Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-09-2024 22:42
General
-
Target
f6ff63c883b0f9c982fcb87547a487a5_JaffaCakes118.exe
-
Size
24KB
-
MD5
f6ff63c883b0f9c982fcb87547a487a5
-
SHA1
97fca869ed8e639aac70144287797641b4dca588
-
SHA256
594fb1ec8c011c3a6fe225fc7137d8cb78e825d87a5ae3cb39109570ace6144c
-
SHA512
39c55d0212d32f92dc01c8792f0adcbf71af541bbe3d61273e89c1da03bc5943c0967a9a127058dab083ca7b05e71fb4cfc8e3d6ad1c4568575e4d7d571028a6
-
SSDEEP
384:PY4GOukRWwTmaGe0QcQ0FW48q/gUH4UHGzh8SHaxPFkKq8P6gy8GJ4lFwY93vYbr:g4tY6Ae0QcQ0Fnx/FmzlKCECZFulFwGU
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\f6ff63c883b0f9c982fcb87547a487a5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f6ff63c883b0f9c982fcb87547a487a5_JaffaCakes118.exe"2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\system32\jio4gs.bat3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\tcpip.exeC:\Windows\SysWOW64\tcpip.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216B
MD574aeb9028802bd5efbb88bc5f994e8fe
SHA17c0708d743988d67ea22e420b5a4de43f92934af
SHA256f799986f6be8b3a6153a259016f008a10eb906bf078e04d5e6114d0b2cb3b702
SHA512bb4c572050f8936fa07c49b82ad6a83930babcc0434f82b0b3ba1545a5d7afcc0acda84ce2be2b1bad083051527b9d707225ee9e23b63a139123d97d816dd991
-
Filesize
24KB
MD5f6ff63c883b0f9c982fcb87547a487a5
SHA197fca869ed8e639aac70144287797641b4dca588
SHA256594fb1ec8c011c3a6fe225fc7137d8cb78e825d87a5ae3cb39109570ace6144c
SHA51239c55d0212d32f92dc01c8792f0adcbf71af541bbe3d61273e89c1da03bc5943c0967a9a127058dab083ca7b05e71fb4cfc8e3d6ad1c4568575e4d7d571028a6
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
88KB