Analysis

  • max time kernel
    140s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-08-2024 14:32

General

  • Target

    bc1ff8d5f5feef35067eab254f5e9cc2_JaffaCakes118.exe

  • Size

    860KB

  • MD5

    bc1ff8d5f5feef35067eab254f5e9cc2

  • SHA1

    1979565258ca0a29a0b3e8ba1a7cd89243a7d01d

  • SHA256

    62c6a7114e08510834d03c3f56c58a1c757fb94b7e176c4a5875d8b793f07033

  • SHA512

    d0d9ce24ea2633dc7f3ea689cba128cd6a559e84bcbfc3862847b81957838360201dcf49f2d31bd77737a931b7ecbe61ab49038d8acf035f7894ffd7d310408d

  • SSDEEP

    24576:5NJ4ChHzi5LMG/2avtQmX8GudJ4ChHzi5LMG/2a+:5NZheR+w6mMdZheR+L

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc1ff8d5f5feef35067eab254f5e9cc2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bc1ff8d5f5feef35067eab254f5e9cc2_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:3556

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3556-0-0x0000000000400000-0x000000000055D000-memory.dmp

    Filesize

    1.4MB

  • memory/3556-1-0x0000000002310000-0x0000000002364000-memory.dmp

    Filesize

    336KB

  • memory/3556-80-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-79-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-83-0x0000000002310000-0x0000000002364000-memory.dmp

    Filesize

    336KB

  • memory/3556-82-0x0000000000400000-0x000000000055D000-memory.dmp

    Filesize

    1.4MB

  • memory/3556-78-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-77-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-76-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-75-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-74-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-73-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-72-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-71-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-70-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-69-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-68-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-67-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-66-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-65-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-64-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-63-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-62-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-61-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-60-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-59-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-58-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-57-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-56-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-55-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-54-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-53-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-52-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-51-0x00000000034E0000-0x00000000034E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-50-0x00000000034E0000-0x00000000034E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-49-0x00000000034E0000-0x00000000034E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-48-0x00000000034E0000-0x00000000034E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-47-0x00000000034E0000-0x00000000034E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-46-0x00000000034E0000-0x00000000034E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-45-0x00000000025F0000-0x00000000025F1000-memory.dmp

    Filesize

    4KB

  • memory/3556-44-0x0000000002590000-0x0000000002591000-memory.dmp

    Filesize

    4KB

  • memory/3556-43-0x00000000025A0000-0x00000000025A1000-memory.dmp

    Filesize

    4KB

  • memory/3556-42-0x00000000025C0000-0x00000000025C1000-memory.dmp

    Filesize

    4KB

  • memory/3556-41-0x00000000025E0000-0x00000000025E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-40-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-39-0x0000000002500000-0x0000000002501000-memory.dmp

    Filesize

    4KB

  • memory/3556-38-0x0000000002570000-0x0000000002571000-memory.dmp

    Filesize

    4KB

  • memory/3556-37-0x0000000002540000-0x0000000002541000-memory.dmp

    Filesize

    4KB

  • memory/3556-36-0x0000000002550000-0x0000000002551000-memory.dmp

    Filesize

    4KB

  • memory/3556-35-0x00000000024E0000-0x00000000024E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-34-0x00000000024F0000-0x00000000024F1000-memory.dmp

    Filesize

    4KB

  • memory/3556-33-0x0000000002560000-0x0000000002561000-memory.dmp

    Filesize

    4KB

  • memory/3556-32-0x0000000002510000-0x0000000002511000-memory.dmp

    Filesize

    4KB

  • memory/3556-31-0x0000000002530000-0x0000000002531000-memory.dmp

    Filesize

    4KB

  • memory/3556-30-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-29-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-28-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-27-0x00000000034D0000-0x00000000034D1000-memory.dmp

    Filesize

    4KB

  • memory/3556-26-0x00000000034E0000-0x00000000034E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-25-0x00000000034E0000-0x00000000034E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-24-0x00000000034E0000-0x00000000034E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-23-0x00000000034E0000-0x00000000034E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-22-0x00000000034E0000-0x00000000034E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-21-0x00000000034E0000-0x00000000034E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-20-0x00000000034E0000-0x00000000034E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-19-0x00000000034E0000-0x00000000034E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-18-0x00000000034E0000-0x00000000034E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-17-0x00000000034E0000-0x00000000034E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-16-0x00000000034E0000-0x00000000034E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-15-0x00000000024B0000-0x00000000024B1000-memory.dmp

    Filesize

    4KB

  • memory/3556-14-0x00000000034E0000-0x00000000034E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-13-0x00000000034E0000-0x00000000034E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-12-0x00000000034E0000-0x00000000034E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-11-0x00000000034E0000-0x00000000034E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-10-0x00000000034E0000-0x00000000034E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-9-0x00000000034E0000-0x00000000034E1000-memory.dmp

    Filesize

    4KB

  • memory/3556-8-0x0000000002480000-0x0000000002481000-memory.dmp

    Filesize

    4KB

  • memory/3556-7-0x0000000002490000-0x0000000002491000-memory.dmp

    Filesize

    4KB

  • memory/3556-6-0x0000000000720000-0x0000000000721000-memory.dmp

    Filesize

    4KB

  • memory/3556-5-0x0000000000730000-0x0000000000731000-memory.dmp

    Filesize

    4KB

  • memory/3556-4-0x00000000024A0000-0x00000000024A1000-memory.dmp

    Filesize

    4KB

  • memory/3556-3-0x0000000000750000-0x0000000000751000-memory.dmp

    Filesize

    4KB

  • memory/3556-2-0x0000000002470000-0x0000000002471000-memory.dmp

    Filesize

    4KB