Analysis
-
max time kernel
141s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 10:07
Static task
static1
Behavioral task
behavioral1
Sample
1ae1e9c3a2ec5820e2d96a278eac562e_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1ae1e9c3a2ec5820e2d96a278eac562e_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1ae1e9c3a2ec5820e2d96a278eac562e_JaffaCakes118.exe
-
Size
342KB
-
MD5
1ae1e9c3a2ec5820e2d96a278eac562e
-
SHA1
4b922229ca4b5a6743510965ddb652f9b3a26567
-
SHA256
e50552f530a6be498748859e8e65a5baaf2dc7f5287c2004b4fc076264469837
-
SHA512
5ed5d4ebcee83dcb203da62b1f9b24bcd11af179dd41edc32d24113c846e0782e7f45f2579fb7c1cfaf5273189e3f720d92c958d1a62dc3a94fcd3087210d89e
-
SSDEEP
6144:C4XQxS2b4Y7C1vtx/9xCVLGKwd63tPlQuk0+4ko2pftDv8wt3FeVBjxWOj:C4sVbj7CRP/9xsLtDtU0J2TkyFeVBlWA
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2356-18-0x0000000000400000-0x00000000004C1000-memory.dmp modiloader_stage2 behavioral1/memory/2868-24-0x0000000000400000-0x00000000004C1000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
cnm.exepid process 2868 cnm.exe -
Drops file in System32 directory 2 IoCs
Processes:
cnm.exedescription ioc process File created C:\Windows\SysWOW64\_cnm.exe cnm.exe File opened for modification C:\Windows\SysWOW64\_cnm.exe cnm.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
cnm.exedescription pid process target process PID 2868 set thread context of 1672 2868 cnm.exe calc.exe PID 2868 set thread context of 772 2868 cnm.exe calc.exe PID 2868 set thread context of 2144 2868 cnm.exe calc.exe PID 2868 set thread context of 900 2868 cnm.exe calc.exe -
Drops file in Windows directory 2 IoCs
Processes:
1ae1e9c3a2ec5820e2d96a278eac562e_JaffaCakes118.exedescription ioc process File created C:\Windows\cnm.exe 1ae1e9c3a2ec5820e2d96a278eac562e_JaffaCakes118.exe File opened for modification C:\Windows\cnm.exe 1ae1e9c3a2ec5820e2d96a278eac562e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1ae1e9c3a2ec5820e2d96a278eac562e_JaffaCakes118.execnm.exedescription pid process target process PID 2356 wrote to memory of 2868 2356 1ae1e9c3a2ec5820e2d96a278eac562e_JaffaCakes118.exe cnm.exe PID 2356 wrote to memory of 2868 2356 1ae1e9c3a2ec5820e2d96a278eac562e_JaffaCakes118.exe cnm.exe PID 2356 wrote to memory of 2868 2356 1ae1e9c3a2ec5820e2d96a278eac562e_JaffaCakes118.exe cnm.exe PID 2356 wrote to memory of 2868 2356 1ae1e9c3a2ec5820e2d96a278eac562e_JaffaCakes118.exe cnm.exe PID 2868 wrote to memory of 1672 2868 cnm.exe calc.exe PID 2868 wrote to memory of 1672 2868 cnm.exe calc.exe PID 2868 wrote to memory of 1672 2868 cnm.exe calc.exe PID 2868 wrote to memory of 1672 2868 cnm.exe calc.exe PID 2868 wrote to memory of 1672 2868 cnm.exe calc.exe PID 2868 wrote to memory of 1672 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2696 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2696 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2696 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2696 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2696 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2696 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2596 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2596 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2596 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2596 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2596 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2596 2868 cnm.exe calc.exe PID 2868 wrote to memory of 1060 2868 cnm.exe calc.exe PID 2868 wrote to memory of 1060 2868 cnm.exe calc.exe PID 2868 wrote to memory of 1060 2868 cnm.exe calc.exe PID 2868 wrote to memory of 1060 2868 cnm.exe calc.exe PID 2868 wrote to memory of 1060 2868 cnm.exe calc.exe PID 2868 wrote to memory of 1060 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2244 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2244 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2244 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2244 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2244 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2244 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2744 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2744 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2744 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2744 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2744 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2744 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2832 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2832 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2832 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2832 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2832 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2832 2868 cnm.exe calc.exe PID 2868 wrote to memory of 624 2868 cnm.exe calc.exe PID 2868 wrote to memory of 624 2868 cnm.exe calc.exe PID 2868 wrote to memory of 624 2868 cnm.exe calc.exe PID 2868 wrote to memory of 624 2868 cnm.exe calc.exe PID 2868 wrote to memory of 624 2868 cnm.exe calc.exe PID 2868 wrote to memory of 624 2868 cnm.exe calc.exe PID 2868 wrote to memory of 1736 2868 cnm.exe calc.exe PID 2868 wrote to memory of 1736 2868 cnm.exe calc.exe PID 2868 wrote to memory of 1736 2868 cnm.exe calc.exe PID 2868 wrote to memory of 1736 2868 cnm.exe calc.exe PID 2868 wrote to memory of 1736 2868 cnm.exe calc.exe PID 2868 wrote to memory of 1736 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2900 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2900 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2900 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2900 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2900 2868 cnm.exe calc.exe PID 2868 wrote to memory of 2900 2868 cnm.exe calc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ae1e9c3a2ec5820e2d96a278eac562e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1ae1e9c3a2ec5820e2d96a278eac562e_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\cnm.exeC:\Windows\cnm.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\cnm.exeFilesize
342KB
MD51ae1e9c3a2ec5820e2d96a278eac562e
SHA14b922229ca4b5a6743510965ddb652f9b3a26567
SHA256e50552f530a6be498748859e8e65a5baaf2dc7f5287c2004b4fc076264469837
SHA5125ed5d4ebcee83dcb203da62b1f9b24bcd11af179dd41edc32d24113c846e0782e7f45f2579fb7c1cfaf5273189e3f720d92c958d1a62dc3a94fcd3087210d89e
-
memory/624-57-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/772-74-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1060-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1672-16-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/1672-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1672-14-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/1736-62-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1768-82-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2132-87-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2244-38-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2356-18-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/2356-0-0x00000000006E0000-0x00000000006E1000-memory.dmpFilesize
4KB
-
memory/2596-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2696-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2744-44-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2832-50-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2868-11-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/2868-31-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/2868-24-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/2900-68-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB