Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03-11-2024 20:31

General

  • Target

    8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe

  • Size

    686KB

  • MD5

    8d5de7db12c822f3eec133fb0a6e5c60

  • SHA1

    47a54931b917f3547c8a3d71dcbc6e3588b91388

  • SHA256

    a65129335948a9c8f63f63ef1a15a342dc7b220ce8bb106c61b2e1165ab49de0

  • SHA512

    3975f932fd62baabd31fbf709223aa930e0a342beb3b9d93bd70944f3618057a81da05acc4ed9db3948aecdcc7917d06512c594524a57ca869313d00bb792d27

  • SSDEEP

    12288:S/NAnH7xxoJXUkpsMCj180wueODiOZv5uOuKm:S/yHAJkGVk1u2D9U4m

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 5 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Program Files\Common Files\Microsoft Shared\MSINFO\re082.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\re082.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:816
      • C:\Windows\SysWOW64\calc.exe
        "C:\Windows\system32\calc.exe"
        3⤵
          PID:2096
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 280
          3⤵
          • Loads dropped DLL
          • Program crash
          PID:1488
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupDel.bat""
        2⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:2944

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\SetupDel.bat

      Filesize

      212B

      MD5

      cf4577d2fcffb3d0f3ca18ff4d3c98ad

      SHA1

      a4db1649840ce26d297d1b46f0f3c58e1d43127b

      SHA256

      b4b366600ec97a655b9da0a780af5c4616593ee04621c353d5121794640a47d8

      SHA512

      829c737b5cd67ec377a9e780bfe3cae2d0a7ee20916211cb8e08ddedb0f0449e8f8ad90194531dc687c219ac52872f83cdb23374b131a92a61a825b8aab65509

    • \Program Files\Common Files\Microsoft Shared\MSInfo\re082.exe

      Filesize

      686KB

      MD5

      8d5de7db12c822f3eec133fb0a6e5c60

      SHA1

      47a54931b917f3547c8a3d71dcbc6e3588b91388

      SHA256

      a65129335948a9c8f63f63ef1a15a342dc7b220ce8bb106c61b2e1165ab49de0

      SHA512

      3975f932fd62baabd31fbf709223aa930e0a342beb3b9d93bd70944f3618057a81da05acc4ed9db3948aecdcc7917d06512c594524a57ca869313d00bb792d27

    • memory/816-31-0x0000000000415000-0x0000000000416000-memory.dmp

      Filesize

      4KB

    • memory/816-43-0x0000000000400000-0x00000000004BD200-memory.dmp

      Filesize

      756KB

    • memory/816-13-0x0000000000400000-0x00000000004BD200-memory.dmp

      Filesize

      756KB

    • memory/816-45-0x0000000000400000-0x00000000004BD200-memory.dmp

      Filesize

      756KB

    • memory/816-17-0x00000000002E0000-0x00000000002E1000-memory.dmp

      Filesize

      4KB

    • memory/2096-24-0x0000000000400000-0x00000000004BE000-memory.dmp

      Filesize

      760KB

    • memory/2096-25-0x0000000000450000-0x0000000000450000-memory.dmp

    • memory/2096-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/3008-10-0x00000000020C0000-0x000000000217E000-memory.dmp

      Filesize

      760KB

    • memory/3008-29-0x0000000000400000-0x00000000004BD200-memory.dmp

      Filesize

      756KB

    • memory/3008-30-0x0000000000260000-0x0000000000261000-memory.dmp

      Filesize

      4KB

    • memory/3008-0-0x0000000000400000-0x00000000004BD200-memory.dmp

      Filesize

      756KB

    • memory/3008-1-0x0000000000260000-0x0000000000261000-memory.dmp

      Filesize

      4KB

    • memory/3008-39-0x0000000000400000-0x00000000004BD200-memory.dmp

      Filesize

      756KB

    • memory/3008-41-0x0000000000400000-0x00000000004BD200-memory.dmp

      Filesize

      756KB

    • memory/3008-11-0x00000000020C0000-0x000000000217E000-memory.dmp

      Filesize

      760KB