Analysis Overview
SHA256
c6bf350eadd3ddff66ad9cf808ae1bd10d183bbab89471acc34225671df66b14
Threat Level: Known bad
The file 2414892b41b41b804d8fabd38504aa1b_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
ModiLoader, DBatLoader
ModiLoader Second Stage
Suspicious use of SetThreadContext
Drops file in Program Files directory
Unsigned PE
Program crash
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-07-04 00:52
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-07-04 00:52
Reported
2024-07-04 00:55
Platform
win7-20240611-en
Max time kernel
120s
Max time network
125s
Command Line
Signatures
ModiLoader, DBatLoader
ModiLoader Second Stage
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1800 set thread context of 2604 | N/A | C:\Users\Admin\AppData\Local\Temp\2414892b41b41b804d8fabd38504aa1b_JaffaCakes118.exe | C:\Windows\SysWOW64\mstsc.exe |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files\SetupWay.txt | C:\Users\Admin\AppData\Local\Temp\2414892b41b41b804d8fabd38504aa1b_JaffaCakes118.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1800 wrote to memory of 2604 | N/A | C:\Users\Admin\AppData\Local\Temp\2414892b41b41b804d8fabd38504aa1b_JaffaCakes118.exe | C:\Windows\SysWOW64\mstsc.exe |
| PID 1800 wrote to memory of 2604 | N/A | C:\Users\Admin\AppData\Local\Temp\2414892b41b41b804d8fabd38504aa1b_JaffaCakes118.exe | C:\Windows\SysWOW64\mstsc.exe |
| PID 1800 wrote to memory of 2604 | N/A | C:\Users\Admin\AppData\Local\Temp\2414892b41b41b804d8fabd38504aa1b_JaffaCakes118.exe | C:\Windows\SysWOW64\mstsc.exe |
| PID 1800 wrote to memory of 2604 | N/A | C:\Users\Admin\AppData\Local\Temp\2414892b41b41b804d8fabd38504aa1b_JaffaCakes118.exe | C:\Windows\SysWOW64\mstsc.exe |
| PID 1800 wrote to memory of 2604 | N/A | C:\Users\Admin\AppData\Local\Temp\2414892b41b41b804d8fabd38504aa1b_JaffaCakes118.exe | C:\Windows\SysWOW64\mstsc.exe |
| PID 1800 wrote to memory of 2604 | N/A | C:\Users\Admin\AppData\Local\Temp\2414892b41b41b804d8fabd38504aa1b_JaffaCakes118.exe | C:\Windows\SysWOW64\mstsc.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\2414892b41b41b804d8fabd38504aa1b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2414892b41b41b804d8fabd38504aa1b_JaffaCakes118.exe"
C:\Windows\SysWOW64\mstsc.exe
"C:\Windows\system32\mstsc.exe"
Network
Files
memory/1800-0-0x0000000000400000-0x0000000000589000-memory.dmp
memory/1800-1-0x0000000000280000-0x00000000002D4000-memory.dmp
memory/1800-3-0x0000000001EC0000-0x0000000001EC1000-memory.dmp
memory/1800-4-0x0000000001F10000-0x0000000001F11000-memory.dmp
memory/1800-7-0x0000000001F00000-0x0000000001F01000-memory.dmp
memory/1800-8-0x0000000001EF0000-0x0000000001EF1000-memory.dmp
memory/1800-6-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/1800-5-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/1800-2-0x0000000001EE0000-0x0000000001EE1000-memory.dmp
memory/1800-9-0x0000000001F60000-0x0000000001F61000-memory.dmp
memory/1800-15-0x00000000032B0000-0x00000000032B1000-memory.dmp
memory/1800-17-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-16-0x00000000032B0000-0x00000000032B1000-memory.dmp
memory/1800-31-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-30-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-29-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-28-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-27-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-26-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-25-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-24-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-23-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-22-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-21-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-20-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-19-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-18-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-14-0x00000000032B0000-0x00000000032B1000-memory.dmp
memory/1800-13-0x00000000032B0000-0x00000000032B1000-memory.dmp
memory/1800-12-0x00000000032B0000-0x00000000032B1000-memory.dmp
memory/1800-11-0x00000000032B0000-0x00000000032B1000-memory.dmp
memory/1800-37-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-46-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-57-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-58-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-56-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-55-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-54-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-53-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-52-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-51-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-50-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-49-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-48-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-47-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-45-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-44-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-43-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-42-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-41-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-40-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-39-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-38-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-36-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-35-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-34-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-33-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-32-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/1800-10-0x0000000000720000-0x0000000000721000-memory.dmp
memory/2604-60-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2604-62-0x0000000000400000-0x0000000000589000-memory.dmp
memory/2604-63-0x0000000000400000-0x0000000000589000-memory.dmp
memory/1800-64-0x0000000000400000-0x0000000000589000-memory.dmp
memory/1800-65-0x0000000000280000-0x00000000002D4000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-07-04 00:52
Reported
2024-07-04 00:55
Platform
win10v2004-20240508-en
Max time kernel
149s
Max time network
153s
Command Line
Signatures
ModiLoader, DBatLoader
ModiLoader Second Stage
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1320 set thread context of 2156 | N/A | C:\Users\Admin\AppData\Local\Temp\2414892b41b41b804d8fabd38504aa1b_JaffaCakes118.exe | C:\Windows\SysWOW64\mstsc.exe |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files\SetupWay.txt | C:\Users\Admin\AppData\Local\Temp\2414892b41b41b804d8fabd38504aa1b_JaffaCakes118.exe | N/A |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\2414892b41b41b804d8fabd38504aa1b_JaffaCakes118.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\SysWOW64\mstsc.exe |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1320 wrote to memory of 2156 | N/A | C:\Users\Admin\AppData\Local\Temp\2414892b41b41b804d8fabd38504aa1b_JaffaCakes118.exe | C:\Windows\SysWOW64\mstsc.exe |
| PID 1320 wrote to memory of 2156 | N/A | C:\Users\Admin\AppData\Local\Temp\2414892b41b41b804d8fabd38504aa1b_JaffaCakes118.exe | C:\Windows\SysWOW64\mstsc.exe |
| PID 1320 wrote to memory of 2156 | N/A | C:\Users\Admin\AppData\Local\Temp\2414892b41b41b804d8fabd38504aa1b_JaffaCakes118.exe | C:\Windows\SysWOW64\mstsc.exe |
| PID 1320 wrote to memory of 2156 | N/A | C:\Users\Admin\AppData\Local\Temp\2414892b41b41b804d8fabd38504aa1b_JaffaCakes118.exe | C:\Windows\SysWOW64\mstsc.exe |
| PID 1320 wrote to memory of 2156 | N/A | C:\Users\Admin\AppData\Local\Temp\2414892b41b41b804d8fabd38504aa1b_JaffaCakes118.exe | C:\Windows\SysWOW64\mstsc.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\2414892b41b41b804d8fabd38504aa1b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2414892b41b41b804d8fabd38504aa1b_JaffaCakes118.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1320 -ip 1320
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 220
C:\Windows\SysWOW64\mstsc.exe
"C:\Windows\system32\mstsc.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2156 -ip 2156
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 12
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.142.211.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 92.12.20.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 66.112.168.52.in-addr.arpa | udp |
Files
memory/1320-0-0x0000000000400000-0x0000000000589000-memory.dmp
memory/1320-1-0x0000000000AD0000-0x0000000000B24000-memory.dmp
memory/1320-67-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-66-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-65-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-64-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-63-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-62-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-61-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-60-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-59-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-58-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-57-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-56-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-55-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-54-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-53-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-52-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-51-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-50-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-49-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-48-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-47-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-46-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-45-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-44-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-43-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-42-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-41-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-40-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-39-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-38-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-37-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-36-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-35-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-34-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-33-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-32-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-31-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-30-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-29-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-28-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-27-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-26-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-25-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-24-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-23-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-22-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-21-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-20-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-19-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-18-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-17-0x00000000033C0000-0x00000000033C1000-memory.dmp
memory/1320-16-0x00000000033D0000-0x00000000033D1000-memory.dmp
memory/1320-15-0x00000000033D0000-0x00000000033D1000-memory.dmp
memory/1320-14-0x00000000033D0000-0x00000000033D1000-memory.dmp
memory/1320-13-0x00000000033D0000-0x00000000033D1000-memory.dmp
memory/1320-12-0x00000000033D0000-0x00000000033D1000-memory.dmp
memory/1320-11-0x00000000033D0000-0x00000000033D1000-memory.dmp
memory/1320-10-0x00000000023F0000-0x00000000023F1000-memory.dmp
memory/1320-9-0x0000000002460000-0x0000000002461000-memory.dmp
memory/1320-8-0x0000000002430000-0x0000000002431000-memory.dmp
memory/1320-7-0x0000000002440000-0x0000000002441000-memory.dmp
memory/1320-6-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/1320-5-0x00000000023E0000-0x00000000023E1000-memory.dmp
memory/1320-4-0x0000000002450000-0x0000000002451000-memory.dmp
memory/1320-3-0x0000000002400000-0x0000000002401000-memory.dmp
memory/1320-2-0x0000000002420000-0x0000000002421000-memory.dmp
memory/2156-69-0x0000000000400000-0x0000000000589000-memory.dmp
memory/1320-72-0x0000000000400000-0x0000000000589000-memory.dmp
memory/1320-71-0x0000000000AD0000-0x0000000000B24000-memory.dmp