Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 14:48
Behavioral task
behavioral1
Sample
cfc9850fe0030c4fa80fcb53639e910c_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
cfc9850fe0030c4fa80fcb53639e910c_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
cfc9850fe0030c4fa80fcb53639e910c_JaffaCakes118.dll
-
Size
18KB
-
MD5
cfc9850fe0030c4fa80fcb53639e910c
-
SHA1
ca315db62a7404f4919eb4ac8d34911226140060
-
SHA256
cf69e552c0f0a485aff97eb15b4fd6bf64e723bda73952365f1729b4efdbe1e1
-
SHA512
c3718f2118791e78d6d26444e7a99f358005ff1f63eb5faf65a6a2f01dc0d9ceb7c9b320d75103eea925efec00c6ff0b81a48b5baf355a91436b344527bf319b
-
SSDEEP
384:VzGJTEu2qc0lpLsz0/Cs0OqSHyf0mfIJIcNKCv+zfg:VZu2qdlpLsz9jpSHyvIJIGvuf
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral1/memory/2468-0-0x0000000000400000-0x000000000040B000-memory.dmp modiloader_stage2 -
Program crash 1 IoCs
pid pid_target Process procid_target 280 2468 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1864 wrote to memory of 2468 1864 rundll32.exe 30 PID 1864 wrote to memory of 2468 1864 rundll32.exe 30 PID 1864 wrote to memory of 2468 1864 rundll32.exe 30 PID 1864 wrote to memory of 2468 1864 rundll32.exe 30 PID 1864 wrote to memory of 2468 1864 rundll32.exe 30 PID 1864 wrote to memory of 2468 1864 rundll32.exe 30 PID 1864 wrote to memory of 2468 1864 rundll32.exe 30 PID 2468 wrote to memory of 280 2468 rundll32.exe 31 PID 2468 wrote to memory of 280 2468 rundll32.exe 31 PID 2468 wrote to memory of 280 2468 rundll32.exe 31 PID 2468 wrote to memory of 280 2468 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cfc9850fe0030c4fa80fcb53639e910c_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cfc9850fe0030c4fa80fcb53639e910c_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 2243⤵
- Program crash
PID:280
-
-