Analysis
-
max time kernel
92s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 09:55
General
-
Target
ed57c096b5603524d8bc95cf6fcc7bbb_JaffaCakes118.exe
-
Size
1.8MB
-
MD5
ed57c096b5603524d8bc95cf6fcc7bbb
-
SHA1
e7d379170161668978cf67868d788ffa7f10d4b3
-
SHA256
b3bc30eecb20c97c61c012c53aa82ed92045ece53e381ad1096bfa065070e30d
-
SHA512
9d05d5766c364dbb7be3a82846ddb72c7fec5804001cef014174275cd25295773dfdd4e0627bceb956085509e0c60bbb88c47d495adea0b7cab64135d5ebafa3
-
SSDEEP
49152:/h/lHiX8GfKvVRScM5k0ufjZnvfVngAqwfZ+:Zpq8GByXjNGA3
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader First Stage 3 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed57c096b5603524d8bc95cf6fcc7bbb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ed57c096b5603524d8bc95cf6fcc7bbb_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 2762⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4212 -ip 42121⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB