Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    04/07/2024, 00:52

General

  • Target

    2414892b41b41b804d8fabd38504aa1b_JaffaCakes118.exe

  • Size

    749KB

  • MD5

    2414892b41b41b804d8fabd38504aa1b

  • SHA1

    acaf76665a10c46307d54f43f8515af74e304749

  • SHA256

    c6bf350eadd3ddff66ad9cf808ae1bd10d183bbab89471acc34225671df66b14

  • SHA512

    06981df5a8f29421860772f9d84e6f1dacf75dce4c8c072eea69480ac6881776e979d583671a2cc9afed68a22c00874725589e1a14ab515e8df0a4dd12f1f7fa

  • SSDEEP

    12288:TPi/ptRfZ4ZwiE03kr5oM0RwoYAvyF3Z4mxxkxPCjcngNPV:Tg5abl3kr5bswAyQmXNNPV

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2414892b41b41b804d8fabd38504aa1b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2414892b41b41b804d8fabd38504aa1b_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1800
    • C:\Windows\SysWOW64\mstsc.exe
      "C:\Windows\system32\mstsc.exe"
      2⤵
        PID:2604

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1800-0-0x0000000000400000-0x0000000000589000-memory.dmp

      Filesize

      1.5MB

    • memory/1800-1-0x0000000000280000-0x00000000002D4000-memory.dmp

      Filesize

      336KB

    • memory/1800-3-0x0000000001EC0000-0x0000000001EC1000-memory.dmp

      Filesize

      4KB

    • memory/1800-4-0x0000000001F10000-0x0000000001F11000-memory.dmp

      Filesize

      4KB

    • memory/1800-7-0x0000000001F00000-0x0000000001F01000-memory.dmp

      Filesize

      4KB

    • memory/1800-8-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

      Filesize

      4KB

    • memory/1800-6-0x00000000003E0000-0x00000000003E1000-memory.dmp

      Filesize

      4KB

    • memory/1800-5-0x00000000003F0000-0x00000000003F1000-memory.dmp

      Filesize

      4KB

    • memory/1800-2-0x0000000001EE0000-0x0000000001EE1000-memory.dmp

      Filesize

      4KB

    • memory/1800-9-0x0000000001F60000-0x0000000001F61000-memory.dmp

      Filesize

      4KB

    • memory/1800-15-0x00000000032B0000-0x00000000032B1000-memory.dmp

      Filesize

      4KB

    • memory/1800-17-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-16-0x00000000032B0000-0x00000000032B1000-memory.dmp

      Filesize

      4KB

    • memory/1800-31-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-30-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-29-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-28-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-27-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-26-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-25-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-24-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-23-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-22-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-21-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-20-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-19-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-18-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-14-0x00000000032B0000-0x00000000032B1000-memory.dmp

      Filesize

      4KB

    • memory/1800-13-0x00000000032B0000-0x00000000032B1000-memory.dmp

      Filesize

      4KB

    • memory/1800-12-0x00000000032B0000-0x00000000032B1000-memory.dmp

      Filesize

      4KB

    • memory/1800-11-0x00000000032B0000-0x00000000032B1000-memory.dmp

      Filesize

      4KB

    • memory/1800-37-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-46-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-57-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-58-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-56-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-55-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-54-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-53-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-52-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-51-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-50-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-49-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-48-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-47-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-45-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-44-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-43-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-42-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-41-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-40-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-39-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-38-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-36-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-35-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-34-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-33-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-32-0x00000000032A0000-0x00000000032A1000-memory.dmp

      Filesize

      4KB

    • memory/1800-10-0x0000000000720000-0x0000000000721000-memory.dmp

      Filesize

      4KB

    • memory/1800-64-0x0000000000400000-0x0000000000589000-memory.dmp

      Filesize

      1.5MB

    • memory/1800-65-0x0000000000280000-0x00000000002D4000-memory.dmp

      Filesize

      336KB

    • memory/2604-60-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2604-62-0x0000000000400000-0x0000000000589000-memory.dmp

      Filesize

      1.5MB

    • memory/2604-63-0x0000000000400000-0x0000000000589000-memory.dmp

      Filesize

      1.5MB