Malware Analysis Report

2025-04-13 20:42

Sample ID 240703-2z8ypasdme
Target 23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118
SHA256 941a598e52d20ab1a145a29a6db14115544626fa8e85908eacf06415eb63c73e
Tags
modiloader persistence privilege_escalation trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

941a598e52d20ab1a145a29a6db14115544626fa8e85908eacf06415eb63c73e

Threat Level: Known bad

The file 23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

modiloader persistence privilege_escalation trojan

ModiLoader, DBatLoader

ModiLoader Second Stage

Executes dropped EXE

Deletes itself

Enumerates connected drives

Drops autorun.inf file

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Program crash

Event Triggered Execution: Accessibility Features

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-03 23:02

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-03 23:02

Reported

2024-07-03 23:04

Platform

win7-20240611-en

Max time kernel

141s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\windows_ipcomfig N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification F:\AutoRun.inf C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened for modification C:\AutoRun.inf C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2012 set thread context of 2652 N/A C:\Windows\windows_ipcomfig C:\Windows\SysWOW64\osk.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\_windows_ipcomfig C:\Windows\windows_ipcomfig N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\_windows_ipcomfig C:\Windows\windows_ipcomfig N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\windows_ipcomfig C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened for modification C:\Windows\windows_ipcomfig C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File created C:\Windows\ReDelBat.bat C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A

Event Triggered Execution: Accessibility Features

persistence privilege_escalation

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\windows_ipcomfig

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2740 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe C:\Windows\windows_ipcomfig
PID 2740 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe C:\Windows\windows_ipcomfig
PID 2740 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe C:\Windows\windows_ipcomfig
PID 2740 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe C:\Windows\windows_ipcomfig
PID 2012 wrote to memory of 2652 N/A C:\Windows\windows_ipcomfig C:\Windows\SysWOW64\osk.exe
PID 2012 wrote to memory of 2652 N/A C:\Windows\windows_ipcomfig C:\Windows\SysWOW64\osk.exe
PID 2012 wrote to memory of 2652 N/A C:\Windows\windows_ipcomfig C:\Windows\SysWOW64\osk.exe
PID 2012 wrote to memory of 2652 N/A C:\Windows\windows_ipcomfig C:\Windows\SysWOW64\osk.exe
PID 2012 wrote to memory of 2652 N/A C:\Windows\windows_ipcomfig C:\Windows\SysWOW64\osk.exe
PID 2012 wrote to memory of 2652 N/A C:\Windows\windows_ipcomfig C:\Windows\SysWOW64\osk.exe
PID 2012 wrote to memory of 2656 N/A C:\Windows\windows_ipcomfig C:\Windows\SysWOW64\WerFault.exe
PID 2012 wrote to memory of 2656 N/A C:\Windows\windows_ipcomfig C:\Windows\SysWOW64\WerFault.exe
PID 2012 wrote to memory of 2656 N/A C:\Windows\windows_ipcomfig C:\Windows\SysWOW64\WerFault.exe
PID 2012 wrote to memory of 2656 N/A C:\Windows\windows_ipcomfig C:\Windows\SysWOW64\WerFault.exe
PID 2740 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe"

C:\Windows\windows_ipcomfig

C:\Windows\windows_ipcomfig

C:\Windows\SysWOW64\osk.exe

"C:\Windows\system32\osk.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 280

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Windows\ReDelBat.bat

Network

N/A

Files

memory/2740-19-0x0000000000580000-0x0000000000581000-memory.dmp

F:\AutoRun.inf

MD5 f523fc2c9cd2cae0ff1c89cd08572d89
SHA1 78330e1621fdc200b742cbcaedc598c7033d88e4
SHA256 6c4de927033652cf18e7a3707ff45c288b97b9fae1c33ed763d1feb8cea173a7
SHA512 80e0e03f577560fa61649257adde0012938102147a1aad9da957dd9698ec1212fa01dfe3efa45351f0eeccdd903d3c9d4e66bda60e1e964c965267ac2a8f7d76

F:\windows_ipcomfig

MD5 23c45f6ca292ee2b645dc2bb3da12993
SHA1 aef38822f494c71b0f84a3ce7d72fcf03fb768b8
SHA256 941a598e52d20ab1a145a29a6db14115544626fa8e85908eacf06415eb63c73e
SHA512 3c361a8c0e80620eea4460e007c6f57ffe0949ca2dc14e02469ea427b7971c46f28cd77729a7fe7337f836cca05e1bb8317acc7cce3fae2dd74cdc90b6ff3ce0

memory/2012-33-0x0000000000340000-0x0000000000341000-memory.dmp

memory/2652-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2652-38-0x0000000000400000-0x00000000004C5000-memory.dmp

memory/2652-41-0x0000000000450000-0x0000000000450000-memory.dmp

memory/2652-36-0x0000000000400000-0x00000000004C5000-memory.dmp

memory/2740-42-0x0000000000400000-0x00000000004C5000-memory.dmp

memory/2012-43-0x0000000000400000-0x00000000004C5000-memory.dmp

C:\Windows\ReDelBat.bat

MD5 02be46d6d8dc02d6e10217bf4c9a5702
SHA1 704210e0ecfc24b62e85c1958f940b7f5600d6c6
SHA256 7674b472a334a4e7b0e71dc7e96ebbe87c684fcd3ea5c2ace9ddd9a905c4dfc5
SHA512 63356afe1304d93bc9067a9e85153e44c3889867004e30e13be8815dae328e48fa93eec17608afb76284007a59ce26375af3752a42b8e7c67042500540792d68

memory/2740-55-0x0000000000400000-0x00000000004C5000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-03 23:02

Reported

2024-07-03 23:05

Platform

win10v2004-20240508-en

Max time kernel

125s

Max time network

133s

Command Line

"C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\windows_ipcomfig N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\AutoRun.inf C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened for modification F:\AutoRun.inf C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\_windows_ipcomfig C:\Windows\windows_ipcomfig N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\_windows_ipcomfig C:\Windows\windows_ipcomfig N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\windows_ipcomfig C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File opened for modification C:\Windows\windows_ipcomfig C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A
File created C:\Windows\ReDelBat.bat C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\23c45f6ca292ee2b645dc2bb3da12993_JaffaCakes118.exe"

C:\Windows\windows_ipcomfig

C:\Windows\windows_ipcomfig

C:\program files\internet explorer\IEXPLORE.EXE

"C:\program files\internet explorer\IEXPLORE.EXE"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Windows\ReDelBat.bat

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4332,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 98.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp

Files

memory/4180-2-0x0000000002310000-0x0000000002311000-memory.dmp

C:\AutoRun.inf

MD5 f523fc2c9cd2cae0ff1c89cd08572d89
SHA1 78330e1621fdc200b742cbcaedc598c7033d88e4
SHA256 6c4de927033652cf18e7a3707ff45c288b97b9fae1c33ed763d1feb8cea173a7
SHA512 80e0e03f577560fa61649257adde0012938102147a1aad9da957dd9698ec1212fa01dfe3efa45351f0eeccdd903d3c9d4e66bda60e1e964c965267ac2a8f7d76

F:\windows_ipcomfig

MD5 23c45f6ca292ee2b645dc2bb3da12993
SHA1 aef38822f494c71b0f84a3ce7d72fcf03fb768b8
SHA256 941a598e52d20ab1a145a29a6db14115544626fa8e85908eacf06415eb63c73e
SHA512 3c361a8c0e80620eea4460e007c6f57ffe0949ca2dc14e02469ea427b7971c46f28cd77729a7fe7337f836cca05e1bb8317acc7cce3fae2dd74cdc90b6ff3ce0

memory/2652-31-0x00000000020D0000-0x00000000020D1000-memory.dmp

memory/2652-33-0x0000000000400000-0x00000000004C5000-memory.dmp

memory/4180-35-0x0000000000400000-0x00000000004C5000-memory.dmp

C:\Windows\ReDelBat.bat

MD5 02be46d6d8dc02d6e10217bf4c9a5702
SHA1 704210e0ecfc24b62e85c1958f940b7f5600d6c6
SHA256 7674b472a334a4e7b0e71dc7e96ebbe87c684fcd3ea5c2ace9ddd9a905c4dfc5
SHA512 63356afe1304d93bc9067a9e85153e44c3889867004e30e13be8815dae328e48fa93eec17608afb76284007a59ce26375af3752a42b8e7c67042500540792d68