Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 04:45
General
-
Target
ecdd848248f8e5480691877512d60ecc_JaffaCakes118.exe
-
Size
386KB
-
MD5
ecdd848248f8e5480691877512d60ecc
-
SHA1
af03c0af0555bb67644e2949f1f64105367f006f
-
SHA256
0d6303dc56d98efe45ad279ddd2677a6fd5d3a64ff680008d1bc4f9e6489d643
-
SHA512
b742d3b41a85fe98d13c18fcbd4f4515dc10c922244c3030472275a294e993e2a9b85105ec71edb6213c93a9dded4ea9ae8a7cc27d0702e895633f7e6ff62964
-
SSDEEP
12288:V913uxLr7rF3Z4mxx5suV8OlyXfkVBQlHc:JWQmXSuVl08VCW
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecdd848248f8e5480691877512d60ecc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ecdd848248f8e5480691877512d60ecc_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER~2.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER~2.EXE2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD569f933f8efb2d2807abd0df27ce4b045
SHA1258a0dc89dc034ee594e6533f9ee683a8d44ad1f
SHA2563567e4fcd0bb855b0920d31908b259b8340d07e1f376c301567620199320d835
SHA51201d30c933a20e114112b92ccc99710aa18dc56ffe8d996289372a6b072d6514de3c3452f3722ab345fb93566f29cd001f18d148a0633388a0b0c6ff1d4caf38e
-
Filesize
20KB
MD590c8d9b88b4ffd895b7c14975087048f
SHA10f020375b376c33aca51a86624f73d82118686da
SHA25636a18d99df14db60a74f529c82fa9cadcf93055e78195b6a21c9054bb8c4dd93
SHA512ed76f3ae17ded2aac599d5bc7c8a6a25720eb5c880691662a1b01c0057ffb902f67d088d8ec3a74aab6493072fd9b0c9524cf947a89f50c2c2f26655cfdcd8b5
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
508KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
508KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
144KB
-
Filesize
120KB
-
Filesize
144KB