Analysis

  • max time kernel
    141s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2024, 04:07

General

  • Target

    2494521b41bd0dff6ba4c82491913ba0_JaffaCakes118.exe

  • Size

    27KB

  • MD5

    2494521b41bd0dff6ba4c82491913ba0

  • SHA1

    590568ea63863466fba2eb46a7277df251232964

  • SHA256

    478632a5e115ed74a3104b9627333eabbd2565976a2c7402f8b9b976f6eee22b

  • SHA512

    22af5ba52df6e7ac1bfc6dbcd6195d74cdcbb6c7700575107e7aee304e5a4c68f39ee11823e8521322d8bf61f7614d6a80b2c9e1a2649e1cef4fab433f244239

  • SSDEEP

    768:+IJpFHSLyupC2/kB5cy+2f1B4FuUD83w84xSHXMHx:+IJpFHSOuopPcy+2HgnywfxSHcHx

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2494521b41bd0dff6ba4c82491913ba0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2494521b41bd0dff6ba4c82491913ba0_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4792
    • C:\RECYCLER\winwm.exe
      C:\RECYCLER\winwm.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:4840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\RECYCLER\winwm.exe

    Filesize

    27KB

    MD5

    2494521b41bd0dff6ba4c82491913ba0

    SHA1

    590568ea63863466fba2eb46a7277df251232964

    SHA256

    478632a5e115ed74a3104b9627333eabbd2565976a2c7402f8b9b976f6eee22b

    SHA512

    22af5ba52df6e7ac1bfc6dbcd6195d74cdcbb6c7700575107e7aee304e5a4c68f39ee11823e8521322d8bf61f7614d6a80b2c9e1a2649e1cef4fab433f244239

  • C:\RECYCLER\wm.dll

    Filesize

    32KB

    MD5

    74a955712209327a1ad86ff7b861749e

    SHA1

    6befaf150a1cf05a6b675eb83a942c4dcd893a39

    SHA256

    a132927a5ba160ed7047a6caa2abd6bac9ab8c5a58d2acfcc1f1709a9279f1b7

    SHA512

    d730b18ef4b4176e34f7ae584631c7d88aa5f0dd6c25ceaad0aea946385a6295920722f9b7bf13c8e6d9a63aa48e4de2aad8de3d660e98ee9db6c46457390979

  • memory/4792-0-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

  • memory/4792-14-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

  • memory/4840-11-0x0000000002030000-0x000000000203E000-memory.dmp

    Filesize

    56KB

  • memory/4840-15-0x0000000002030000-0x000000000203E000-memory.dmp

    Filesize

    56KB

  • memory/4840-17-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB