Analysis Overview
SHA256
fd4fddbfca5fd959b445e1b0aa0f9b8e4364a815e12c084abfc46307925d3777
Threat Level: Known bad
The file 0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
ModiLoader, DBatLoader
ModiLoader Second Stage
Executes dropped EXE
Drops file in System32 directory
Unsigned PE
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-06-20 19:23
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-20 19:23
Reported
2024-06-20 19:26
Platform
win7-20240221-en
Max time kernel
120s
Max time network
122s
Command Line
Signatures
ModiLoader, DBatLoader
ModiLoader Second Stage
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rascetrs.exe | N/A |
Drops file in System32 directory
Processes
C:\Users\Admin\AppData\Local\Temp\0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe"
C:\Windows\SysWOW64\rascetrs.exe
C:\Windows\SysWOW64\rascetrs.exe
Network
Files
C:\Windows\SysWOW64\rascetrs.exe
| MD5 | 0911995cf1ba233e13a4958846f9a1c0 |
| SHA1 | 055724f98727a5332bf1e6a2499a896a9e74ca2c |
| SHA256 | fd4fddbfca5fd959b445e1b0aa0f9b8e4364a815e12c084abfc46307925d3777 |
| SHA512 | e344e0cafeecb6e44a407f34c7329ba739ecd62e90520b1802d2c7de2e65a1b5c11fc21547bb16043f171076994d1fa53566e753e31f49098d4f1a9fdc6e07d1 |
C:\Windows\SysWOW64\nacktio.sys
| MD5 | 40d42be372aef4d98307061d3d84ac8f |
| SHA1 | b322bdd0e12eee768393b5b407a11ff0e9d5f201 |
| SHA256 | 91e2e5f74556bee5d0916532362e4101cd8bb6616dc1cdcc3cba5b0beb748bc6 |
| SHA512 | d611ef49b78c4b5a4ac168175b265825e6110cf150a098c5b7b07a2aa6a9c0b54e0f9aa367d5194fbaf6cf1f3d8a58a2581c3be473e48c6202be5730ad1f3092 |
C:\Windows\SysWOW64\natrnie.sys
| MD5 | 1cd653f3b4ef4fdbe3498860167f1f08 |
| SHA1 | 8aadddfdcb3bde2c46ae10130aa0536c2c481fa0 |
| SHA256 | 95a370282b6c2dff5a626eb71e6fa4f4a1b7559c58ec34d3cbb44af4a57cffb3 |
| SHA512 | 3fc59e2069e45ba80d670229b671c0523244847e5716e03ba89b7435738bd9c0caa40d4c6c2cf47c7afed232ddd41fcae559b1b1e378e4d192d7becd75f3be9b |
C:\Windows\SysWOW64\entarnoi.sys
| MD5 | 67799a6b4bde6110b9927271d6b03869 |
| SHA1 | c5b093354e87c5c769e803cc2351764733836d4d |
| SHA256 | 02f6f1255980ba4ef08a62f295dc74eeea9e4e5b317532411981fde301765fed |
| SHA512 | 2d73196e984075503f63a51478a3772aef92ef6888f7c6e8cbc3a5599c80076e107d7982c613ae77842c7da53ac2dbb3d5bef310d6004e61b226de6bcc840224 |
C:\Windows\SysWOW64\critrfs.sys
| MD5 | 710bacf7059fef2c1f07fc1dcdaa5b95 |
| SHA1 | 40b2093f31197dba7e9e28753973231f1016fbda |
| SHA256 | 7726f0169079fd83e0638143d72070803d6191a7888a9e54626fa9987fb108a9 |
| SHA512 | e5ec6dd3680b53b9cf86ecf6e20f70542c8b01f1f9679a2d1fa02dceefe1488ff1cfcb3e6402d054049bc11da3f4184454bdf01694f35db5657225cd690a93d4 |
memory/2052-23-0x0000000000400000-0x0000000000494000-memory.dmp
memory/756-24-0x0000000000400000-0x0000000000494000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-20 19:23
Reported
2024-06-20 19:26
Platform
win10v2004-20240611-en
Max time kernel
139s
Max time network
124s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 13.107.21.237:443 | g.bing.com | tcp |
| NL | 23.62.61.97:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 133.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 98.58.20.217.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.21.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.99.105.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.27.171.150.in-addr.arpa | udp |