Malware Analysis Report

2025-04-13 20:41

Sample ID 240704-g2eseaybjr
Target 24ea45716e1f4fe1eeb203637eb77f9f_JaffaCakes118
SHA256 e3d76d970541997e04cdeea6fdef66ee9955f50dc73cb50576aea670587bb2ed
Tags
modiloader persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e3d76d970541997e04cdeea6fdef66ee9955f50dc73cb50576aea670587bb2ed

Threat Level: Known bad

The file 24ea45716e1f4fe1eeb203637eb77f9f_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

modiloader persistence trojan

ModiLoader, DBatLoader

ModiLoader Second Stage

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in Program Files directory

Unsigned PE

Program crash

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-04 06:17

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-04 06:17

Reported

2024-07-04 06:20

Platform

win7-20240220-en

Max time kernel

140s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\24ea45716e1f4fe1eeb203637eb77f9f_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\24ea45716e1f4fe1eeb203637eb77f9f_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\FieleWay.txt C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 840 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\24ea45716e1f4fe1eeb203637eb77f9f_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
PID 840 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\24ea45716e1f4fe1eeb203637eb77f9f_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
PID 840 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\24ea45716e1f4fe1eeb203637eb77f9f_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
PID 840 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\24ea45716e1f4fe1eeb203637eb77f9f_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
PID 840 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\24ea45716e1f4fe1eeb203637eb77f9f_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
PID 840 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\24ea45716e1f4fe1eeb203637eb77f9f_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
PID 840 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\24ea45716e1f4fe1eeb203637eb77f9f_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
PID 1888 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe C:\program files\internet explorer\IEXPLORE.EXE
PID 1888 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe C:\program files\internet explorer\IEXPLORE.EXE
PID 1888 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe C:\program files\internet explorer\IEXPLORE.EXE
PID 1888 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe C:\program files\internet explorer\IEXPLORE.EXE
PID 1888 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe C:\program files\internet explorer\IEXPLORE.EXE
PID 1888 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe C:\program files\internet explorer\IEXPLORE.EXE
PID 1888 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe C:\program files\internet explorer\IEXPLORE.EXE
PID 1888 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe C:\Windows\SysWOW64\WerFault.exe
PID 1888 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe C:\Windows\SysWOW64\WerFault.exe
PID 1888 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe C:\Windows\SysWOW64\WerFault.exe
PID 1888 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe C:\Windows\SysWOW64\WerFault.exe
PID 1888 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe C:\Windows\SysWOW64\WerFault.exe
PID 1888 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe C:\Windows\SysWOW64\WerFault.exe
PID 1888 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\24ea45716e1f4fe1eeb203637eb77f9f_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\24ea45716e1f4fe1eeb203637eb77f9f_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe

C:\program files\internet explorer\IEXPLORE.EXE

"C:\program files\internet explorer\IEXPLORE.EXE"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 372

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe

MD5 8df047fd8e9c5657dd4ca86d40919995
SHA1 8cecf1b3b0a13f09e4fa3d5d6d69f07c51dfeaba
SHA256 ab4a5bb05b5c09a8b9e99caddd1f07583be6a77bb9ca4d3f0f7aa50d4b34b822
SHA512 c469ece17c940301e920ae7651e28d03eb0af7b3b32ee7094cfb73bbebc443edfa90e371631b871307db7631e0ed3f8837a680712286ec4f86be0a5cfcb15512

memory/1888-14-0x00000000004BD000-0x00000000004BE000-memory.dmp

memory/1888-13-0x0000000000400000-0x00000000004FF000-memory.dmp

memory/840-10-0x0000000000A30000-0x0000000000B2F000-memory.dmp

memory/840-9-0x0000000000A30000-0x0000000000B2F000-memory.dmp

memory/1888-15-0x0000000000400000-0x00000000004FF000-memory.dmp

memory/1888-16-0x0000000000500000-0x00000000005FF000-memory.dmp

memory/1888-18-0x0000000000400000-0x00000000004FF000-memory.dmp

memory/1888-20-0x00000000004BD000-0x00000000004BE000-memory.dmp

memory/1888-21-0x0000000000500000-0x00000000005FF000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-04 06:17

Reported

2024-07-04 06:20

Platform

win10v2004-20240508-en

Max time kernel

125s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\24ea45716e1f4fe1eeb203637eb77f9f_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\24ea45716e1f4fe1eeb203637eb77f9f_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\FieleWay.txt C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe

Processes

C:\Users\Admin\AppData\Local\Temp\24ea45716e1f4fe1eeb203637eb77f9f_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\24ea45716e1f4fe1eeb203637eb77f9f_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe

C:\program files\internet explorer\IEXPLORE.EXE

"C:\program files\internet explorer\IEXPLORE.EXE"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 928 -ip 928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1036,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 199.111.78.13.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe

MD5 8df047fd8e9c5657dd4ca86d40919995
SHA1 8cecf1b3b0a13f09e4fa3d5d6d69f07c51dfeaba
SHA256 ab4a5bb05b5c09a8b9e99caddd1f07583be6a77bb9ca4d3f0f7aa50d4b34b822
SHA512 c469ece17c940301e920ae7651e28d03eb0af7b3b32ee7094cfb73bbebc443edfa90e371631b871307db7631e0ed3f8837a680712286ec4f86be0a5cfcb15512

memory/928-4-0x0000000000400000-0x00000000004FF000-memory.dmp

memory/928-6-0x0000000000780000-0x00000000007D0000-memory.dmp

memory/928-8-0x0000000000400000-0x00000000004FF000-memory.dmp

memory/928-9-0x0000000000780000-0x00000000007D0000-memory.dmp