Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 18:39

General

  • Target

    08b98cea751df2f1a0b93c1026c98c62_JaffaCakes118.exe

  • Size

    706KB

  • MD5

    08b98cea751df2f1a0b93c1026c98c62

  • SHA1

    059e9e6615c562af98d4505f12d3ae1f08b6ef67

  • SHA256

    5f5e4235a44db94afdd2f9643e14f36d69f3854040270a78125529070d83e098

  • SHA512

    6e5a248a0a84f3d44ee5a494e138313ccbd69a3cdabef0e7b23302df9164fc82a6d66c06d4e1042e48376ef79a72e3170dfe28e65317cac0de01ab5a49982dde

  • SSDEEP

    12288:tLIqdYi+c5m3UtUV11g+V6WRoTG0WBSVXF3Z4mxxzDqVTVOCy:pIXc5m3UCN9V6qoT/W0XQmXaVTzy

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\08b98cea751df2f1a0b93c1026c98c62_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\08b98cea751df2f1a0b93c1026c98c62_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1244
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2008_S~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2008_S~1.EXE
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2240
      • C:\program files\internet explorer\IEXPLORE.EXE
        "C:\program files\internet explorer\IEXPLORE.EXE"
        3⤵
          PID:2716

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\2008_S~1.EXE

      Filesize

      301KB

      MD5

      5bd1216746054bd6eac0ab50c6c68b5e

      SHA1

      44836f2e7932970b9ec06652905becd2ad3cc038

      SHA256

      e1357cc2990eba4af60c70ea3e2f4921869ff1aa4db9fb056efdc2309ca17505

      SHA512

      4c031e8dc0994dbb41d728df86d1b71d8cfaa95578e6820ff4917528c263b3670d0c871a34db7d141ddab635831d7d00ac6ea04fec5a5eaea18db9b0f3d8ec53

    • memory/1244-0-0x0000000001000000-0x000000000116B000-memory.dmp

      Filesize

      1.4MB

    • memory/1244-1-0x0000000000280000-0x00000000002D4000-memory.dmp

      Filesize

      336KB

    • memory/1244-37-0x0000000000B40000-0x0000000000B41000-memory.dmp

      Filesize

      4KB

    • memory/1244-40-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/1244-39-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/1244-38-0x0000000000B30000-0x0000000000B31000-memory.dmp

      Filesize

      4KB

    • memory/1244-36-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

      Filesize

      4KB

    • memory/1244-35-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

      Filesize

      4KB

    • memory/1244-34-0x0000000000B00000-0x0000000000B01000-memory.dmp

      Filesize

      4KB

    • memory/1244-33-0x0000000000B20000-0x0000000000B21000-memory.dmp

      Filesize

      4KB

    • memory/1244-41-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/1244-32-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/1244-31-0x0000000000900000-0x0000000000901000-memory.dmp

      Filesize

      4KB

    • memory/1244-30-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

      Filesize

      4KB

    • memory/1244-29-0x0000000000A80000-0x0000000000A81000-memory.dmp

      Filesize

      4KB

    • memory/1244-28-0x0000000000A90000-0x0000000000A91000-memory.dmp

      Filesize

      4KB

    • memory/1244-27-0x0000000000570000-0x0000000000571000-memory.dmp

      Filesize

      4KB

    • memory/1244-26-0x0000000000580000-0x0000000000581000-memory.dmp

      Filesize

      4KB

    • memory/1244-25-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

      Filesize

      4KB

    • memory/1244-42-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/1244-47-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/1244-46-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/1244-45-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/1244-44-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/1244-43-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/1244-24-0x0000000000A50000-0x0000000000A51000-memory.dmp

      Filesize

      4KB

    • memory/1244-23-0x0000000000A70000-0x0000000000A71000-memory.dmp

      Filesize

      4KB

    • memory/1244-22-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/1244-21-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/1244-20-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/1244-19-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/1244-18-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/1244-17-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/1244-16-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/1244-15-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/1244-14-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/1244-13-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/1244-12-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/1244-11-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/1244-10-0x0000000000340000-0x0000000000341000-memory.dmp

      Filesize

      4KB

    • memory/1244-9-0x0000000003290000-0x0000000003291000-memory.dmp

      Filesize

      4KB

    • memory/1244-8-0x0000000000300000-0x0000000000301000-memory.dmp

      Filesize

      4KB

    • memory/1244-7-0x0000000000310000-0x0000000000311000-memory.dmp

      Filesize

      4KB

    • memory/1244-6-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/1244-5-0x0000000000250000-0x0000000000251000-memory.dmp

      Filesize

      4KB

    • memory/1244-4-0x0000000000330000-0x0000000000331000-memory.dmp

      Filesize

      4KB

    • memory/1244-3-0x0000000000270000-0x0000000000271000-memory.dmp

      Filesize

      4KB

    • memory/1244-2-0x00000000002F0000-0x00000000002F1000-memory.dmp

      Filesize

      4KB

    • memory/1244-64-0x0000000001000000-0x000000000116B000-memory.dmp

      Filesize

      1.4MB

    • memory/1244-63-0x0000000000280000-0x00000000002D4000-memory.dmp

      Filesize

      336KB

    • memory/2240-61-0x0000000000400000-0x00000000004C1000-memory.dmp

      Filesize

      772KB