Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
09-09-2024 08:39
General
-
Target
d5f7dcba1f4b7b7659742305e4fcc41f_JaffaCakes118.exe
-
Size
590KB
-
MD5
d5f7dcba1f4b7b7659742305e4fcc41f
-
SHA1
4dac1f030d66273ee13934a5f9ec0ba1951847a2
-
SHA256
2ef7d74625d62840d77464481e128e0b2f835043852e08413716b7dbb5b1135a
-
SHA512
ce62e51fb7ae2cdd0f203dc0c3616814e7af298e6aa72584470f276081a2b626936872f2c5fdd28f5605fd9560614617f0c28e160f8d21db34418287e376d7d6
-
SSDEEP
12288:owDDh8iktuS3BuLr5+OWJSR4FktF3Z4mxx6hsV4AOwf7DGj7XQs:ow/6juSxuPUSKutQmXYYtfujJ
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5f7dcba1f4b7b7659742305e4fcc41f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d5f7dcba1f4b7b7659742305e4fcc41f_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 4403⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3564 -ip 35641⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
221KB
MD5a16a4b5f68b877f7dc0909ff4e10db3e
SHA16a357ca3a94f39c865e5c98187a2f5ee1607ea6d
SHA2561f905fb895828aba74f3f296ae2eafe3f0deeb62ab48c5258a487d18f6f5d8c0
SHA51260a55f7f91e2c0d5047dfe22b71079fa92465c762ebcdc952cba9cee6c57c3f7b9a38870d31529efe7fa976e0b78f2d1f19ab6138d9ac286fb229e498385568d
-
Filesize
900KB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
900KB
-
Filesize
336KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB