Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-09-2024 10:21
General
-
Target
eb20cf5e55aaede9d1e6192d5ce722e0_JaffaCakes118.exe
-
Size
554KB
-
MD5
eb20cf5e55aaede9d1e6192d5ce722e0
-
SHA1
e744e18bc60ca540d4657316040df9bba07b3552
-
SHA256
f2a38097c01e8734cf9efe50e7b0101ef8f46ca24ff2be83dbad812b3b384726
-
SHA512
fe27f87fe7c7ca56ab86e0e5a15f8b6258ab7f557e83d1dc68416606715194f70eef30b69e49656967cca0a7c1f6ed49f871c79b343f4865c770c2d59f5426a8
-
SSDEEP
12288:G7FAgcKCEtlfXF3Z4mxxfv3lpcDCUVpYHVp:G75CCXQmXfv3zcDkH7
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
ModiLoader Second Stage 5 IoCs
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb20cf5e55aaede9d1e6192d5ce722e0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eb20cf5e55aaede9d1e6192d5ce722e0_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\eb20cf5e55aaede9d1e6192d5ce722e0_JaffaCakes118.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k network1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5f7bfce68a1162ff656e34e227d027f71
SHA191b4d714ffc11c4e2d2d053a4bd0eabf08ce1cfc
SHA256f2d2557e52e84ee74bb26c999b7847868f0cc2861d858d86f906a11250db6ba5
SHA51295e212f16128bd206a3a4d3664673701d29fd17a934b66f3ccf10875543d1552b84612a246b3e93c7a9092b90c9d4ab14e5f121ac021919d616f362d7c1af404
-
Filesize
191KB
MD5007fb208b6cde541b9e4f372bb1ad186
SHA10f54350aa21ef2935b4d8b62f6c0455ca0d32174
SHA25684a510265baaaace2dc3b053480299a34b5a8a9f7302788764ee75d4f8b6dc59
SHA512dfb32a988801905dec5aeb772702dc7467c83c4fd330874990bc742a7177006ba7cac58d855e4b504176d3667badf4ef9535e4d3bde832d6ed8febd9e522e8a3
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
616KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
336KB
-
Filesize
616KB
-
Filesize
336KB
-
Filesize
528KB
-
Filesize
56KB
-
Filesize
528KB
-
Filesize
56KB
-
Filesize
528KB
-
Filesize
528KB
-
Filesize
528KB