Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10-12-2024 06:03
Static task
static1
Behavioral task
behavioral1
Sample
dd5702c7d262a226b0c4ac00782c9f23_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
dd5702c7d262a226b0c4ac00782c9f23_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
dd5702c7d262a226b0c4ac00782c9f23_JaffaCakes118.exe
-
Size
594KB
-
MD5
dd5702c7d262a226b0c4ac00782c9f23
-
SHA1
035aef2f30ae9cd2de05219417dca70e23635659
-
SHA256
ef6846f1dc867fb89caa467be42e46fd3836d29fe995663e6c5c4ae94a87d383
-
SHA512
8a4c5adadfde5d568c2518eceb9048ee6acdfd50d3dc8997d7b202da29c6d5b319f8a1b46ad9db4bf6525b8cf2d8a8e7af969ca6ad8b813eacd21d92abe01843
-
SSDEEP
6144:pp0m9SYNHCso153INk+2++OXuXlTv2KEPiTsnxF2idZecnl20lHRxp3gMncduD7O:sm9zNg33ERuXlTkF3Z4mxxzDqVTVOCN
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 4 IoCs
resource yara_rule behavioral1/memory/2696-54-0x0000000000400000-0x00000000005A1000-memory.dmp modiloader_stage2 behavioral1/memory/2696-85-0x0000000000400000-0x00000000005A1000-memory.dmp modiloader_stage2 behavioral1/memory/2884-88-0x0000000000400000-0x00000000005A1000-memory.dmp modiloader_stage2 behavioral1/memory/2884-89-0x0000000000400000-0x00000000005A1000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 1992 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2884 time.exe -
Loads dropped DLL 2 IoCs
pid Process 2696 dd5702c7d262a226b0c4ac00782c9f23_JaffaCakes118.exe 2696 dd5702c7d262a226b0c4ac00782c9f23_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\_time.exe time.exe File created C:\Windows\SysWOW64\_time.exe time.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2884 set thread context of 2932 2884 time.exe 31 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\time.exe dd5702c7d262a226b0c4ac00782c9f23_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\time.exe dd5702c7d262a226b0c4ac00782c9f23_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupDel.bat dd5702c7d262a226b0c4ac00782c9f23_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2728 2884 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dd5702c7d262a226b0c4ac00782c9f23_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language time.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2696 wrote to memory of 2884 2696 dd5702c7d262a226b0c4ac00782c9f23_JaffaCakes118.exe 30 PID 2696 wrote to memory of 2884 2696 dd5702c7d262a226b0c4ac00782c9f23_JaffaCakes118.exe 30 PID 2696 wrote to memory of 2884 2696 dd5702c7d262a226b0c4ac00782c9f23_JaffaCakes118.exe 30 PID 2696 wrote to memory of 2884 2696 dd5702c7d262a226b0c4ac00782c9f23_JaffaCakes118.exe 30 PID 2884 wrote to memory of 2932 2884 time.exe 31 PID 2884 wrote to memory of 2932 2884 time.exe 31 PID 2884 wrote to memory of 2932 2884 time.exe 31 PID 2884 wrote to memory of 2932 2884 time.exe 31 PID 2884 wrote to memory of 2932 2884 time.exe 31 PID 2884 wrote to memory of 2932 2884 time.exe 31 PID 2884 wrote to memory of 2980 2884 time.exe 32 PID 2884 wrote to memory of 2980 2884 time.exe 32 PID 2884 wrote to memory of 2980 2884 time.exe 32 PID 2884 wrote to memory of 2980 2884 time.exe 32 PID 2884 wrote to memory of 2728 2884 time.exe 33 PID 2884 wrote to memory of 2728 2884 time.exe 33 PID 2884 wrote to memory of 2728 2884 time.exe 33 PID 2884 wrote to memory of 2728 2884 time.exe 33 PID 2696 wrote to memory of 1992 2696 dd5702c7d262a226b0c4ac00782c9f23_JaffaCakes118.exe 34 PID 2696 wrote to memory of 1992 2696 dd5702c7d262a226b0c4ac00782c9f23_JaffaCakes118.exe 34 PID 2696 wrote to memory of 1992 2696 dd5702c7d262a226b0c4ac00782c9f23_JaffaCakes118.exe 34 PID 2696 wrote to memory of 1992 2696 dd5702c7d262a226b0c4ac00782c9f23_JaffaCakes118.exe 34 PID 2696 wrote to memory of 1992 2696 dd5702c7d262a226b0c4ac00782c9f23_JaffaCakes118.exe 34 PID 2696 wrote to memory of 1992 2696 dd5702c7d262a226b0c4ac00782c9f23_JaffaCakes118.exe 34 PID 2696 wrote to memory of 1992 2696 dd5702c7d262a226b0c4ac00782c9f23_JaffaCakes118.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd5702c7d262a226b0c4ac00782c9f23_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dd5702c7d262a226b0c4ac00782c9f23_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Program Files\Common Files\Microsoft Shared\MSINFO\time.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\time.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:2932
-
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵PID:2980
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 3123⤵
- Program crash
PID:2728
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupDel.bat""2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:1992
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD5c4e1ca32dfbfb27dd3dfee892732ddc9
SHA1f60a82f22c4b4259388001c08c16fda094574ba7
SHA256f178f6d83fcbc83044121f6dda717507be818dc8ccd842f797d321bf9236d5ac
SHA51245529c58b42925e1bc4a79b8b53e7a065cdd141ce1901d13d89403244279f83135fc0e19e6e5bddff1cf24ef444c2bcf10c7e0dab363c065d487a5313a31e239
-
Filesize
594KB
MD5dd5702c7d262a226b0c4ac00782c9f23
SHA1035aef2f30ae9cd2de05219417dca70e23635659
SHA256ef6846f1dc867fb89caa467be42e46fd3836d29fe995663e6c5c4ae94a87d383
SHA5128a4c5adadfde5d568c2518eceb9048ee6acdfd50d3dc8997d7b202da29c6d5b319f8a1b46ad9db4bf6525b8cf2d8a8e7af969ca6ad8b813eacd21d92abe01843