Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
29-09-2024 13:28
General
-
Target
fea0492c981115e5c404c95c4c86cdcc_JaffaCakes118.exe
-
Size
59KB
-
MD5
fea0492c981115e5c404c95c4c86cdcc
-
SHA1
84537eae5f61f19e7c4c9313d030f450a6787ded
-
SHA256
072b1340fef86144f3daf5c150781e5aa4d21719a55376e417cc02fb10bdf14d
-
SHA512
add019976fd6d7ac29ea46b21a301dcf77973e63e3b217a356eeff3dadfa61b46fe24b1a4d8a05fa31569cf5b2c8ad61fbc117515c4b28f063ab9490791d2d73
-
SSDEEP
1536:AnkrPktLpj1OHaZbulGW/mnwHOiCBCZ4ckskQ5Uje:AmPkhHO8buywHOiC2ksn5Uj
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fea0492c981115e5c404c95c4c86cdcc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fea0492c981115e5c404c95c4c86cdcc_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Temp\cgtwb93server.exe"C:\Temp\cgtwb93server.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD584144dfead13a22ccba151e49f29a38d
SHA1b3ef6b4161c5c97892761ee10aa68f35cbdff79d
SHA256db781713a30e7830da1cd7dbc7995bacc74ea65fdd3d0f1219613342c8063abf
SHA5124fd8b9f0f57b2665c937d829432430631f6c036bb5c66148459c7724831e4b864a5f1b5e19e84b3ce96a7b5d279042960d705b2cfebd45080f8814bb3559b22b
-
Filesize
40KB
MD5e7bce9140e16d554a0bb0a8d246fe43c
SHA1b709e3316798a5cc50ded502cfb93aef8f7d1778
SHA256c7652592cf155ad914f6ca1c3ea641444f61c36608dbc542ddb3ff8ef80828de
SHA512bc1315f25939ad3196e38775e640c5cf4521963d64766b12282e42ef9a7fc80fa7409dc342f67cee3504c1d68fdcd16e709de0da5182307ab7f68ad94222f59f
-
Filesize
212KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
212KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
164KB
-
Filesize
164KB