Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06/09/2024, 09:55
General
-
Target
cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe
-
Size
27KB
-
MD5
cf467479fdc99b3db98e8564e6cac482
-
SHA1
38059448b95dadef82accb6502c96e918ec99749
-
SHA256
bb8962e9ff8731f21efd36f63e398cde9339820351bc00d6a9c923abadb7862b
-
SHA512
eb3aa0ed8c16065f0b7833eb499d6c3ca96a6fb7f807b70bf0ae2d83a7f5619a296e377dc358adbb57614f234adc7afd52a820e553aff71f941e6b29691d0d7a
-
SSDEEP
384:M8Yr2vDf3mtjmzuhNuQ0dZOKa7EAfH5+3KJIYfIpljPWfcfbfY6Lt3unzvRZG0cK:XM2RauhagGH83kreW2ZAVmc
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
4KB