Analysis
- max time kernel
51s - max time network
52s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
25/06/2024, 03:46
General
- Target 0c5cb0cb90a8006a1869d8de603da7bf_JaffaCakes118.exe
- Size 632KB
- Sample240625-ebtsjascnl
- SHA256 b2cd7d847cab8a2dd695451e01a7de2b9af027186fca83b589b30f56a0ad5a50
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 3 IoCs
- Executes dropped EXE 1 IoCs
- Drops file in System32 directory 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 2 IoCs
- Program crash 7 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c5cb0cb90a8006a1869d8de603da7bf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0c5cb0cb90a8006a1869d8de603da7bf_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 5322⤵
- Program crash
-
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\windows r server.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\windows r server.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 5323⤵
- Program crash
-
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 124⤵
- Program crash
-
-
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 6883⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 8363⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 1403⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 1402⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4960 -ip 49601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3192 -ip 31921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2324 -ip 23241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3192 -ip 31921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4960 -ip 49601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3192 -ip 31921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3192 -ip 31921⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
windows r server.exe
memory/2324-35-0x0000000000400000-0x0000000000517000-memory.dmp
memory/3192-42-0x0000000002210000-0x0000000002264000-memory.dmp
memory/3192-41-0x0000000000400000-0x0000000000517000-memory.dmp
memory/3192-32-0x0000000002210000-0x0000000002264000-memory.dmp
memory/3192-31-0x0000000000400000-0x0000000000517000-memory.dmp
memory/4960-11-0x00000000034C0000-0x00000000035C0000-memory.dmp
memory/4960-22-0x00000000034F0000-0x00000000034F1000-memory.dmp
memory/4960-12-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/4960-0-0x0000000000400000-0x0000000000517000-memory.dmp
memory/4960-10-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/4960-9-0x0000000002560000-0x0000000002561000-memory.dmp
memory/4960-8-0x0000000002530000-0x0000000002531000-memory.dmp
memory/4960-7-0x0000000002540000-0x0000000002541000-memory.dmp
memory/4960-6-0x00000000024D0000-0x00000000024D1000-memory.dmp
memory/4960-5-0x00000000024E0000-0x00000000024E1000-memory.dmp
memory/4960-4-0x0000000002550000-0x0000000002551000-memory.dmp
memory/4960-3-0x0000000002500000-0x0000000002501000-memory.dmp
memory/4960-2-0x0000000002520000-0x0000000002521000-memory.dmp
memory/4960-24-0x0000000003550000-0x0000000003551000-memory.dmp
memory/4960-23-0x00000000034E0000-0x00000000034E1000-memory.dmp
memory/4960-13-0x00000000034C0000-0x00000000034C3000-memory.dmp
memory/4960-21-0x0000000003500000-0x0000000003501000-memory.dmp
memory/4960-20-0x00000000022A0000-0x00000000022A1000-memory.dmp
memory/4960-19-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/4960-25-0x00000000026E0000-0x00000000026E1000-memory.dmp
memory/4960-14-0x00000000035C0000-0x00000000035C1000-memory.dmp
memory/4960-15-0x00000000035C0000-0x00000000035C1000-memory.dmp
memory/4960-16-0x00000000035C0000-0x00000000035C1000-memory.dmp
memory/4960-17-0x00000000035C0000-0x00000000035C1000-memory.dmp
memory/4960-37-0x0000000003540000-0x0000000003541000-memory.dmp
memory/4960-38-0x0000000003530000-0x0000000003531000-memory.dmp
memory/4960-39-0x0000000000400000-0x0000000000517000-memory.dmp
memory/4960-40-0x0000000002320000-0x0000000002374000-memory.dmp
memory/4960-18-0x00000000035C0000-0x00000000035C1000-memory.dmp
memory/4960-1-0x0000000002320000-0x0000000002374000-memory.dmp