 rascetrs.exe -
Drops file in System32 directory 13 IoCs
Processes:
0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exerascetrs.exedescription ioc process File created C:\Windows\SysWOW64\rascetrs.exe 0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe File created C:\Windows\SysWOW64\ncpxa.DLL 0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe File created C:\Windows\SysWOW64\critrfs.sys 0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\rascetrs.exe rascetrs.exe File created C:\Windows\SysWOW64\entarnoi.sys 0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\critrfs.sys 0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe File created C:\Windows\SysWOW64\natrnie.sys rascetrs.exe File opened for modification C:\Windows\SysWOW64\rascetrs.exe 0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe File created C:\Windows\SysWOW64\natrnie.sys 0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe File created C:\Windows\SysWOW64\nacktio.sys rascetrs.exe File created C:\Windows\SysWOW64\entarnoi.sys rascetrs.exe File opened for modification C:\Windows\SysWOW64\critrfs.sys rascetrs.exe File created C:\Windows\SysWOW64\nacktio.sys 0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
PID:756
-
C:\Windows\SysWOW64\rascetrs.exeC:\Windows\SysWOW64\rascetrs.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2052
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10B
MD5710bacf7059fef2c1f07fc1dcdaa5b95
SHA140b2093f31197dba7e9e28753973231f1016fbda
SHA2567726f0169079fd83e0638143d72070803d6191a7888a9e54626fa9987fb108a9
SHA512e5ec6dd3680b53b9cf86ecf6e20f70542c8b01f1f9679a2d1fa02dceefe1488ff1cfcb3e6402d054049bc11da3f4184454bdf01694f35db5657225cd690a93d4
-
Filesize
26B
MD567799a6b4bde6110b9927271d6b03869
SHA1c5b093354e87c5c769e803cc2351764733836d4d
SHA25602f6f1255980ba4ef08a62f295dc74eeea9e4e5b317532411981fde301765fed
SHA5122d73196e984075503f63a51478a3772aef92ef6888f7c6e8cbc3a5599c80076e107d7982c613ae77842c7da53ac2dbb3d5bef310d6004e61b226de6bcc840224
-
Filesize
15B
MD540d42be372aef4d98307061d3d84ac8f
SHA1b322bdd0e12eee768393b5b407a11ff0e9d5f201
SHA25691e2e5f74556bee5d0916532362e4101cd8bb6616dc1cdcc3cba5b0beb748bc6
SHA512d611ef49b78c4b5a4ac168175b265825e6110cf150a098c5b7b07a2aa6a9c0b54e0f9aa367d5194fbaf6cf1f3d8a58a2581c3be473e48c6202be5730ad1f3092
-
Filesize
8B
MD51cd653f3b4ef4fdbe3498860167f1f08
SHA18aadddfdcb3bde2c46ae10130aa0536c2c481fa0
SHA25695a370282b6c2dff5a626eb71e6fa4f4a1b7559c58ec34d3cbb44af4a57cffb3
SHA5123fc59e2069e45ba80d670229b671c0523244847e5716e03ba89b7435738bd9c0caa40d4c6c2cf47c7afed232ddd41fcae559b1b1e378e4d192d7becd75f3be9b
-
Filesize
178KB
MD50911995cf1ba233e13a4958846f9a1c0
SHA1055724f98727a5332bf1e6a2499a896a9e74ca2c
SHA256fd4fddbfca5fd959b445e1b0aa0f9b8e4364a815e12c084abfc46307925d3777
SHA512e344e0cafeecb6e44a407f34c7329ba739ecd62e90520b1802d2c7de2e65a1b5c11fc21547bb16043f171076994d1fa53566e753e31f49098d4f1a9fdc6e07d1