Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-07-2024 19:36
Behavioral task
behavioral1
Sample
260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe
-
Size
173KB
-
MD5
260237c1d4e8543e0861123621862a6d
-
SHA1
3db335eb712f3b04a9e6a546976c97b28dd62224
-
SHA256
a55d19708abe112ce7c8392ffe3078dcc60d9c987de73c6770f5754406e2f46a
-
SHA512
2dcd9fa4df6852df9187a739feefb38688b92324afb1b1b1f90114a01caadd581a79b6845dc2e55291fe929a84dad3a7b60c7e1efa3ae8fbaa90f7e4a9ad794d
-
SSDEEP
3072:d9DulZKsSqzZjDDeqCe5ToU21kkH2ip0KuPk2afiMpltkrkbtNLWGti0:dKKsS+rIU2ykH2ipsPnafFlerkb3LrtP
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral1/memory/2524-7-0x0000000000400000-0x0000000000432000-memory.dmp modiloader_stage2 -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{652PGK21-4XYT-033O-URSV-61TJ452Q35WG} 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{652PGK21-4XYT-033O-URSV-61TJ452Q35WG}\StubPath = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe\"" 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28 PID 2524 wrote to memory of 2804 2524 260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\260237c1d4e8543e0861123621862a6d_JaffaCakes118.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵PID:2804
-