Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 21:34
Static task
static1
Behavioral task
behavioral1
Sample
179d0e252b6e5fe67c903951033a03cf_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
179d0e252b6e5fe67c903951033a03cf_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
179d0e252b6e5fe67c903951033a03cf_JaffaCakes118.exe
-
Size
787KB
-
MD5
179d0e252b6e5fe67c903951033a03cf
-
SHA1
ca8b72e13f892b8b44d35d7388ade75daac8ef94
-
SHA256
4d5f86096678cb557f647bbe79def6971b5a5728cb3f6ba7cf81dd00263f5bbc
-
SHA512
38077831b44d532bb22fb5a8f7b2baaf099b0e80d6566517ae86905e955f101814c11362867d44eae78b0a51db65ec82225bdaced3f3bf249c9cbaa9bfca4ee3
-
SSDEEP
12288:xQyItOCh9StyaguIZxqEFmcRhsu5lF3Z4mxxpDqVTVOCV:xQyItOCh0tHicEFRHscQmXAVTzV
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2532-89-0x0000000000400000-0x0000000000527000-memory.dmp modiloader_stage2 behavioral1/memory/2956-91-0x0000000000400000-0x0000000000527000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1104 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
Server47.exepid process 2532 Server47.exe -
Loads dropped DLL 2 IoCs
Processes:
179d0e252b6e5fe67c903951033a03cf_JaffaCakes118.exepid process 2956 179d0e252b6e5fe67c903951033a03cf_JaffaCakes118.exe 2956 179d0e252b6e5fe67c903951033a03cf_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
Processes:
Server47.exedescription ioc process File created C:\Windows\SysWOW64\_Server47.exe Server47.exe File opened for modification C:\Windows\SysWOW64\_Server47.exe Server47.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Server47.exedescription pid process target process PID 2532 set thread context of 2544 2532 Server47.exe calc.exe -
Drops file in Program Files directory 2 IoCs
Processes:
179d0e252b6e5fe67c903951033a03cf_JaffaCakes118.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\Server47.exe 179d0e252b6e5fe67c903951033a03cf_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\Server47.exe 179d0e252b6e5fe67c903951033a03cf_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
179d0e252b6e5fe67c903951033a03cf_JaffaCakes118.exeServer47.exedescription pid process target process PID 2956 wrote to memory of 2532 2956 179d0e252b6e5fe67c903951033a03cf_JaffaCakes118.exe Server47.exe PID 2956 wrote to memory of 2532 2956 179d0e252b6e5fe67c903951033a03cf_JaffaCakes118.exe Server47.exe PID 2956 wrote to memory of 2532 2956 179d0e252b6e5fe67c903951033a03cf_JaffaCakes118.exe Server47.exe PID 2956 wrote to memory of 2532 2956 179d0e252b6e5fe67c903951033a03cf_JaffaCakes118.exe Server47.exe PID 2532 wrote to memory of 2544 2532 Server47.exe calc.exe PID 2532 wrote to memory of 2544 2532 Server47.exe calc.exe PID 2532 wrote to memory of 2544 2532 Server47.exe calc.exe PID 2532 wrote to memory of 2544 2532 Server47.exe calc.exe PID 2532 wrote to memory of 2544 2532 Server47.exe calc.exe PID 2532 wrote to memory of 2544 2532 Server47.exe calc.exe PID 2532 wrote to memory of 3044 2532 Server47.exe IEXPLORE.EXE PID 2532 wrote to memory of 3044 2532 Server47.exe IEXPLORE.EXE PID 2532 wrote to memory of 3044 2532 Server47.exe IEXPLORE.EXE PID 2532 wrote to memory of 3044 2532 Server47.exe IEXPLORE.EXE PID 2956 wrote to memory of 1104 2956 179d0e252b6e5fe67c903951033a03cf_JaffaCakes118.exe cmd.exe PID 2956 wrote to memory of 1104 2956 179d0e252b6e5fe67c903951033a03cf_JaffaCakes118.exe cmd.exe PID 2956 wrote to memory of 1104 2956 179d0e252b6e5fe67c903951033a03cf_JaffaCakes118.exe cmd.exe PID 2956 wrote to memory of 1104 2956 179d0e252b6e5fe67c903951033a03cf_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\179d0e252b6e5fe67c903951033a03cf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\179d0e252b6e5fe67c903951033a03cf_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\Server47.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\Server47.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c erase /F "C:\Users\Admin\AppData\Local\Temp\179d0e252b6e5fe67c903951033a03cf_JaffaCakes118.exe"2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Program Files\Common Files\Microsoft Shared\MSInfo\Server47.exeFilesize
787KB
MD5179d0e252b6e5fe67c903951033a03cf
SHA1ca8b72e13f892b8b44d35d7388ade75daac8ef94
SHA2564d5f86096678cb557f647bbe79def6971b5a5728cb3f6ba7cf81dd00263f5bbc
SHA51238077831b44d532bb22fb5a8f7b2baaf099b0e80d6566517ae86905e955f101814c11362867d44eae78b0a51db65ec82225bdaced3f3bf249c9cbaa9bfca4ee3
-
memory/2532-79-0x0000000000400000-0x0000000000527000-memory.dmpFilesize
1.2MB
-
memory/2532-89-0x0000000000400000-0x0000000000527000-memory.dmpFilesize
1.2MB
-
memory/2544-84-0x0000000000400000-0x0000000000527000-memory.dmpFilesize
1.2MB
-
memory/2544-83-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2544-86-0x0000000000400000-0x0000000000527000-memory.dmpFilesize
1.2MB
-
memory/2956-36-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-64-0x0000000003390000-0x0000000003490000-memory.dmpFilesize
1024KB
-
memory/2956-56-0x0000000003390000-0x0000000003490000-memory.dmpFilesize
1024KB
-
memory/2956-58-0x0000000003390000-0x0000000003490000-memory.dmpFilesize
1024KB
-
memory/2956-34-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-33-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-67-0x0000000003390000-0x0000000003490000-memory.dmpFilesize
1024KB
-
memory/2956-66-0x0000000003390000-0x0000000003490000-memory.dmpFilesize
1024KB
-
memory/2956-65-0x0000000003390000-0x0000000003490000-memory.dmpFilesize
1024KB
-
memory/2956-63-0x0000000003390000-0x0000000003490000-memory.dmpFilesize
1024KB
-
memory/2956-62-0x0000000003390000-0x0000000003490000-memory.dmpFilesize
1024KB
-
memory/2956-61-0x0000000003390000-0x0000000003490000-memory.dmpFilesize
1024KB
-
memory/2956-60-0x0000000003390000-0x0000000003490000-memory.dmpFilesize
1024KB
-
memory/2956-59-0x0000000003390000-0x0000000003490000-memory.dmpFilesize
1024KB
-
memory/2956-55-0x0000000003390000-0x0000000003490000-memory.dmpFilesize
1024KB
-
memory/2956-53-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-52-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-51-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-50-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-49-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-48-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-47-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-46-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-45-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-44-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-43-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-42-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-41-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-40-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-39-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-38-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-37-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-1-0x0000000001E60000-0x0000000001EB4000-memory.dmpFilesize
336KB
-
memory/2956-35-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-32-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-54-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-57-0x0000000003390000-0x0000000003490000-memory.dmpFilesize
1024KB
-
memory/2956-31-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-30-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-29-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-28-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-27-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-26-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-25-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-24-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-23-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-22-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-21-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-20-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-19-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-18-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2956-17-0x00000000033A0000-0x00000000033A1000-memory.dmpFilesize
4KB
-
memory/2956-16-0x00000000033A0000-0x00000000033A1000-memory.dmpFilesize
4KB
-
memory/2956-15-0x00000000033A0000-0x00000000033A1000-memory.dmpFilesize
4KB
-
memory/2956-14-0x00000000033A0000-0x00000000033A1000-memory.dmpFilesize
4KB
-
memory/2956-13-0x00000000033A0000-0x00000000033A1000-memory.dmpFilesize
4KB
-
memory/2956-12-0x00000000033A0000-0x00000000033A1000-memory.dmpFilesize
4KB
-
memory/2956-11-0x0000000003390000-0x0000000003490000-memory.dmpFilesize
1024KB
-
memory/2956-10-0x0000000001FE0000-0x0000000001FE1000-memory.dmpFilesize
4KB
-
memory/2956-9-0x0000000002440000-0x0000000002441000-memory.dmpFilesize
4KB
-
memory/2956-8-0x0000000002020000-0x0000000002021000-memory.dmpFilesize
4KB
-
memory/2956-7-0x0000000002030000-0x0000000002031000-memory.dmpFilesize
4KB
-
memory/2956-6-0x0000000001FC0000-0x0000000001FC1000-memory.dmpFilesize
4KB
-
memory/2956-5-0x0000000001FD0000-0x0000000001FD1000-memory.dmpFilesize
4KB
-
memory/2956-4-0x0000000002430000-0x0000000002431000-memory.dmpFilesize
4KB
-
memory/2956-0-0x0000000000400000-0x0000000000527000-memory.dmpFilesize
1.2MB
-
memory/2956-3-0x0000000001FF0000-0x0000000001FF1000-memory.dmpFilesize
4KB
-
memory/2956-2-0x0000000002010000-0x0000000002011000-memory.dmpFilesize
4KB
-
memory/2956-76-0x0000000004390000-0x00000000044B7000-memory.dmpFilesize
1.2MB
-
memory/2956-77-0x0000000004390000-0x00000000044B7000-memory.dmpFilesize
1.2MB
-
memory/2956-92-0x0000000001E60000-0x0000000001EB4000-memory.dmpFilesize
336KB
-
memory/2956-91-0x0000000000400000-0x0000000000527000-memory.dmpFilesize
1.2MB