Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    04/07/2024, 02:30

General

  • Target

    2454eb9b310f7ce365102e725ae20384_JaffaCakes118.exe

  • Size

    466KB

  • MD5

    2454eb9b310f7ce365102e725ae20384

  • SHA1

    40325cb980adc5ad27b43fd16c5d976c33990310

  • SHA256

    b9e618bc5e2a5b52ebc616441b89408deb9d5bd4708275b1296627c3a6ec0173

  • SHA512

    2d28338864446f45317a31ec472c425b5ae85990812f13abd2d2ec6cc0311721990f222903680cddfe37ad7cb3c4547dba43c376e973ec2c78b634f92fd3c7ac

  • SSDEEP

    12288:iSv8tHUEnrgtTdF3Z4mxxd7qPjyzgBLrkR/ZzeQKL6:iC+PIQmX0LbZkbzeBL6

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 2 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2454eb9b310f7ce365102e725ae20384_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2454eb9b310f7ce365102e725ae20384_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1912
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c del "C:\Users\Admin\AppData\Local\Temp\2454eb9b310f7ce365102e725ae20384_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      PID:2920
  • C:\Users\Admin\Favorites\netservice.exe
    C:\Users\Admin\Favorites\netservice.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2564
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\System32\svchost.exe
      2⤵
        PID:2592

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Favorites\netservice.exe

      Filesize

      466KB

      MD5

      2454eb9b310f7ce365102e725ae20384

      SHA1

      40325cb980adc5ad27b43fd16c5d976c33990310

      SHA256

      b9e618bc5e2a5b52ebc616441b89408deb9d5bd4708275b1296627c3a6ec0173

      SHA512

      2d28338864446f45317a31ec472c425b5ae85990812f13abd2d2ec6cc0311721990f222903680cddfe37ad7cb3c4547dba43c376e973ec2c78b634f92fd3c7ac

    • memory/1912-6-0x0000000000360000-0x0000000000361000-memory.dmp

      Filesize

      4KB

    • memory/1912-11-0x00000000031B0000-0x00000000031B1000-memory.dmp

      Filesize

      4KB

    • memory/1912-16-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/1912-15-0x00000000031C0000-0x00000000031C1000-memory.dmp

      Filesize

      4KB

    • memory/1912-13-0x00000000031F0000-0x00000000031F1000-memory.dmp

      Filesize

      4KB

    • memory/1912-12-0x00000000031A0000-0x00000000031A2000-memory.dmp

      Filesize

      8KB

    • memory/1912-0-0x0000000000400000-0x0000000000484000-memory.dmp

      Filesize

      528KB

    • memory/1912-10-0x0000000000380000-0x0000000000381000-memory.dmp

      Filesize

      4KB

    • memory/1912-9-0x0000000000650000-0x0000000000651000-memory.dmp

      Filesize

      4KB

    • memory/1912-8-0x0000000000620000-0x0000000000621000-memory.dmp

      Filesize

      4KB

    • memory/1912-14-0x0000000000220000-0x0000000000221000-memory.dmp

      Filesize

      4KB

    • memory/1912-7-0x0000000000630000-0x0000000000631000-memory.dmp

      Filesize

      4KB

    • memory/1912-1-0x0000000000280000-0x00000000002D4000-memory.dmp

      Filesize

      336KB

    • memory/1912-4-0x0000000000640000-0x0000000000641000-memory.dmp

      Filesize

      4KB

    • memory/1912-3-0x0000000000390000-0x0000000000391000-memory.dmp

      Filesize

      4KB

    • memory/1912-2-0x00000000003F0000-0x00000000003F1000-memory.dmp

      Filesize

      4KB

    • memory/1912-5-0x0000000000370000-0x0000000000371000-memory.dmp

      Filesize

      4KB

    • memory/1912-23-0x0000000000280000-0x00000000002D4000-memory.dmp

      Filesize

      336KB

    • memory/1912-22-0x0000000000400000-0x0000000000484000-memory.dmp

      Filesize

      528KB

    • memory/2564-20-0x0000000000400000-0x0000000000484000-memory.dmp

      Filesize

      528KB

    • memory/2564-247-0x0000000000400000-0x0000000000484000-memory.dmp

      Filesize

      528KB

    • memory/2592-31-0x00000000000E0000-0x00000000000E1000-memory.dmp

      Filesize

      4KB

    • memory/2592-25-0x0000000000080000-0x0000000000081000-memory.dmp

      Filesize

      4KB

    • memory/2592-40-0x0000000000120000-0x0000000000121000-memory.dmp

      Filesize

      4KB