Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
10/09/2024, 11:40
General
-
Target
d8344e4648e2c128e1e71634ee644c24_JaffaCakes118.exe
-
Size
668KB
-
MD5
d8344e4648e2c128e1e71634ee644c24
-
SHA1
c6ccd2734f72af40e8f723211987989b06fbe7ef
-
SHA256
a74c52e8df9d2a3f56de0c7c20f8b4d8484c7653d1c62d6088e708173a647ba2
-
SHA512
df1ea86c02248947291304b21aaf13fb65b53081c9162e4a74f6cfb9b8ed037ae1e33e77406a089d4650d10f27dea87eaa43f0aa221e4d9e2fe11bb559fc9f07
-
SSDEEP
12288:N+bps8fMQ0iGn039/JGdILQsiTV5nYPnlF3Z4mxxPP0OFpR++hn7fW:N+lUd0WYQBTV5nGlQmXPP0OS
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8344e4648e2c128e1e71634ee644c24_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d8344e4648e2c128e1e71634ee644c24_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dbsea.exeC:\Windows\system32\dbsea.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\system32\DelSvel.bat2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD57fae0f9f5f539c63073451f2b2e76dff
SHA15fabad3d50b3e539e855d1cc7aea633286c94b8d
SHA256a00dbe3b004fc4a9e447b836f0377b0f63f1938e7792ff0ef97cacbcb6cc973d
SHA5120617bab6a617e52ca78405ff008904d65cc0d5600bd71eacccdf6be363b8b036f9f3253b3873155ef15e7a4c280676d8f9d364319b4c44fa744afb7e18148861
-
Filesize
668KB
MD5d8344e4648e2c128e1e71634ee644c24
SHA1c6ccd2734f72af40e8f723211987989b06fbe7ef
SHA256a74c52e8df9d2a3f56de0c7c20f8b4d8484c7653d1c62d6088e708173a647ba2
SHA512df1ea86c02248947291304b21aaf13fb65b53081c9162e4a74f6cfb9b8ed037ae1e33e77406a089d4650d10f27dea87eaa43f0aa221e4d9e2fe11bb559fc9f07
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
336KB
-
Filesize
1.1MB
-
Filesize
336KB