Analysis
-
max time kernel
146s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
29/03/2025, 20:06
Behavioral task
behavioral1
Sample
JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe
-
Size
685KB
-
MD5
9707baa95b63eb59ebc04ee31d440cba
-
SHA1
497ebbf02c3a7e92a7da538a064a2e652e0a2d4b
-
SHA256
3dbf1b6087ddfb765a6a798aad70929304835188355178b4a207f9e574d02515
-
SHA512
93640607bbe26402bf47f4b39eb5a07206e300228c210eaf73b621b52caaee6df20d39cce7cbcc92d696047e3783b1a97e1192ef1e8a1edb0401a49b50870f6c
-
SSDEEP
12288:gVKOrsDpsGzfTO+qsDpahahFERXMKYHI0ckB8DgJRLstRGSs5zQtQ5:gY4qa+mM7b8MNIHkxjK6r5
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 22 IoCs
resource yara_rule behavioral2/memory/1680-1-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/1680-15-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/5876-16-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/5876-21-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/4388-22-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/4388-28-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/5392-30-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/5392-36-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/4052-37-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/4052-44-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/5224-45-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/5224-51-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/6120-52-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/6120-58-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/316-59-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/316-65-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/5024-66-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/5024-72-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/2992-73-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/2992-79-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/4112-81-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/4112-87-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 -
Executes dropped EXE 11 IoCs
pid Process 5876 winupdate.exe 4388 winupdate.exe 5392 winupdate.exe 4052 winupdate.exe 5224 winupdate.exe 6120 winupdate.exe 316 winupdate.exe 5024 winupdate.exe 2992 winupdate.exe 4112 winupdate.exe 1688 winupdate.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\Security\1.mzp JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe File opened for modification C:\Windows\SysWOW64\Security\1.mzp JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe File created C:\Windows\SysWOW64\Security\winupdate.exe JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe -
resource yara_rule behavioral2/memory/1680-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1680-1-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x000f000000024230-11.dat upx behavioral2/memory/5876-13-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1680-15-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/5876-16-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/5876-21-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4388-22-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4388-28-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/5392-30-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/5392-36-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4052-37-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/5224-42-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4052-44-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/5224-45-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/5224-51-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/6120-52-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/6120-58-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/316-59-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/316-65-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/5024-66-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/5024-72-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2992-73-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2992-79-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4112-81-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4112-87-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Drops file in Windows directory 22 IoCs
description ioc Process File created C:\Windows\1.mzp winupdate.exe File created C:\Windows\1.mzp winupdate.exe File created C:\Windows\1.mzp winupdate.exe File created C:\Windows\1.mzp winupdate.exe File opened for modification C:\Windows\1.mzp winupdate.exe File created C:\Windows\1.mzp JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe File opened for modification C:\Windows\1.mzp winupdate.exe File created C:\Windows\1.mzp winupdate.exe File opened for modification C:\Windows\1.mzp winupdate.exe File opened for modification C:\Windows\1.mzp winupdate.exe File created C:\Windows\1.mzp winupdate.exe File opened for modification C:\Windows\1.mzp winupdate.exe File created C:\Windows\1.mzp winupdate.exe File created C:\Windows\1.mzp winupdate.exe File created C:\Windows\1.mzp winupdate.exe File opened for modification C:\Windows\1.mzp winupdate.exe File opened for modification C:\Windows\1.mzp winupdate.exe File created C:\Windows\1.mzp winupdate.exe File opened for modification C:\Windows\1.mzp winupdate.exe File opened for modification C:\Windows\1.mzp winupdate.exe File opened for modification C:\Windows\1.mzp winupdate.exe File opened for modification C:\Windows\1.mzp JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe -
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1680 JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe Token: SeSecurityPrivilege 1680 JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe Token: SeTakeOwnershipPrivilege 1680 JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe Token: SeLoadDriverPrivilege 1680 JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe Token: SeSystemProfilePrivilege 1680 JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe Token: SeSystemtimePrivilege 1680 JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe Token: SeProfSingleProcessPrivilege 1680 JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe Token: SeIncBasePriorityPrivilege 1680 JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe Token: SeCreatePagefilePrivilege 1680 JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe Token: SeBackupPrivilege 1680 JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe Token: SeRestorePrivilege 1680 JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe Token: SeShutdownPrivilege 1680 JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe Token: SeDebugPrivilege 1680 JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe Token: SeSystemEnvironmentPrivilege 1680 JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe Token: SeRemoteShutdownPrivilege 1680 JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe Token: SeUndockPrivilege 1680 JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe Token: SeManageVolumePrivilege 1680 JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe Token: 33 1680 JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe Token: 34 1680 JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe Token: 35 1680 JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe Token: 36 1680 JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe Token: SeIncreaseQuotaPrivilege 5876 winupdate.exe Token: SeSecurityPrivilege 5876 winupdate.exe Token: SeTakeOwnershipPrivilege 5876 winupdate.exe Token: SeLoadDriverPrivilege 5876 winupdate.exe Token: SeSystemProfilePrivilege 5876 winupdate.exe Token: SeSystemtimePrivilege 5876 winupdate.exe Token: SeProfSingleProcessPrivilege 5876 winupdate.exe Token: SeIncBasePriorityPrivilege 5876 winupdate.exe Token: SeCreatePagefilePrivilege 5876 winupdate.exe Token: SeBackupPrivilege 5876 winupdate.exe Token: SeRestorePrivilege 5876 winupdate.exe Token: SeShutdownPrivilege 5876 winupdate.exe Token: SeDebugPrivilege 5876 winupdate.exe Token: SeSystemEnvironmentPrivilege 5876 winupdate.exe Token: SeRemoteShutdownPrivilege 5876 winupdate.exe Token: SeUndockPrivilege 5876 winupdate.exe Token: SeManageVolumePrivilege 5876 winupdate.exe Token: 33 5876 winupdate.exe Token: 34 5876 winupdate.exe Token: 35 5876 winupdate.exe Token: 36 5876 winupdate.exe Token: SeIncreaseQuotaPrivilege 4388 winupdate.exe Token: SeSecurityPrivilege 4388 winupdate.exe Token: SeTakeOwnershipPrivilege 4388 winupdate.exe Token: SeLoadDriverPrivilege 4388 winupdate.exe Token: SeSystemProfilePrivilege 4388 winupdate.exe Token: SeSystemtimePrivilege 4388 winupdate.exe Token: SeProfSingleProcessPrivilege 4388 winupdate.exe Token: SeIncBasePriorityPrivilege 4388 winupdate.exe Token: SeCreatePagefilePrivilege 4388 winupdate.exe Token: SeBackupPrivilege 4388 winupdate.exe Token: SeRestorePrivilege 4388 winupdate.exe Token: SeShutdownPrivilege 4388 winupdate.exe Token: SeDebugPrivilege 4388 winupdate.exe Token: SeSystemEnvironmentPrivilege 4388 winupdate.exe Token: SeRemoteShutdownPrivilege 4388 winupdate.exe Token: SeUndockPrivilege 4388 winupdate.exe Token: SeManageVolumePrivilege 4388 winupdate.exe Token: 33 4388 winupdate.exe Token: 34 4388 winupdate.exe Token: 35 4388 winupdate.exe Token: 36 4388 winupdate.exe Token: SeIncreaseQuotaPrivilege 5392 winupdate.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1680 wrote to memory of 5876 1680 JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe 106 PID 1680 wrote to memory of 5876 1680 JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe 106 PID 1680 wrote to memory of 5876 1680 JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe 106 PID 5876 wrote to memory of 4388 5876 winupdate.exe 108 PID 5876 wrote to memory of 4388 5876 winupdate.exe 108 PID 5876 wrote to memory of 4388 5876 winupdate.exe 108 PID 4388 wrote to memory of 5392 4388 winupdate.exe 114 PID 4388 wrote to memory of 5392 4388 winupdate.exe 114 PID 4388 wrote to memory of 5392 4388 winupdate.exe 114 PID 5392 wrote to memory of 4052 5392 winupdate.exe 116 PID 5392 wrote to memory of 4052 5392 winupdate.exe 116 PID 5392 wrote to memory of 4052 5392 winupdate.exe 116 PID 4052 wrote to memory of 5224 4052 winupdate.exe 119 PID 4052 wrote to memory of 5224 4052 winupdate.exe 119 PID 4052 wrote to memory of 5224 4052 winupdate.exe 119 PID 5224 wrote to memory of 6120 5224 winupdate.exe 122 PID 5224 wrote to memory of 6120 5224 winupdate.exe 122 PID 5224 wrote to memory of 6120 5224 winupdate.exe 122 PID 6120 wrote to memory of 316 6120 winupdate.exe 124 PID 6120 wrote to memory of 316 6120 winupdate.exe 124 PID 6120 wrote to memory of 316 6120 winupdate.exe 124 PID 316 wrote to memory of 5024 316 winupdate.exe 126 PID 316 wrote to memory of 5024 316 winupdate.exe 126 PID 316 wrote to memory of 5024 316 winupdate.exe 126 PID 5024 wrote to memory of 2992 5024 winupdate.exe 128 PID 5024 wrote to memory of 2992 5024 winupdate.exe 128 PID 5024 wrote to memory of 2992 5024 winupdate.exe 128 PID 2992 wrote to memory of 4112 2992 winupdate.exe 130 PID 2992 wrote to memory of 4112 2992 winupdate.exe 130 PID 2992 wrote to memory of 4112 2992 winupdate.exe 130 PID 4112 wrote to memory of 1688 4112 winupdate.exe 132 PID 4112 wrote to memory of 1688 4112 winupdate.exe 132 PID 4112 wrote to memory of 1688 4112 winupdate.exe 132
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9707baa95b63eb59ebc04ee31d440cba.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\Security\winupdate.exeC:\Windows\system32\Security\winupdate.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Windows\SysWOW64\Security\winupdate.exeC:\Windows\system32\Security\winupdate.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\Security\winupdate.exeC:\Windows\system32\Security\winupdate.exe4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Windows\SysWOW64\Security\winupdate.exeC:\Windows\system32\Security\winupdate.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\SysWOW64\Security\winupdate.exeC:\Windows\system32\Security\winupdate.exe6⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Windows\SysWOW64\Security\winupdate.exeC:\Windows\system32\Security\winupdate.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\SysWOW64\Security\winupdate.exeC:\Windows\system32\Security\winupdate.exe8⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\SysWOW64\Security\winupdate.exeC:\Windows\system32\Security\winupdate.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\Security\winupdate.exeC:\Windows\system32\Security\winupdate.exe10⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\Security\winupdate.exeC:\Windows\system32\Security\winupdate.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\Security\winupdate.exeC:\Windows\system32\Security\winupdate.exe12⤵
- Executes dropped EXE
PID:1688
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
643KB
MD5eb51d3e90a9168579f90c8fa2e4d6c0b
SHA194aab8419b08c80ed5987e29cd5518540345a51d
SHA256d0773ec6d9365733069010d133360f5c3b89cef93524c5009ff0fcd02f7bc6f4
SHA5120ad17fab589f07c230a47ae05571016fc83f92ecb759b43bc6fd2e559b46d6e0fb146f436d1ec091de19d9bc495ace3bc1ebcfa04690054bdf10a80f6d70ae82
-
Filesize
685KB
MD59707baa95b63eb59ebc04ee31d440cba
SHA1497ebbf02c3a7e92a7da538a064a2e652e0a2d4b
SHA2563dbf1b6087ddfb765a6a798aad70929304835188355178b4a207f9e574d02515
SHA51293640607bbe26402bf47f4b39eb5a07206e300228c210eaf73b621b52caaee6df20d39cce7cbcc92d696047e3783b1a97e1192ef1e8a1edb0401a49b50870f6c