Analysis

  • max time kernel
    92s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2024, 02:30

General

  • Target

    2454eb9b310f7ce365102e725ae20384_JaffaCakes118.exe

  • Size

    466KB

  • MD5

    2454eb9b310f7ce365102e725ae20384

  • SHA1

    40325cb980adc5ad27b43fd16c5d976c33990310

  • SHA256

    b9e618bc5e2a5b52ebc616441b89408deb9d5bd4708275b1296627c3a6ec0173

  • SHA512

    2d28338864446f45317a31ec472c425b5ae85990812f13abd2d2ec6cc0311721990f222903680cddfe37ad7cb3c4547dba43c376e973ec2c78b634f92fd3c7ac

  • SSDEEP

    12288:iSv8tHUEnrgtTdF3Z4mxxd7qPjyzgBLrkR/ZzeQKL6:iC+PIQmX0LbZkbzeBL6

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 6 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2454eb9b310f7ce365102e725ae20384_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2454eb9b310f7ce365102e725ae20384_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1900
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c del "C:\Users\Admin\AppData\Local\Temp\2454eb9b310f7ce365102e725ae20384_JaffaCakes118.exe"
      2⤵
        PID:3536
    • C:\Users\Admin\Favorites\netservice.exe
      C:\Users\Admin\Favorites\netservice.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:624
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\System32\svchost.exe
        2⤵
          PID:3316
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 1032
            3⤵
            • Program crash
            PID:3052
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 1040
            3⤵
            • Program crash
            PID:1376
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3316 -ip 3316
        1⤵
          PID:3516
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 3316 -ip 3316
          1⤵
            PID:1704

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\Favorites\netservice.exe

            Filesize

            466KB

            MD5

            2454eb9b310f7ce365102e725ae20384

            SHA1

            40325cb980adc5ad27b43fd16c5d976c33990310

            SHA256

            b9e618bc5e2a5b52ebc616441b89408deb9d5bd4708275b1296627c3a6ec0173

            SHA512

            2d28338864446f45317a31ec472c425b5ae85990812f13abd2d2ec6cc0311721990f222903680cddfe37ad7cb3c4547dba43c376e973ec2c78b634f92fd3c7ac

          • memory/624-69-0x0000000000400000-0x0000000000484000-memory.dmp

            Filesize

            528KB

          • memory/624-61-0x0000000010410000-0x0000000010464000-memory.dmp

            Filesize

            336KB

          • memory/624-23-0x0000000010410000-0x0000000010464000-memory.dmp

            Filesize

            336KB

          • memory/1900-5-0x00000000022E0000-0x00000000022E1000-memory.dmp

            Filesize

            4KB

          • memory/1900-15-0x0000000000700000-0x0000000000701000-memory.dmp

            Filesize

            4KB

          • memory/1900-13-0x0000000003310000-0x0000000003311000-memory.dmp

            Filesize

            4KB

          • memory/1900-12-0x00000000032C0000-0x00000000032C2000-memory.dmp

            Filesize

            8KB

          • memory/1900-11-0x00000000032D0000-0x00000000032D1000-memory.dmp

            Filesize

            4KB

          • memory/1900-10-0x00000000022F0000-0x00000000022F1000-memory.dmp

            Filesize

            4KB

          • memory/1900-9-0x0000000002360000-0x0000000002361000-memory.dmp

            Filesize

            4KB

          • memory/1900-8-0x0000000002330000-0x0000000002331000-memory.dmp

            Filesize

            4KB

          • memory/1900-7-0x0000000002340000-0x0000000002341000-memory.dmp

            Filesize

            4KB

          • memory/1900-6-0x00000000022D0000-0x00000000022D1000-memory.dmp

            Filesize

            4KB

          • memory/1900-0-0x0000000000400000-0x0000000000484000-memory.dmp

            Filesize

            528KB

          • memory/1900-4-0x0000000002350000-0x0000000002351000-memory.dmp

            Filesize

            4KB

          • memory/1900-3-0x0000000002300000-0x0000000002301000-memory.dmp

            Filesize

            4KB

          • memory/1900-14-0x00000000006F0000-0x00000000006F1000-memory.dmp

            Filesize

            4KB

          • memory/1900-21-0x0000000000400000-0x0000000000484000-memory.dmp

            Filesize

            528KB

          • memory/1900-22-0x0000000002160000-0x00000000021B4000-memory.dmp

            Filesize

            336KB

          • memory/1900-16-0x00000000032E0000-0x00000000032E1000-memory.dmp

            Filesize

            4KB

          • memory/1900-1-0x0000000002160000-0x00000000021B4000-memory.dmp

            Filesize

            336KB

          • memory/1900-2-0x0000000002320000-0x0000000002321000-memory.dmp

            Filesize

            4KB

          • memory/3316-24-0x0000000000530000-0x0000000000531000-memory.dmp

            Filesize

            4KB

          • memory/3316-64-0x0000000002700000-0x0000000002701000-memory.dmp

            Filesize

            4KB

          • memory/3316-65-0x0000000010410000-0x0000000010464000-memory.dmp

            Filesize

            336KB

          • memory/3316-66-0x0000000010410000-0x0000000010464000-memory.dmp

            Filesize

            336KB

          • memory/3316-68-0x0000000010410000-0x0000000010464000-memory.dmp

            Filesize

            336KB

          • memory/3316-25-0x00000000005F0000-0x00000000005F1000-memory.dmp

            Filesize

            4KB

          • memory/3316-71-0x0000000010410000-0x0000000010464000-memory.dmp

            Filesize

            336KB