Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    04-05-2024 16:55

General

  • Target

    13a46707944e036d1bf9be580056b4f3_JaffaCakes118.exe

  • Size

    397KB

  • MD5

    13a46707944e036d1bf9be580056b4f3

  • SHA1

    0256eb2bca82d3a61f3d374873c015de292156d2

  • SHA256

    d7c25f336e0d597734a5523a83d3b78c44c2fc6a83d3750ebbf591dddf457391

  • SHA512

    17c8d3000bee5438160c8278886046fbfb6e00a8ccf1296dd5de6b11283cec11b745a5228b8118588d0046eec83f1f6a5c6201a51371d4e9a7d90e3652332716

  • SSDEEP

    6144:MLy84u9nSO2GjZkD10BIY3rb1YfBdfpoZ3u/Ht52w6JSeiFPXDW2:Y+u9nx2GjMY3XKfd/H/9PS2

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 3 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\13a46707944e036d1bf9be580056b4f3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\13a46707944e036d1bf9be580056b4f3_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    PID:3000
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Suspicious use of AdjustPrivilegeToken
    PID:2172

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3000-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

  • memory/3000-1-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

  • memory/3000-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

  • memory/3000-6-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

  • memory/3000-13-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB