Analysis
-
max time kernel
97s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25-09-2024 23:20
General
-
Target
f70e5bbe31a3b953ba55fcb35ff454b1_JaffaCakes118.exe
-
Size
597KB
-
MD5
f70e5bbe31a3b953ba55fcb35ff454b1
-
SHA1
d34b37b91fbdb995e0507c7a461f690bd105015f
-
SHA256
42a8b011ea909e76e91b70c0af554a0a06e1c3b7dfd5805d27b25e76dabd7aff
-
SHA512
6e1bcc4601696743c88e4c150113284e81f1e561ed09edf4dc8b540750921bb063b7359ad91bfa788befda2cf475ff6cc12e6dda21ad93d04253b19e2826568f
-
SSDEEP
12288:3M8FUr8wREWlM9Dvg+21c2obY7TsGsEbgO3yg:30rhRzM9DvWoc3sGbbgKyg
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f70e5bbe31a3b953ba55fcb35ff454b1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f70e5bbe31a3b953ba55fcb35ff454b1_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\divepro.iniC:\Windows\system32\divepro.ini2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\DaverDel.bat2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD52a2305448339aaba7d6f0ef5ad272b54
SHA192c73d342f718d641b61883763e67ebfd62d6042
SHA25627c57ebb0387da46b7c08fe883f407c2528e9f0226abd84b390fcefcf0f27d00
SHA512d267639c7379e5a8bdaeed411f520b2cfe80b54afc8551afde205b903b858bb97d2bfba04711db18bcec17b3529728f8c11ed921fb2dcf49eb0ac93b31e4b607
-
Filesize
597KB
MD5f70e5bbe31a3b953ba55fcb35ff454b1
SHA1d34b37b91fbdb995e0507c7a461f690bd105015f
SHA25642a8b011ea909e76e91b70c0af554a0a06e1c3b7dfd5805d27b25e76dabd7aff
SHA5126e1bcc4601696743c88e4c150113284e81f1e561ed09edf4dc8b540750921bb063b7359ad91bfa788befda2cf475ff6cc12e6dda21ad93d04253b19e2826568f
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
1016KB