Analysis
-
max time kernel
96s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
29-09-2024 01:03
General
-
Target
fd7f2e0575e97e9078322bfd2cd0d432_JaffaCakes118.exe
-
Size
585KB
-
MD5
fd7f2e0575e97e9078322bfd2cd0d432
-
SHA1
677292a8026f1767babaacc03eb64b6337b8af01
-
SHA256
8bf0c5d3fa9e024ee99237ab43955bb48f1bbe3334c45cc6001fbb7929551315
-
SHA512
a1bdd9624982731e25a264baa2e5063212b09580488be14f3787ead1189156cff2ba923b8e4457ee9a23b27abd465fe29824bdee6a1867de7c6d7b190020741f
-
SSDEEP
12288:S7ro6J7CbPvBoWvEEUG0wvFF3Z4mxxb/zll/EpM/MJ:S7064LZVMA0wtQmXLzC
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd7f2e0575e97e9078322bfd2cd0d432_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd7f2e0575e97e9078322bfd2cd0d432_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\qq.exeC:\Windows\system32\qq.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\DelSvel.bat2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD5c8c16acbfd2cf76c550917c31d16869f
SHA18531372fbcdfb46a692c9cf3f221a50daaaf3c3e
SHA25652e03d25d5ae39afd2fbc4df3308185a04272d7b500607ec4c93b6c34fd00e96
SHA512b26e418ecd0500a4f0346bb272205ee10aca887cd35be1d0248016020cbc1184291bfc51070d9011df75d9bf3b34454d317d685608c9bc73fa2eef1f357f0b30
-
Filesize
585KB
MD5fd7f2e0575e97e9078322bfd2cd0d432
SHA1677292a8026f1767babaacc03eb64b6337b8af01
SHA2568bf0c5d3fa9e024ee99237ab43955bb48f1bbe3334c45cc6001fbb7929551315
SHA512a1bdd9624982731e25a264baa2e5063212b09580488be14f3787ead1189156cff2ba923b8e4457ee9a23b27abd465fe29824bdee6a1867de7c6d7b190020741f
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
700KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
336KB