Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
18-04-2024 01:29
General
-
Target
f6ff63c883b0f9c982fcb87547a487a5_JaffaCakes118.exe
-
Size
24KB
-
MD5
f6ff63c883b0f9c982fcb87547a487a5
-
SHA1
97fca869ed8e639aac70144287797641b4dca588
-
SHA256
594fb1ec8c011c3a6fe225fc7137d8cb78e825d87a5ae3cb39109570ace6144c
-
SHA512
39c55d0212d32f92dc01c8792f0adcbf71af541bbe3d61273e89c1da03bc5943c0967a9a127058dab083ca7b05e71fb4cfc8e3d6ad1c4568575e4d7d571028a6
-
SSDEEP
384:PY4GOukRWwTmaGe0QcQ0FW48q/gUH4UHGzh8SHaxPFkKq8P6gy8GJ4lFwY93vYbr:g4tY6Ae0QcQ0Fnx/FmzlKCECZFulFwGU
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 36 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\f6ff63c883b0f9c982fcb87547a487a5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f6ff63c883b0f9c982fcb87547a487a5_JaffaCakes118.exe"2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\jio4gs.bat3⤵
-
-
-
C:\Windows\SysWOW64\tcpip.exeC:\Windows\SysWOW64\tcpip.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216B
MD574aeb9028802bd5efbb88bc5f994e8fe
SHA17c0708d743988d67ea22e420b5a4de43f92934af
SHA256f799986f6be8b3a6153a259016f008a10eb906bf078e04d5e6114d0b2cb3b702
SHA512bb4c572050f8936fa07c49b82ad6a83930babcc0434f82b0b3ba1545a5d7afcc0acda84ce2be2b1bad083051527b9d707225ee9e23b63a139123d97d816dd991
-
Filesize
24KB
MD5f6ff63c883b0f9c982fcb87547a487a5
SHA197fca869ed8e639aac70144287797641b4dca588
SHA256594fb1ec8c011c3a6fe225fc7137d8cb78e825d87a5ae3cb39109570ace6144c
SHA51239c55d0212d32f92dc01c8792f0adcbf71af541bbe3d61273e89c1da03bc5943c0967a9a127058dab083ca7b05e71fb4cfc8e3d6ad1c4568575e4d7d571028a6
-
Filesize
64KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
112KB
-
Filesize
88KB