Analysis
-
max time kernel
133s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
27/06/2024, 13:15
General
-
Target
162222ead12eee9fa73de87d21102096_JaffaCakes118.exe
-
Size
494KB
-
MD5
162222ead12eee9fa73de87d21102096
-
SHA1
3d3a13622fdf29e9918921d04f13bb483df4b14a
-
SHA256
65e6b921a14733de62eb3e950d0e9a5d1063f3823890de4c07d002912f21d9d9
-
SHA512
ee6826773a0a008efd0f3399de270d4509ce123492506586688f3390c1cac9bad54a7e846feb9c057b23e3c0269cbfb90aea92e6299622b6d424356c86fd4eb1
-
SSDEEP
12288:ztZMoVZSj/WfkyiT8Dgt9qiynVfi2XMrI3s2OkB:ztZxij+fXI8Dgt3/28ezOkB
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\162222ead12eee9fa73de87d21102096_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\162222ead12eee9fa73de87d21102096_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 123⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2352 -ip 23521⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
2.1MB
-
Filesize
2.1MB