Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 18:08
Static task
static1
Behavioral task
behavioral1
Sample
16fbe86af8e3534f5aabf2b320c649fb_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
16fbe86af8e3534f5aabf2b320c649fb_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
16fbe86af8e3534f5aabf2b320c649fb_JaffaCakes118.exe
-
Size
707KB
-
MD5
16fbe86af8e3534f5aabf2b320c649fb
-
SHA1
3ff3409e7e6922b4320132508f113a74a0cb6a59
-
SHA256
cf5327bbbacb93cffeaec747568bd760398ba862f947699b74259a795911e8a9
-
SHA512
d3853f07c8d8ffc8fe6a521d13f388a0b2aecf60c1cd2fa9eb1095ad603a54b8115d63e37da68bf278bd3ab209676922737e9b14627c9275a29e3f428f0cce8a
-
SSDEEP
12288:uchBW9KdYaaiP6/qX5LzmOPmUWlOwqlkA8MJ88S2Pklys1c2obY7cPN5sxuUFJG:uKBqKpPcq1CwmfXqlkFMJ88xcnocIPn1
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2284-62-0x0000000000400000-0x00000000004C8200-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
4.exepid process 2284 4.exe -
Loads dropped DLL 2 IoCs
Processes:
16fbe86af8e3534f5aabf2b320c649fb_JaffaCakes118.exepid process 3024 16fbe86af8e3534f5aabf2b320c649fb_JaffaCakes118.exe 3024 16fbe86af8e3534f5aabf2b320c649fb_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
16fbe86af8e3534f5aabf2b320c649fb_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 16fbe86af8e3534f5aabf2b320c649fb_JaffaCakes118.exe -
Drops file in System32 directory 1 IoCs
Processes:
4.exedescription ioc process File created C:\Windows\SysWOW64\FieleWay.txt 4.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
16fbe86af8e3534f5aabf2b320c649fb_JaffaCakes118.exedescription pid process target process PID 3024 wrote to memory of 2284 3024 16fbe86af8e3534f5aabf2b320c649fb_JaffaCakes118.exe 4.exe PID 3024 wrote to memory of 2284 3024 16fbe86af8e3534f5aabf2b320c649fb_JaffaCakes118.exe 4.exe PID 3024 wrote to memory of 2284 3024 16fbe86af8e3534f5aabf2b320c649fb_JaffaCakes118.exe 4.exe PID 3024 wrote to memory of 2284 3024 16fbe86af8e3534f5aabf2b320c649fb_JaffaCakes118.exe 4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\16fbe86af8e3534f5aabf2b320c649fb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\16fbe86af8e3534f5aabf2b320c649fb_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exeFilesize
723KB
MD5eb8c254308d7f05ebff68ec6334033f5
SHA1082e0a0e2d3578b8d17e2246869a57fdbf75ea40
SHA25660f3c0990111f6bf4cecc4aba9c94512cf1a2ac96928405697656efc865e2713
SHA512b377b5d2d6eb642b94b5f6756940f6288e34ad21cda7c61475f38307eb16544b3857211ad636899286eb0952a8d41b12db65d05ac5ad7c8721455a1591d2ed63
-
memory/2284-62-0x0000000000400000-0x00000000004C8200-memory.dmpFilesize
800KB
-
memory/2284-60-0x0000000000400000-0x00000000004C8200-memory.dmpFilesize
800KB
-
memory/3024-28-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/3024-6-0x0000000000880000-0x0000000000881000-memory.dmpFilesize
4KB
-
memory/3024-48-0x0000000002A20000-0x0000000002A21000-memory.dmpFilesize
4KB
-
memory/3024-47-0x0000000002A20000-0x0000000002A21000-memory.dmpFilesize
4KB
-
memory/3024-46-0x0000000002A20000-0x0000000002A21000-memory.dmpFilesize
4KB
-
memory/3024-44-0x0000000002A20000-0x0000000002A21000-memory.dmpFilesize
4KB
-
memory/3024-43-0x0000000002A20000-0x0000000002A21000-memory.dmpFilesize
4KB
-
memory/3024-42-0x0000000002A20000-0x0000000002A21000-memory.dmpFilesize
4KB
-
memory/3024-41-0x0000000002A20000-0x0000000002A21000-memory.dmpFilesize
4KB
-
memory/3024-3-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/3024-40-0x0000000002A20000-0x0000000002A21000-memory.dmpFilesize
4KB
-
memory/3024-39-0x0000000002A20000-0x0000000002A21000-memory.dmpFilesize
4KB
-
memory/3024-4-0x0000000000690000-0x0000000000691000-memory.dmpFilesize
4KB
-
memory/3024-58-0x0000000002A20000-0x0000000002AE9000-memory.dmpFilesize
804KB
-
memory/3024-57-0x0000000002A20000-0x0000000002AE9000-memory.dmpFilesize
804KB
-
memory/3024-38-0x0000000002A20000-0x0000000002A21000-memory.dmpFilesize
4KB
-
memory/3024-37-0x0000000002A20000-0x0000000002A21000-memory.dmpFilesize
4KB
-
memory/3024-36-0x0000000002A20000-0x0000000002A21000-memory.dmpFilesize
4KB
-
memory/3024-35-0x0000000002A20000-0x0000000002A21000-memory.dmpFilesize
4KB
-
memory/3024-34-0x0000000002A20000-0x0000000002A21000-memory.dmpFilesize
4KB
-
memory/3024-33-0x0000000002A20000-0x0000000002A21000-memory.dmpFilesize
4KB
-
memory/3024-32-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/3024-31-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/3024-30-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/3024-27-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/3024-1-0x00000000001B0000-0x0000000000200000-memory.dmpFilesize
320KB
-
memory/3024-29-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/3024-45-0x0000000002A20000-0x0000000002A21000-memory.dmpFilesize
4KB
-
memory/3024-9-0x00000000006B0000-0x00000000006B1000-memory.dmpFilesize
4KB
-
memory/3024-25-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/3024-66-0x00000000001B0000-0x0000000000200000-memory.dmpFilesize
320KB
-
memory/3024-65-0x0000000001000000-0x0000000001126000-memory.dmpFilesize
1.1MB
-
memory/3024-24-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/3024-23-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/3024-22-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/3024-21-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/3024-20-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/3024-19-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/3024-18-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/3024-17-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/3024-16-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/3024-15-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/3024-14-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/3024-13-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/3024-12-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/3024-11-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/3024-10-0x0000000002A20000-0x0000000002B20000-memory.dmpFilesize
1024KB
-
memory/3024-0-0x0000000001000000-0x0000000001126000-memory.dmpFilesize
1.1MB
-
memory/3024-8-0x0000000000890000-0x0000000000891000-memory.dmpFilesize
4KB
-
memory/3024-7-0x00000000008C0000-0x00000000008C1000-memory.dmpFilesize
4KB
-
memory/3024-26-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/3024-5-0x00000000006D0000-0x00000000006D1000-memory.dmpFilesize
4KB
-
memory/3024-2-0x00000000008B0000-0x00000000008B1000-memory.dmpFilesize
4KB