Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19/01/2025, 11:22

General

  • Target

    JaffaCakes118_c650d943b26950830ff91945dadafa1f.exe

  • Size

    244KB

  • MD5

    c650d943b26950830ff91945dadafa1f

  • SHA1

    3e8065836d7018e684969946afb03573a7beb688

  • SHA256

    2beb5d46c94486a211643653d65d1a1952b3ef0983e74d1e4bf4476fa90833ce

  • SHA512

    f9c125dbb56d6c9e0644541f471da8b6aab58de9753b7994610235a2f6afcf7b7a608efc0fbda402e7be757dc0caa70fba20090170829164f6fa6df8384aa2fc

  • SSDEEP

    6144:AaAbo5uA86xeI/s5tD4mMVohX7cla9PUCrzXF:AfbIkXIlaTrz1

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 11 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c650d943b26950830ff91945dadafa1f.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c650d943b26950830ff91945dadafa1f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2660
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c650d943b26950830ff91945dadafa1f.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c650d943b26950830ff91945dadafa1f.exe"
      2⤵
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2700
      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c650d943b26950830ff91945dadafa1f.exe
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c650d943b26950830ff91945dadafa1f.exe"
        3⤵
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2684
        • C:\Users\Admin\AppData\Roaming\met start.exe
          "C:\Users\Admin\AppData\Roaming\met start.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2544
          • C:\Users\Admin\AppData\Roaming\met start.exe
            "C:\Users\Admin\AppData\Roaming\met start.exe"
            5⤵
            • Executes dropped EXE
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2996
            • C:\Users\Admin\AppData\Roaming\met start.exe
              "C:\Users\Admin\AppData\Roaming\met start.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              PID:2976

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Roaming\met start.exe

    Filesize

    244KB

    MD5

    c650d943b26950830ff91945dadafa1f

    SHA1

    3e8065836d7018e684969946afb03573a7beb688

    SHA256

    2beb5d46c94486a211643653d65d1a1952b3ef0983e74d1e4bf4476fa90833ce

    SHA512

    f9c125dbb56d6c9e0644541f471da8b6aab58de9753b7994610235a2f6afcf7b7a608efc0fbda402e7be757dc0caa70fba20090170829164f6fa6df8384aa2fc

  • memory/2660-0-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2684-35-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2684-40-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2684-39-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2684-52-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2684-34-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2684-18-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2684-28-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2684-30-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2684-26-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2684-24-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2684-22-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2684-20-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2700-5-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2700-38-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2700-15-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2700-7-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2700-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2700-13-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2700-4-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2976-96-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2996-94-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB