Analysis
-
max time kernel
51s -
max time network
56s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 05:32
Static task
static1
Behavioral task
behavioral1
Sample
18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe
-
Size
688KB
-
MD5
18f54f3a1cf7e60b35662cce35f84126
-
SHA1
539024d5ccc955038f7cf75b8c96ad62cacf31d3
-
SHA256
5be3ee0c15bbbbf36f888c7b59ab271801de4569bf8875872399f3305a781def
-
SHA512
b35e9088ee245d39cbabef08375180fc43ae4a381f766b4b7b87982a061ff408c744b0892a32dbcaf37f7863c293fb4988644a98af24535e6b126f4e24d4d103
-
SSDEEP
12288:T8LLywMdqOnAuvBWF/2LtjVK4LqCF3Z4mxx6awUQ55JIqsvR33NeiH:4LcqOnlvgFI+4L9QmX6awD5/xsvNNeS
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2904-34-0x0000000000400000-0x0000000000523000-memory.dmp modiloader_stage2 behavioral2/memory/1876-39-0x0000000000400000-0x0000000000523000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
360Safe.exepid process 2904 360Safe.exe -
Drops file in System32 directory 2 IoCs
Processes:
360Safe.exedescription ioc process File created C:\Windows\SysWOW64\_360Safe.exe 360Safe.exe File opened for modification C:\Windows\SysWOW64\_360Safe.exe 360Safe.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
360Safe.exedescription pid process target process PID 2904 set thread context of 3440 2904 360Safe.exe mstsc.exe PID 2904 set thread context of 3640 2904 360Safe.exe svchost.exe -
Drops file in Program Files directory 3 IoCs
Processes:
18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\360Safe.exe 18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxingDel.bat 18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\360Safe.exe 18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2848 3640 WerFault.exe svchost.exe 2588 3440 WerFault.exe mstsc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe360Safe.exedescription pid process target process PID 1876 wrote to memory of 2904 1876 18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe 360Safe.exe PID 1876 wrote to memory of 2904 1876 18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe 360Safe.exe PID 1876 wrote to memory of 2904 1876 18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe 360Safe.exe PID 2904 wrote to memory of 3440 2904 360Safe.exe mstsc.exe PID 2904 wrote to memory of 3440 2904 360Safe.exe mstsc.exe PID 2904 wrote to memory of 3440 2904 360Safe.exe mstsc.exe PID 2904 wrote to memory of 3440 2904 360Safe.exe mstsc.exe PID 2904 wrote to memory of 3440 2904 360Safe.exe mstsc.exe PID 2904 wrote to memory of 3640 2904 360Safe.exe svchost.exe PID 2904 wrote to memory of 3640 2904 360Safe.exe svchost.exe PID 2904 wrote to memory of 3640 2904 360Safe.exe svchost.exe PID 2904 wrote to memory of 3640 2904 360Safe.exe svchost.exe PID 2904 wrote to memory of 3640 2904 360Safe.exe svchost.exe PID 1876 wrote to memory of 4880 1876 18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe cmd.exe PID 1876 wrote to memory of 4880 1876 18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe cmd.exe PID 1876 wrote to memory of 4880 1876 18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\18f54f3a1cf7e60b35662cce35f84126_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\360Safe.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\360Safe.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\system32\mstsc.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 124⤵
- Program crash
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 124⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxingDel.bat""2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3640 -ip 36401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3440 -ip 34401⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxingDel.batFilesize
212B
MD586b94f1568e462fea1a9017feb1bcce6
SHA18c79a1791f3ecd0784d4b8398af429937e864072
SHA256c8a8bf286a905687229103a00ccdd8ba0e2738089983222023d5a224394ebe17
SHA512cb5fe656ab4738d1982a162fdb25f1d91758a0c76dbab68743521f284cf65059f10d4e5930dc4cc16711addd24393dadbf7c150c52bf95ac1a7784ae9bc7e3ee
-
C:\Program Files\Common Files\microsoft shared\MSInfo\360Safe.exeFilesize
688KB
MD518f54f3a1cf7e60b35662cce35f84126
SHA1539024d5ccc955038f7cf75b8c96ad62cacf31d3
SHA2565be3ee0c15bbbbf36f888c7b59ab271801de4569bf8875872399f3305a781def
SHA512b35e9088ee245d39cbabef08375180fc43ae4a381f766b4b7b87982a061ff408c744b0892a32dbcaf37f7863c293fb4988644a98af24535e6b126f4e24d4d103
-
memory/1876-16-0x00000000033D0000-0x00000000033D1000-memory.dmpFilesize
4KB
-
memory/1876-17-0x00000000033C0000-0x00000000033C1000-memory.dmpFilesize
4KB
-
memory/1876-7-0x0000000002420000-0x0000000002421000-memory.dmpFilesize
4KB
-
memory/1876-18-0x00000000033B0000-0x00000000033B1000-memory.dmpFilesize
4KB
-
memory/1876-6-0x0000000000B00000-0x0000000000B01000-memory.dmpFilesize
4KB
-
memory/1876-0-0x0000000000400000-0x0000000000523000-memory.dmpFilesize
1.1MB
-
memory/1876-15-0x00000000009D0000-0x00000000009D1000-memory.dmpFilesize
4KB
-
memory/1876-22-0x00000000025B0000-0x00000000025B1000-memory.dmpFilesize
4KB
-
memory/1876-13-0x0000000003490000-0x0000000003491000-memory.dmpFilesize
4KB
-
memory/1876-12-0x0000000003390000-0x0000000003393000-memory.dmpFilesize
12KB
-
memory/1876-11-0x00000000033A0000-0x00000000033A1000-memory.dmpFilesize
4KB
-
memory/1876-5-0x0000000000B10000-0x0000000000B11000-memory.dmpFilesize
4KB
-
memory/1876-9-0x0000000002440000-0x0000000002441000-memory.dmpFilesize
4KB
-
memory/1876-8-0x0000000002410000-0x0000000002411000-memory.dmpFilesize
4KB
-
memory/1876-19-0x0000000003420000-0x0000000003421000-memory.dmpFilesize
4KB
-
memory/1876-14-0x00000000009C0000-0x00000000009C1000-memory.dmpFilesize
4KB
-
memory/1876-10-0x0000000000B20000-0x0000000000B21000-memory.dmpFilesize
4KB
-
memory/1876-2-0x0000000002400000-0x0000000002401000-memory.dmpFilesize
4KB
-
memory/1876-3-0x00000000023E0000-0x00000000023E1000-memory.dmpFilesize
4KB
-
memory/1876-4-0x0000000002430000-0x0000000002431000-memory.dmpFilesize
4KB
-
memory/1876-1-0x0000000000A20000-0x0000000000A74000-memory.dmpFilesize
336KB
-
memory/1876-35-0x0000000003410000-0x0000000003411000-memory.dmpFilesize
4KB
-
memory/1876-39-0x0000000000400000-0x0000000000523000-memory.dmpFilesize
1.1MB
-
memory/1876-36-0x0000000003400000-0x0000000003401000-memory.dmpFilesize
4KB
-
memory/1876-40-0x0000000000A20000-0x0000000000A74000-memory.dmpFilesize
336KB
-
memory/2904-37-0x0000000000A90000-0x0000000000AE4000-memory.dmpFilesize
336KB
-
memory/2904-34-0x0000000000400000-0x0000000000523000-memory.dmpFilesize
1.1MB
-
memory/2904-26-0x0000000000A90000-0x0000000000AE4000-memory.dmpFilesize
336KB
-
memory/3440-29-0x0000000000400000-0x0000000000523000-memory.dmpFilesize
1.1MB