Analysis

  • max time kernel
    41s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2024, 05:27

General

  • Target

    24c80dc0f04d5cb42bdae99e8227da27_JaffaCakes118.exe

  • Size

    617KB

  • MD5

    24c80dc0f04d5cb42bdae99e8227da27

  • SHA1

    5000232be787e5f4d702ec2fc3c3bb80e2403d25

  • SHA256

    168f32f2c3853fcceb4607efbedeb0cac01f8333dc7c75a87ccf8eabcbb68892

  • SHA512

    f66399e0aee1c1f06c01eb66e2466eb1262928342d5841f2b2977e95389d23b977533d34278b29d7ea8b4bca63ef0126e1c52e2ab0875eb2dcb1e28d7a9882cf

  • SSDEEP

    12288:Cj3eGwoHaqlxR+c0chWH/XpqmvXtF3Z4mxxtSXE3ygk6nOF2tjMq:E38oHvxh0chm/btQmXIXE3ygSFsj

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\24c80dc0f04d5cb42bdae99e8227da27_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\24c80dc0f04d5cb42bdae99e8227da27_JaffaCakes118.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2144
      • C:\Windows\SysWOW64\calc.exe
        "C:\Windows\system32\calc.exe"
        3⤵
          PID:3592
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 12
            4⤵
            • Program crash
            PID:3116
        • C:\program files\internet explorer\IEXPLORE.EXE
          "C:\program files\internet explorer\IEXPLORE.EXE"
          3⤵
            PID:1956
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 676
            3⤵
            • Program crash
            PID:1588
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2144 -ip 2144
        1⤵
          PID:2772
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3592 -ip 3592
          1⤵
            PID:64

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\Common Files\microsoft shared\MSInfo\rejoice47.exe

            Filesize

            617KB

            MD5

            24c80dc0f04d5cb42bdae99e8227da27

            SHA1

            5000232be787e5f4d702ec2fc3c3bb80e2403d25

            SHA256

            168f32f2c3853fcceb4607efbedeb0cac01f8333dc7c75a87ccf8eabcbb68892

            SHA512

            f66399e0aee1c1f06c01eb66e2466eb1262928342d5841f2b2977e95389d23b977533d34278b29d7ea8b4bca63ef0126e1c52e2ab0875eb2dcb1e28d7a9882cf

          • memory/2144-30-0x0000000000400000-0x000000000050C000-memory.dmp

            Filesize

            1.0MB

          • memory/2144-23-0x0000000000400000-0x000000000050C000-memory.dmp

            Filesize

            1.0MB

          • memory/2808-9-0x0000000002560000-0x0000000002561000-memory.dmp

            Filesize

            4KB

          • memory/2808-19-0x00000000034D0000-0x00000000034D1000-memory.dmp

            Filesize

            4KB

          • memory/2808-10-0x00000000024E0000-0x00000000024E1000-memory.dmp

            Filesize

            4KB

          • memory/2808-0-0x0000000000400000-0x000000000050C000-memory.dmp

            Filesize

            1.0MB

          • memory/2808-8-0x0000000002520000-0x0000000002521000-memory.dmp

            Filesize

            4KB

          • memory/2808-7-0x0000000002530000-0x0000000002531000-memory.dmp

            Filesize

            4KB

          • memory/2808-6-0x00000000024C0000-0x00000000024C1000-memory.dmp

            Filesize

            4KB

          • memory/2808-5-0x00000000024D0000-0x00000000024D1000-memory.dmp

            Filesize

            4KB

          • memory/2808-4-0x0000000002540000-0x0000000002541000-memory.dmp

            Filesize

            4KB

          • memory/2808-3-0x00000000024F0000-0x00000000024F1000-memory.dmp

            Filesize

            4KB

          • memory/2808-2-0x0000000002510000-0x0000000002511000-memory.dmp

            Filesize

            4KB

          • memory/2808-12-0x00000000034B0000-0x00000000034B3000-memory.dmp

            Filesize

            12KB

          • memory/2808-18-0x0000000002280000-0x0000000002281000-memory.dmp

            Filesize

            4KB

          • memory/2808-17-0x0000000002270000-0x0000000002271000-memory.dmp

            Filesize

            4KB

          • memory/2808-16-0x0000000003500000-0x0000000003501000-memory.dmp

            Filesize

            4KB

          • memory/2808-13-0x00000000035B0000-0x00000000035B1000-memory.dmp

            Filesize

            4KB

          • memory/2808-11-0x00000000034C0000-0x00000000034C1000-memory.dmp

            Filesize

            4KB

          • memory/2808-1-0x0000000002330000-0x0000000002384000-memory.dmp

            Filesize

            336KB

          • memory/2808-28-0x0000000000400000-0x000000000050C000-memory.dmp

            Filesize

            1.0MB

          • memory/2808-29-0x0000000002330000-0x0000000002384000-memory.dmp

            Filesize

            336KB

          • memory/3592-26-0x0000000000400000-0x000000000050C000-memory.dmp

            Filesize

            1.0MB