Analysis

  • max time kernel
    140s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2024 18:53

General

  • Target

    08d531a7f7fff50d2b03fa906ab6a225_JaffaCakes118.exe

  • Size

    544KB

  • MD5

    08d531a7f7fff50d2b03fa906ab6a225

  • SHA1

    61fad11ae22a07183d2e535c0ce915b38bfac22f

  • SHA256

    4b4d5ff9c9a8ed6a202408872ca393c630ec364606963197a35292539322aa35

  • SHA512

    b11a4e78874f5208f6eb759f63944a3f72d0adc3f6c94da2de3db58b1555714b2b322ddd3ed46b06767086f128372ae2c67c4cb7caabb01325444a00b467a551

  • SSDEEP

    12288:JAhH7ss1wJoXK8nrl+CnfGew9G9OXKGS0gq9Eeq6R+JoHGVX04b7:JAhj1+8nTnfGe39cKGLH97q1oHGB04b

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\08d531a7f7fff50d2b03fa906ab6a225_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\08d531a7f7fff50d2b03fa906ab6a225_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:4048
    • C:\Windows\SysWOW64\ddos.exe
      C:\Windows\system32\ddos.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      PID:1880
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
      2⤵
        PID:1596

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\Deleteme.bat

      Filesize

      212B

      MD5

      c511e432ebe0af9bf5ae47b27898fa10

      SHA1

      a4ee66b061df03ade296448b0d4ce3a3fcd0cad8

      SHA256

      11a0096a97c9438da8888d05c15c29e0a9c5669ba5f7887960983dec1f9d8ae4

      SHA512

      ff78385419e823e44944cb564d1b7113838c8fde6f78c591ef42ee816e5183320b5fbc01e17648b61e6e11edc3ea08c220aa93d292ac205b9adf6698ff144e3c

    • C:\Windows\SysWOW64\ddos.exe

      Filesize

      544KB

      MD5

      08d531a7f7fff50d2b03fa906ab6a225

      SHA1

      61fad11ae22a07183d2e535c0ce915b38bfac22f

      SHA256

      4b4d5ff9c9a8ed6a202408872ca393c630ec364606963197a35292539322aa35

      SHA512

      b11a4e78874f5208f6eb759f63944a3f72d0adc3f6c94da2de3db58b1555714b2b322ddd3ed46b06767086f128372ae2c67c4cb7caabb01325444a00b467a551

    • memory/1880-29-0x0000000000400000-0x000000000056B000-memory.dmp

      Filesize

      1.4MB

    • memory/1880-30-0x0000000002140000-0x0000000002194000-memory.dmp

      Filesize

      336KB

    • memory/1880-25-0x00000000005C0000-0x0000000000600000-memory.dmp

      Filesize

      256KB

    • memory/1880-26-0x0000000002140000-0x0000000002194000-memory.dmp

      Filesize

      336KB

    • memory/4048-14-0x0000000000B10000-0x0000000000B11000-memory.dmp

      Filesize

      4KB

    • memory/4048-5-0x0000000002580000-0x0000000002581000-memory.dmp

      Filesize

      4KB

    • memory/4048-19-0x0000000002710000-0x0000000002711000-memory.dmp

      Filesize

      4KB

    • memory/4048-13-0x00000000034F0000-0x00000000034F3000-memory.dmp

      Filesize

      12KB

    • memory/4048-12-0x0000000003500000-0x0000000003501000-memory.dmp

      Filesize

      4KB

    • memory/4048-11-0x0000000002520000-0x0000000002521000-memory.dmp

      Filesize

      4KB

    • memory/4048-10-0x0000000002590000-0x0000000002591000-memory.dmp

      Filesize

      4KB

    • memory/4048-9-0x0000000002560000-0x0000000002561000-memory.dmp

      Filesize

      4KB

    • memory/4048-8-0x0000000002570000-0x0000000002571000-memory.dmp

      Filesize

      4KB

    • memory/4048-7-0x0000000002500000-0x0000000002501000-memory.dmp

      Filesize

      4KB

    • memory/4048-6-0x0000000002510000-0x0000000002511000-memory.dmp

      Filesize

      4KB

    • memory/4048-0-0x0000000000400000-0x000000000056B000-memory.dmp

      Filesize

      1.4MB

    • memory/4048-4-0x0000000002530000-0x0000000002531000-memory.dmp

      Filesize

      4KB

    • memory/4048-3-0x0000000002550000-0x0000000002551000-memory.dmp

      Filesize

      4KB

    • memory/4048-15-0x0000000000B20000-0x0000000000B21000-memory.dmp

      Filesize

      4KB

    • memory/4048-16-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/4048-17-0x0000000003520000-0x0000000003521000-memory.dmp

      Filesize

      4KB

    • memory/4048-18-0x0000000003510000-0x0000000003511000-memory.dmp

      Filesize

      4KB

    • memory/4048-32-0x0000000002390000-0x00000000023E4000-memory.dmp

      Filesize

      336KB

    • memory/4048-2-0x0000000002390000-0x00000000023E4000-memory.dmp

      Filesize

      336KB

    • memory/4048-31-0x0000000000400000-0x000000000056B000-memory.dmp

      Filesize

      1.4MB

    • memory/4048-1-0x0000000000B10000-0x0000000000B11000-memory.dmp

      Filesize

      4KB