Analysis
-
max time kernel
141s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16-09-2024 10:30
General
-
Target
e49371191739ff954cb62429143e5579_JaffaCakes118.exe
-
Size
586KB
-
MD5
e49371191739ff954cb62429143e5579
-
SHA1
397b0ba0f67827ed7a830fd70a59910fdcca3d76
-
SHA256
4ed27ae580c02da3f25f6e40341b5d9edb58cbd4c89e86857fa0252a7c4298bb
-
SHA512
30d25e5db633a4eac6b5f79423dd79ad5f4819b1f2deef75e75a17c4fe9f61bb9fb47e5591b9b3cdf8ee7f6950cf86ec7b8ae1fe981bdb5621c13f99df942ea3
-
SSDEEP
12288:zmNxPfT6t2CQcAjaV16qM30BB1F3Z4mxx1ZSQgj/7RXi:qTj1CQcjAq20BB1QmX1Zzgj7c
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e49371191739ff954cb62429143e5579_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e49371191739ff954cb62429143e5579_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\svchost.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169B
MD55f7787360c566d826fdc5029dad5180f
SHA1971aa4517fff5937a33b17029e9576ff73e8b827
SHA25699c80c3778f7d635be13b495f0e1ff12c74bdfd282f93a10cce9f092eb8dbdb6
SHA51202bd59d3e719bdc95a004cbfd9490015e3e28697e14d57b8fc1c6120a7b99c3c1cc7d105ee9889188f323322bf209aa806376d0f170ab83079ce19f76796932e
-
Filesize
586KB
MD5e49371191739ff954cb62429143e5579
SHA1397b0ba0f67827ed7a830fd70a59910fdcca3d76
SHA2564ed27ae580c02da3f25f6e40341b5d9edb58cbd4c89e86857fa0252a7c4298bb
SHA51230d25e5db633a4eac6b5f79423dd79ad5f4819b1f2deef75e75a17c4fe9f61bb9fb47e5591b9b3cdf8ee7f6950cf86ec7b8ae1fe981bdb5621c13f99df942ea3
-
Filesize
1.3MB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
692KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
1.3MB
-
Filesize
336KB
-
Filesize
1.3MB
-
Filesize
1.3MB