Analysis
-
max time kernel
145s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 18:51
Static task
static1
Behavioral task
behavioral1
Sample
08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe
-
Size
464KB
-
MD5
08d2170af43c86ed97d0dac1ff5dda13
-
SHA1
1a392945351dcf710e5ff89bbd84e4ca0042d018
-
SHA256
def80d52865a8f5abe1a54989c9869c456f8c2d9722a82dde46f0822ce403977
-
SHA512
1f5920c454955f939d2c8be06282a48342b70fd9c2c5f110ec1fa2c3e94d254192404218a1c0608dd5351c8794155ada85a0b2d964f53448a2b846ebf32fab6a
-
SSDEEP
6144:VGfbCSJRNESQN53Bf/SWCjNW5uo5McluV67JAI58JLexotC+PrrBO8FL02QFWz/t:gEr93Co5uo2hQKJ20s8F42mSVUDu
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 5 IoCs
Processes:
resource yara_rule behavioral2/memory/4816-3-0x0000000000400000-0x000000000053B000-memory.dmp modiloader_stage2 behavioral2/memory/4496-13-0x0000000000400000-0x000000000053B000-memory.dmp modiloader_stage2 behavioral2/memory/4816-18-0x0000000000400000-0x000000000053B000-memory.dmp modiloader_stage2 behavioral2/memory/4496-22-0x0000000000400000-0x000000000053B000-memory.dmp modiloader_stage2 behavioral2/memory/4496-25-0x0000000000400000-0x000000000053B000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
rejoice813.exepid process 4496 rejoice813.exe -
Drops file in System32 directory 2 IoCs
Processes:
rejoice813.exedescription ioc process File opened for modification C:\Windows\SysWOW64\_rejoice813.exe rejoice813.exe File created C:\Windows\SysWOW64\_rejoice813.exe rejoice813.exe -
Suspicious use of SetThreadContext 8 IoCs
Processes:
rejoice813.exedescription pid process target process PID 4496 set thread context of 2976 4496 rejoice813.exe calc.exe PID 4496 set thread context of 1464 4496 rejoice813.exe calc.exe PID 4496 set thread context of 392 4496 rejoice813.exe calc.exe PID 4496 set thread context of 4580 4496 rejoice813.exe calc.exe PID 4496 set thread context of 4976 4496 rejoice813.exe calc.exe PID 4496 set thread context of 4520 4496 rejoice813.exe calc.exe PID 4496 set thread context of 3056 4496 rejoice813.exe calc.exe PID 4496 set thread context of 1084 4496 rejoice813.exe calc.exe -
Drops file in Program Files directory 3 IoCs
Processes:
08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat 08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice813.exe 08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice813.exe 08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe -
Program crash 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1032 2976 WerFault.exe calc.exe 632 1464 WerFault.exe calc.exe 2256 4296 WerFault.exe calc.exe 3184 392 WerFault.exe calc.exe 4652 4580 WerFault.exe calc.exe 4984 4976 WerFault.exe calc.exe 3416 4520 WerFault.exe calc.exe 1768 3056 WerFault.exe calc.exe 2952 1084 WerFault.exe calc.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
calc.exepid process 2976 calc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exerejoice813.exedescription pid process target process PID 4816 wrote to memory of 4496 4816 08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe rejoice813.exe PID 4816 wrote to memory of 4496 4816 08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe rejoice813.exe PID 4816 wrote to memory of 4496 4816 08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe rejoice813.exe PID 4496 wrote to memory of 2976 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 2976 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 2976 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 2976 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 2976 4496 rejoice813.exe calc.exe PID 4816 wrote to memory of 2496 4816 08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe cmd.exe PID 4816 wrote to memory of 2496 4816 08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe cmd.exe PID 4816 wrote to memory of 2496 4816 08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe cmd.exe PID 4496 wrote to memory of 3136 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 3136 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 3136 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 1464 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 1464 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 1464 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 1464 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 1464 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 3456 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 3456 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 3456 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 3896 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 3896 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 3896 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 4296 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 4296 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 4296 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 4296 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 4296 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 1368 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 1368 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 1368 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 392 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 392 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 392 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 392 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 392 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 4476 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 4476 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 4476 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 4580 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 4580 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 4580 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 4580 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 4580 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 4976 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 4976 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 4976 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 4976 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 4976 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 4520 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 4520 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 4520 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 4520 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 4520 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 3056 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 3056 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 3056 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 3056 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 3056 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 1892 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 1892 4496 rejoice813.exe calc.exe PID 4496 wrote to memory of 1892 4496 rejoice813.exe calc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice813.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice813.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵
- Suspicious use of UnmapMainImage
PID:2976 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 124⤵
- Program crash
PID:1032 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:3136
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:1464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 124⤵
- Program crash
PID:632 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:3456
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:3896
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:4296
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 124⤵
- Program crash
PID:2256 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:1368
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 124⤵
- Program crash
PID:3184 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:4476
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:4580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 124⤵
- Program crash
PID:4652 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:4976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 124⤵
- Program crash
PID:4984 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:4520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 124⤵
- Program crash
PID:3416 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:3056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 124⤵
- Program crash
PID:1768 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:1892
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:1084
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 124⤵
- Program crash
PID:2952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat""2⤵PID:2496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2976 -ip 29761⤵PID:2736
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1464 -ip 14641⤵PID:2984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4296 -ip 42961⤵PID:2956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 392 -ip 3921⤵PID:3996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4580 -ip 45801⤵PID:1452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4976 -ip 49761⤵PID:4828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4520 -ip 45201⤵PID:4172
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3056 -ip 30561⤵PID:1668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1084 -ip 10841⤵PID:2112
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD51c26e6dbd374899a7b0bceeeeb790b18
SHA110f738dc8709ca4497585c86b6a7d7a02631202a
SHA2564ee0afb71247d02c06e3ab15ba26e1b3f576149e5ab3b97b8226bda616420e85
SHA51289ee2cdfde82f43bb05675952fde27f49671ef9b3a431541c1e8cfab953466d98d35b5257fc2845e65ef0799befd783c590767fe3b93c76016f68839f6c68bcb
-
Filesize
464KB
MD508d2170af43c86ed97d0dac1ff5dda13
SHA11a392945351dcf710e5ff89bbd84e4ca0042d018
SHA256def80d52865a8f5abe1a54989c9869c456f8c2d9722a82dde46f0822ce403977
SHA5121f5920c454955f939d2c8be06282a48342b70fd9c2c5f110ec1fa2c3e94d254192404218a1c0608dd5351c8794155ada85a0b2d964f53448a2b846ebf32fab6a