Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03-11-2024 20:31
Static task
static1
Behavioral task
behavioral1
Sample
8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe
-
Size
686KB
-
MD5
8d5de7db12c822f3eec133fb0a6e5c60
-
SHA1
47a54931b917f3547c8a3d71dcbc6e3588b91388
-
SHA256
a65129335948a9c8f63f63ef1a15a342dc7b220ce8bb106c61b2e1165ab49de0
-
SHA512
3975f932fd62baabd31fbf709223aa930e0a342beb3b9d93bd70944f3618057a81da05acc4ed9db3948aecdcc7917d06512c594524a57ca869313d00bb792d27
-
SSDEEP
12288:S/NAnH7xxoJXUkpsMCj180wueODiOZv5uOuKm:S/yHAJkGVk1u2D9U4m
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 5 IoCs
resource yara_rule behavioral1/memory/3008-29-0x0000000000400000-0x00000000004BD200-memory.dmp modiloader_stage2 behavioral1/memory/3008-39-0x0000000000400000-0x00000000004BD200-memory.dmp modiloader_stage2 behavioral1/memory/3008-41-0x0000000000400000-0x00000000004BD200-memory.dmp modiloader_stage2 behavioral1/memory/816-43-0x0000000000400000-0x00000000004BD200-memory.dmp modiloader_stage2 behavioral1/memory/816-45-0x0000000000400000-0x00000000004BD200-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 2944 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 816 re082.exe -
Loads dropped DLL 5 IoCs
pid Process 3008 8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe 3008 8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe 1488 WerFault.exe 1488 WerFault.exe 1488 WerFault.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\_re082.exe re082.exe File opened for modification C:\Windows\SysWOW64\_re082.exe re082.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 816 set thread context of 2096 816 re082.exe 31 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\re082.exe 8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\re082.exe 8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupDel.bat 8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1488 816 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language re082.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3008 wrote to memory of 816 3008 8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe 30 PID 3008 wrote to memory of 816 3008 8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe 30 PID 3008 wrote to memory of 816 3008 8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe 30 PID 3008 wrote to memory of 816 3008 8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe 30 PID 816 wrote to memory of 2096 816 re082.exe 31 PID 816 wrote to memory of 2096 816 re082.exe 31 PID 816 wrote to memory of 2096 816 re082.exe 31 PID 816 wrote to memory of 2096 816 re082.exe 31 PID 816 wrote to memory of 2096 816 re082.exe 31 PID 816 wrote to memory of 2096 816 re082.exe 31 PID 816 wrote to memory of 1488 816 re082.exe 33 PID 816 wrote to memory of 1488 816 re082.exe 33 PID 816 wrote to memory of 1488 816 re082.exe 33 PID 816 wrote to memory of 1488 816 re082.exe 33 PID 3008 wrote to memory of 2944 3008 8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe 34 PID 3008 wrote to memory of 2944 3008 8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe 34 PID 3008 wrote to memory of 2944 3008 8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe 34 PID 3008 wrote to memory of 2944 3008 8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe 34 PID 3008 wrote to memory of 2944 3008 8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe 34 PID 3008 wrote to memory of 2944 3008 8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe 34 PID 3008 wrote to memory of 2944 3008 8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8d5de7db12c822f3eec133fb0a6e5c60_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Program Files\Common Files\Microsoft Shared\MSINFO\re082.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\re082.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:2096
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 2803⤵
- Loads dropped DLL
- Program crash
PID:1488
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupDel.bat""2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD5cf4577d2fcffb3d0f3ca18ff4d3c98ad
SHA1a4db1649840ce26d297d1b46f0f3c58e1d43127b
SHA256b4b366600ec97a655b9da0a780af5c4616593ee04621c353d5121794640a47d8
SHA512829c737b5cd67ec377a9e780bfe3cae2d0a7ee20916211cb8e08ddedb0f0449e8f8ad90194531dc687c219ac52872f83cdb23374b131a92a61a825b8aab65509
-
Filesize
686KB
MD58d5de7db12c822f3eec133fb0a6e5c60
SHA147a54931b917f3547c8a3d71dcbc6e3588b91388
SHA256a65129335948a9c8f63f63ef1a15a342dc7b220ce8bb106c61b2e1165ab49de0
SHA5123975f932fd62baabd31fbf709223aa930e0a342beb3b9d93bd70944f3618057a81da05acc4ed9db3948aecdcc7917d06512c594524a57ca869313d00bb792d27