Analysis
-
max time kernel
97s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
24/09/2024, 16:24
General
-
Target
f40ae4c9ba13acea469f313e212577a2_JaffaCakes118.exe
-
Size
42KB
-
MD5
f40ae4c9ba13acea469f313e212577a2
-
SHA1
cdcc2874c2dd7160e6e37f6ef5d3ae92c5912d90
-
SHA256
a53cbaadeb531dab1cdf4c01565962dd331b2489cc4def346506947325c53ca7
-
SHA512
2eb60958627cab919a115efb9633a8f90e21becf691ab197a0a9c5439634da38a11d7b31b2804bb03198f81d8dc60577b9557db7b2eec79e3c5d08f1ec5cf1c3
-
SSDEEP
768:V8UzzFMoCUZAArRMb/3kkNf7qXLa69/FxAd2BhhfoWsv9aMRiro9049EDY:aIFTCUSPY5LaAtOdEQWKSFW
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f40ae4c9ba13acea469f313e212577a2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f40ae4c9ba13acea469f313e212577a2_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB