Analysis
-
max time kernel
142s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 05:32
Static task
static1
Behavioral task
behavioral1
Sample
18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe
-
Size
688KB
-
MD5
18f54f3a1cf7e60b35662cce35f84126
-
SHA1
539024d5ccc955038f7cf75b8c96ad62cacf31d3
-
SHA256
5be3ee0c15bbbbf36f888c7b59ab271801de4569bf8875872399f3305a781def
-
SHA512
b35e9088ee245d39cbabef08375180fc43ae4a381f766b4b7b87982a061ff408c744b0892a32dbcaf37f7863c293fb4988644a98af24535e6b126f4e24d4d103
-
SSDEEP
12288:T8LLywMdqOnAuvBWF/2LtjVK4LqCF3Z4mxx6awUQ55JIqsvR33NeiH:4LcqOnlvgFI+4L9QmX6awD5/xsvNNeS
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1996-44-0x0000000000400000-0x0000000000523000-memory.dmp modiloader_stage2 behavioral1/memory/2596-47-0x0000000000400000-0x0000000000523000-memory.dmp modiloader_stage2 behavioral1/memory/1996-60-0x0000000000400000-0x0000000000523000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2844 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
360Safe.exepid process 2596 360Safe.exe -
Loads dropped DLL 5 IoCs
Processes:
18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exeWerFault.exepid process 1996 18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe 1996 18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe 2920 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe -
Drops file in System32 directory 2 IoCs
Processes:
360Safe.exedescription ioc process File created C:\Windows\SysWOW64\_360Safe.exe 360Safe.exe File opened for modification C:\Windows\SysWOW64\_360Safe.exe 360Safe.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
360Safe.exedescription pid process target process PID 2596 set thread context of 2572 2596 360Safe.exe mstsc.exe -
Drops file in Program Files directory 3 IoCs
Processes:
18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\360Safe.exe 18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxingDel.bat 18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\360Safe.exe 18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2920 2596 WerFault.exe 360Safe.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe360Safe.exedescription pid process target process PID 1996 wrote to memory of 2596 1996 18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe 360Safe.exe PID 1996 wrote to memory of 2596 1996 18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe 360Safe.exe PID 1996 wrote to memory of 2596 1996 18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe 360Safe.exe PID 1996 wrote to memory of 2596 1996 18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe 360Safe.exe PID 2596 wrote to memory of 2572 2596 360Safe.exe mstsc.exe PID 2596 wrote to memory of 2572 2596 360Safe.exe mstsc.exe PID 2596 wrote to memory of 2572 2596 360Safe.exe mstsc.exe PID 2596 wrote to memory of 2572 2596 360Safe.exe mstsc.exe PID 2596 wrote to memory of 2572 2596 360Safe.exe mstsc.exe PID 2596 wrote to memory of 2572 2596 360Safe.exe mstsc.exe PID 2596 wrote to memory of 2920 2596 360Safe.exe WerFault.exe PID 2596 wrote to memory of 2920 2596 360Safe.exe WerFault.exe PID 2596 wrote to memory of 2920 2596 360Safe.exe WerFault.exe PID 2596 wrote to memory of 2920 2596 360Safe.exe WerFault.exe PID 1996 wrote to memory of 2844 1996 18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe cmd.exe PID 1996 wrote to memory of 2844 1996 18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe cmd.exe PID 1996 wrote to memory of 2844 1996 18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe cmd.exe PID 1996 wrote to memory of 2844 1996 18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\360Safe.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\360Safe.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\system32\mstsc.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 3003⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxingDel.bat""2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\360Safe.exeFilesize
688KB
MD518f54f3a1cf7e60b35662cce35f84126
SHA1539024d5ccc955038f7cf75b8c96ad62cacf31d3
SHA2565be3ee0c15bbbbf36f888c7b59ab271801de4569bf8875872399f3305a781def
SHA512b35e9088ee245d39cbabef08375180fc43ae4a381f766b4b7b87982a061ff408c744b0892a32dbcaf37f7863c293fb4988644a98af24535e6b126f4e24d4d103
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\SxingDel.batFilesize
212B
MD586b94f1568e462fea1a9017feb1bcce6
SHA18c79a1791f3ecd0784d4b8398af429937e864072
SHA256c8a8bf286a905687229103a00ccdd8ba0e2738089983222023d5a224394ebe17
SHA512cb5fe656ab4738d1982a162fdb25f1d91758a0c76dbab68743521f284cf65059f10d4e5930dc4cc16711addd24393dadbf7c150c52bf95ac1a7784ae9bc7e3ee
-
memory/1996-18-0x00000000033B0000-0x00000000033B1000-memory.dmpFilesize
4KB
-
memory/1996-6-0x00000000020A0000-0x00000000020A1000-memory.dmpFilesize
4KB
-
memory/1996-11-0x00000000033A0000-0x00000000033A1000-memory.dmpFilesize
4KB
-
memory/1996-16-0x00000000033D0000-0x00000000033D1000-memory.dmpFilesize
4KB
-
memory/1996-9-0x0000000002440000-0x0000000002441000-memory.dmpFilesize
4KB
-
memory/1996-8-0x0000000002100000-0x0000000002101000-memory.dmpFilesize
4KB
-
memory/1996-7-0x0000000002420000-0x0000000002421000-memory.dmpFilesize
4KB
-
memory/1996-15-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1996-5-0x00000000020B0000-0x00000000020B1000-memory.dmpFilesize
4KB
-
memory/1996-4-0x0000000002430000-0x0000000002431000-memory.dmpFilesize
4KB
-
memory/1996-3-0x00000000020D0000-0x00000000020D1000-memory.dmpFilesize
4KB
-
memory/1996-2-0x00000000020F0000-0x00000000020F1000-memory.dmpFilesize
4KB
-
memory/1996-20-0x0000000002090000-0x0000000002091000-memory.dmpFilesize
4KB
-
memory/1996-14-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1996-0-0x0000000000400000-0x0000000000523000-memory.dmpFilesize
1.1MB
-
memory/1996-17-0x00000000033C0000-0x00000000033C1000-memory.dmpFilesize
4KB
-
memory/1996-10-0x00000000020C0000-0x00000000020C1000-memory.dmpFilesize
4KB
-
memory/1996-12-0x0000000003390000-0x0000000003393000-memory.dmpFilesize
12KB
-
memory/1996-19-0x0000000003420000-0x0000000003421000-memory.dmpFilesize
4KB
-
memory/1996-13-0x0000000003490000-0x0000000003491000-memory.dmpFilesize
4KB
-
memory/1996-62-0x0000000000590000-0x00000000005E4000-memory.dmpFilesize
336KB
-
memory/1996-60-0x0000000000400000-0x0000000000523000-memory.dmpFilesize
1.1MB
-
memory/1996-30-0x0000000004750000-0x0000000004873000-memory.dmpFilesize
1.1MB
-
memory/1996-1-0x0000000000590000-0x00000000005E4000-memory.dmpFilesize
336KB
-
memory/1996-48-0x0000000002090000-0x0000000002091000-memory.dmpFilesize
4KB
-
memory/1996-44-0x0000000000400000-0x0000000000523000-memory.dmpFilesize
1.1MB
-
memory/1996-45-0x0000000000590000-0x00000000005E4000-memory.dmpFilesize
336KB
-
memory/2572-39-0x0000000000400000-0x0000000000523000-memory.dmpFilesize
1.1MB
-
memory/2572-36-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2596-47-0x0000000000400000-0x0000000000523000-memory.dmpFilesize
1.1MB
-
memory/2596-51-0x0000000001E50000-0x0000000001EA4000-memory.dmpFilesize
336KB
-
memory/2596-31-0x0000000000400000-0x0000000000523000-memory.dmpFilesize
1.1MB
-
memory/2596-32-0x0000000001E50000-0x0000000001EA4000-memory.dmpFilesize
336KB