Analysis
- max time kernel
51s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
22/06/2024, 16:47
General
- Target 03042e28fc12a12c8a90a56b23dbaa15_JaffaCakes118.exe
- Size 751KB
- Sample240622-va2prazakj
- SHA256 96bcd6c4eb8d88336f23c4dc5327f7fe0d31088f9263ef076b20fe7be3878344
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 1 IoCs
- Drops file in Windows directory 1 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\03042e28fc12a12c8a90a56b23dbaa15_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\03042e28fc12a12c8a90a56b23dbaa15_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 3242⤵
- Program crash
-
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2444 -ip 24441⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2444-0-0x0000000000400000-0x0000000000588000-memory.dmp
memory/2444-1-0x0000000000A60000-0x0000000000AB4000-memory.dmp
memory/2444-14-0x00000000033D0000-0x00000000033D1000-memory.dmp
memory/2444-18-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/2444-17-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/2444-16-0x00000000033D0000-0x00000000033D1000-memory.dmp
memory/2444-15-0x00000000033D0000-0x00000000033D1000-memory.dmp
memory/2444-13-0x00000000033D0000-0x00000000033D1000-memory.dmp
memory/2444-12-0x00000000033D0000-0x00000000033D1000-memory.dmp
memory/2444-11-0x00000000033D0000-0x00000000033D1000-memory.dmp
memory/2444-10-0x00000000023F0000-0x00000000023F1000-memory.dmp
memory/2444-9-0x0000000002460000-0x0000000002461000-memory.dmp
memory/2444-8-0x0000000002430000-0x0000000002431000-memory.dmp
memory/2444-7-0x0000000002440000-0x0000000002441000-memory.dmp
memory/2444-6-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/2444-5-0x00000000023E0000-0x00000000023E1000-memory.dmp
memory/2444-4-0x0000000002450000-0x0000000002451000-memory.dmp
memory/2444-3-0x0000000002400000-0x0000000002401000-memory.dmp
memory/2444-2-0x0000000002420000-0x0000000002421000-memory.dmp
memory/2444-21-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-20-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-19-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-49-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-55-0x0000000000A60000-0x0000000000AB4000-memory.dmp
memory/2444-54-0x0000000000400000-0x0000000000588000-memory.dmp
memory/2444-51-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-50-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-48-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-47-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-46-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-45-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-44-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-43-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-42-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-41-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-40-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-39-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-38-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-37-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-36-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-35-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-34-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-33-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-32-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-31-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-30-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-29-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-28-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-27-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-26-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-25-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-24-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-23-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-22-0x00000000033C0000-0x0000000003400000-memory.dmp
memory/2444-56-0x00000000033C0000-0x0000000003400000-memory.dmp