Analysis

  • max time kernel
    117s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13/09/2024, 02:12 UTC

General

  • Target

    dd766b64c60d9cf8d9af6f026c584880_JaffaCakes118.exe

  • Size

    306KB

  • MD5

    dd766b64c60d9cf8d9af6f026c584880

  • SHA1

    f5d17993a0c9095c664f63b02e68390e004f76e2

  • SHA256

    e097e0f3e886bb84fc58910bea444749b8fbe89f09f505cfa0448e7753b775af

  • SHA512

    4ef917c2d82a6880182e8157518726df0419f65082781af6e2e12c6279ca696a4639d3fb3fba6e76d7fb71bc9969440f06d296a8cdf6ef932b065f42c0595cdf

  • SSDEEP

    6144:U010c2b/DhQw9QgpDowFSL1u2ApUTyGouITOkIxYy80:luJDhxOgpfSE2ApCyigPIYyL

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dd766b64c60d9cf8d9af6f026c584880_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\dd766b64c60d9cf8d9af6f026c584880_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\program files\internet explorer\IEXPLORE.EXE
      "C:\program files\internet explorer\IEXPLORE.EXE"
      2⤵
        PID:2916

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2736-1-0x00000000002A0000-0x00000000002A1000-memory.dmp

      Filesize

      4KB

    • memory/2736-2-0x0000000000400000-0x00000000004C0000-memory.dmp

      Filesize

      768KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.