Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/09/2024, 08:10
Behavioral task
behavioral1
Sample
d5eda76368c1928bda619b1450d39833_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
d5eda76368c1928bda619b1450d39833_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
d5eda76368c1928bda619b1450d39833_JaffaCakes118.exe
-
Size
164KB
-
MD5
d5eda76368c1928bda619b1450d39833
-
SHA1
a2cd9e16d28f6ceb434bd77fa8306597b95f1bf2
-
SHA256
4a54a68f73b096fb4c8fc64b4ebb60a1c2e8083ee0c5536883eca1a2802aa14a
-
SHA512
a68235220330a6c15ec63ff4d53460d5c3ec727f87acc9d26af4371ead38cf92f22ebedc03c9b768b1e16694f7764d3ebc0c47017a294ad6776e650a66fc0ec2
-
SSDEEP
3072:GhtsgbRrvh84QOtsVfgHWSTHSN2qhhvmmbKQUBd0amgROD+/:Axrva4QT4ANbhvmmjUrDmX6/
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 8 IoCs
resource yara_rule behavioral2/files/0x000b0000000234c9-2.dat modiloader_stage2 behavioral2/memory/2600-4-0x0000000000400000-0x0000000000430000-memory.dmp modiloader_stage2 behavioral2/memory/5008-47-0x0000000010410000-0x0000000010464000-memory.dmp modiloader_stage2 behavioral2/memory/5008-50-0x0000000010410000-0x0000000010464000-memory.dmp modiloader_stage2 behavioral2/memory/5008-51-0x0000000010410000-0x0000000010464000-memory.dmp modiloader_stage2 behavioral2/memory/5008-48-0x0000000010410000-0x0000000010464000-memory.dmp modiloader_stage2 behavioral2/memory/1932-52-0x0000000000400000-0x0000000000430000-memory.dmp modiloader_stage2 behavioral2/memory/5008-53-0x0000000010410000-0x0000000010464000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 1932 netservice.exe -
resource yara_rule behavioral2/memory/1932-5-0x0000000010410000-0x0000000010464000-memory.dmp upx behavioral2/memory/5008-47-0x0000000010410000-0x0000000010464000-memory.dmp upx behavioral2/memory/1932-43-0x0000000010410000-0x0000000010464000-memory.dmp upx behavioral2/memory/5008-50-0x0000000010410000-0x0000000010464000-memory.dmp upx behavioral2/memory/5008-51-0x0000000010410000-0x0000000010464000-memory.dmp upx behavioral2/memory/5008-48-0x0000000010410000-0x0000000010464000-memory.dmp upx behavioral2/memory/5008-53-0x0000000010410000-0x0000000010464000-memory.dmp upx -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 4984 5008 WerFault.exe 89 2980 5008 WerFault.exe 89 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d5eda76368c1928bda619b1450d39833_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1932 netservice.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2600 wrote to memory of 3960 2600 d5eda76368c1928bda619b1450d39833_JaffaCakes118.exe 84 PID 2600 wrote to memory of 3960 2600 d5eda76368c1928bda619b1450d39833_JaffaCakes118.exe 84 PID 2600 wrote to memory of 3960 2600 d5eda76368c1928bda619b1450d39833_JaffaCakes118.exe 84 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89 PID 1932 wrote to memory of 5008 1932 netservice.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5eda76368c1928bda619b1450d39833_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d5eda76368c1928bda619b1450d39833_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\d5eda76368c1928bda619b1450d39833_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3960
-
-
C:\Users\Admin\Favorites\netservice.exeC:\Users\Admin\Favorites\netservice.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe2⤵
- System Location Discovery: System Language Discovery
PID:5008 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 7123⤵
- Program crash
PID:4984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 10523⤵
- Program crash
PID:2980
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5008 -ip 50081⤵PID:4484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5008 -ip 50081⤵PID:552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164KB
MD5d5eda76368c1928bda619b1450d39833
SHA1a2cd9e16d28f6ceb434bd77fa8306597b95f1bf2
SHA2564a54a68f73b096fb4c8fc64b4ebb60a1c2e8083ee0c5536883eca1a2802aa14a
SHA512a68235220330a6c15ec63ff4d53460d5c3ec727f87acc9d26af4371ead38cf92f22ebedc03c9b768b1e16694f7764d3ebc0c47017a294ad6776e650a66fc0ec2