Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/01/2025, 00:58

General

  • Target

    JaffaCakes118_01077826ac5e8236745c8f155be6350a.exe

  • Size

    12KB

  • MD5

    01077826ac5e8236745c8f155be6350a

  • SHA1

    bcb6b5863c4758ceb3828d1813cfa3c85b7b2eda

  • SHA256

    a86161ef176524a5a341558e53de4ac40f2a403bca94b5f17654d1c1ae3c0b9a

  • SHA512

    83632e5322649a977c6daa533cd2b33cd038ca9031fb4e6df4e41d6f384493d43a182af064dd1c32c3795093f8020e65b6f584bf116e44d92fb56cf2071a2cf9

  • SSDEEP

    384:8W6S1pD/AFeihyJ4ir4noH63yDY2KJXZ3:0FFeihyJ46Bkv

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_01077826ac5e8236745c8f155be6350a.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_01077826ac5e8236745c8f155be6350a.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2508
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      2⤵
        PID:1268

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1268-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/1268-8-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB

    • memory/1268-5-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB

    • memory/1268-3-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB

    • memory/2508-0-0x0000000000400000-0x000000000041217A-memory.dmp

      Filesize

      72KB

    • memory/2508-1-0x0000000000401000-0x000000000040F000-memory.dmp

      Filesize

      56KB

    • memory/2508-13-0x0000000000401000-0x000000000040F000-memory.dmp

      Filesize

      56KB

    • memory/2508-12-0x0000000000400000-0x000000000041217A-memory.dmp

      Filesize

      72KB