Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16-09-2024 04:52
General
-
Target
e40f82c1c2ec5033089c17201d5ba0d2_JaffaCakes118.exe
-
Size
40KB
-
MD5
e40f82c1c2ec5033089c17201d5ba0d2
-
SHA1
b5fb3860082b1fba2111e74e6ed65846292a55ad
-
SHA256
0e0235533b6b1e32af5cf334ffda365fd674c18fe1f7da618ca361bdcefaa2a7
-
SHA512
2efdce85345fe5be581606f886d779c501c624b8496fbfb763ed5add817f8eb9e86cc842484d88f5945f5b4579f746f5fedd33cd0c5467989258e01c449afc99
-
SSDEEP
768:hs8d22LdX9wTB0DTzLIlLWx2GQrddXq80:h7XLdievgiQpdA
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 16 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e40f82c1c2ec5033089c17201d5ba0d2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e40f82c1c2ec5033089c17201d5ba0d2_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\antivir.exe"C:\Users\Admin\AppData\Local\antivir.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5e40f82c1c2ec5033089c17201d5ba0d2
SHA1b5fb3860082b1fba2111e74e6ed65846292a55ad
SHA2560e0235533b6b1e32af5cf334ffda365fd674c18fe1f7da618ca361bdcefaa2a7
SHA5122efdce85345fe5be581606f886d779c501c624b8496fbfb763ed5add817f8eb9e86cc842484d88f5945f5b4579f746f5fedd33cd0c5467989258e01c449afc99
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB