Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    27/09/2024, 14:00 UTC

General

  • Target

    fa88df5d972e2c0b867ec0cda6f711ec_JaffaCakes118.exe

  • Size

    286KB

  • MD5

    fa88df5d972e2c0b867ec0cda6f711ec

  • SHA1

    424e17936235d1d348ea66627de479bb6ba46e2e

  • SHA256

    e0006e97a56ac37edbafd67ba10ec7e4f661ab1683411deaa3e33007f40f9389

  • SHA512

    57fc574f0720cb41681cab81d6f5366a5ca4668c0c059e13c91c6792623c7d72e25ddc7cfb6eade97293a902d6c3a7e942f7faf3c919492315c5349dbb8d92a2

  • SSDEEP

    6144:6f0qbz3+KEoCuiJIZHpaxVK1WhmpA1rE4b/QHo2ZZ7M8dsWQEaWf/t:1quJBfJkIz2/bHoisiaWt

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa88df5d972e2c0b867ec0cda6f711ec_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fa88df5d972e2c0b867ec0cda6f711ec_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2076
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 36
      2⤵
      • Program crash
      PID:1720

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2076-0-0x0000000000400000-0x000000000050C000-memory.dmp

    Filesize

    1.0MB

  • memory/2076-1-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/2076-2-0x0000000000400000-0x000000000050C000-memory.dmp

    Filesize

    1.0MB

  • memory/2076-3-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.