Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2024 05:19

General

  • Target

    287676aed2a794ab37b5d15e3b8240fc_JaffaCakes118.exe

  • Size

    131KB

  • MD5

    287676aed2a794ab37b5d15e3b8240fc

  • SHA1

    4843654fefae2b9acffda822e42b9e873f22e505

  • SHA256

    6b642779294dbc484846ac080019d3254fef27adcb91941f1365668768f99a28

  • SHA512

    da445b01f1c2dfc183169fadd1aef168759aab8d1a8f8c36e0d596df50e6bdc59e55143bc846efed3c1f37c91c5a209e5db19aa640ead0bd6f4c53c9ec1dce25

  • SSDEEP

    3072:rqJROloR0U4OulGjb58Md5ejE3/wwGcYO9l:urOlKf49QVYcl

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 5 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\287676aed2a794ab37b5d15e3b8240fc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\287676aed2a794ab37b5d15e3b8240fc_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    PID:2612

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Common Files\microsoft shared\MSInfo\SysInfo.wmp

    Filesize

    48KB

    MD5

    c4e1241f08a79f77098d2373e42a6abd

    SHA1

    5f30ffdc1ddf90cee4a924c5a84a22ca29896f19

    SHA256

    fb5bf9ecd9e3b840c5d168e568c94c5e73ee961ad4fe476e935040f934b675ff

    SHA512

    2c67f0ee3ebe3ec40be1ec8b244b98e62c7721befd8277bb9b66e36e29e46e27b7d37c588099f4376783568e76ae8d3778676a27d205e08cd6309c79015f441a

  • memory/2612-7-0x0000000000690000-0x00000000006A1000-memory.dmp

    Filesize

    68KB

  • memory/2612-10-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2612-11-0x0000000000690000-0x00000000006A1000-memory.dmp

    Filesize

    68KB

  • memory/2612-37-0x0000000000690000-0x00000000006A1000-memory.dmp

    Filesize

    68KB