Analysis

  • max time kernel
    140s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    31/08/2024, 16:34

General

  • Target

    cd2cd4d70f08ab66ab1ac86ef34b2053_JaffaCakes118.exe

  • Size

    1.7MB

  • MD5

    cd2cd4d70f08ab66ab1ac86ef34b2053

  • SHA1

    2327c38bc4060a61fd9f51aace8839cc9da9223c

  • SHA256

    084df3f980755255c0568db06cadd14602e6880325dab0c3e0a3dfc2b8576e27

  • SHA512

    dca808e37fbaab86aa2fa6e1b220a6216e837addb3a6a3753fde05dfabfb64e0095aa88245c475dd9d3552e2eb1dfa620c26c9d0258c8a2504168f1fb90c1b9e

  • SSDEEP

    49152:Mo8vZVcLvSSDN+OMF/kjDUvmjZMElV6vRC1Z:MorvSSDNw/kjDUvmNMT0Z

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 26 IoCs
  • Themida packer 26 IoCs

    Detects Themida, an advanced Windows software protection system.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cd2cd4d70f08ab66ab1ac86ef34b2053_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\cd2cd4d70f08ab66ab1ac86ef34b2053_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2448

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\crux_remake.ini

    Filesize

    7KB

    MD5

    4df1a8be461c9d5112cfc84a5011d7d4

    SHA1

    903d32e003a76ce28536c4f6379bb6b4d58b9258

    SHA256

    767ae67fcda96a55f3980e60de5da59f1d5c242939672a048b24eb8db18e8f9c

    SHA512

    1d7f47087bc643a13dd7df9c20eca1e06cc4b217f3908cb84ba75cd64015f038a057381de22d7773ff66831b74dc9465b9d48b3fee22e25ab1d02f294684e079

  • memory/2448-408-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/2448-415-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-4-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-3-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-2-0x0000000000401000-0x0000000000455000-memory.dmp

    Filesize

    336KB

  • memory/2448-400-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-401-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-402-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-404-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-405-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-403-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-406-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-407-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-0-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/2448-1-0x0000000001E80000-0x0000000001F63000-memory.dmp

    Filesize

    908KB

  • memory/2448-409-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-417-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-412-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-413-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-414-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-410-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-416-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-411-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-418-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-419-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-420-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-421-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-422-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-423-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB

  • memory/2448-424-0x0000000000400000-0x0000000000756000-memory.dmp

    Filesize

    3.3MB