Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
30-09-2024 06:57
General
-
Target
00115d494aa5c8938625f8be6f360fb0_JaffaCakes118.exe
-
Size
250KB
-
MD5
00115d494aa5c8938625f8be6f360fb0
-
SHA1
d823d7a935ba78e4e28403757092b20c163f553b
-
SHA256
a83188c0dc367efdf90a62023d1894a49e25462d600b939ba282432442d5a5da
-
SHA512
ee42b209095ee174750d812bcd2d9f3deae56b8e8d7082c75a7e6be952613c083ba761f5be68805c3dd937b9171088c83d663a7b7b788aa98eba5f7658852eb2
-
SSDEEP
6144:f9vKmScOyAXdnunxJQNmYr4s/YsAQ/kQrBGsh:fPgyAXdn2nQNmLjsj/trBXh
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\00115d494aa5c8938625f8be6f360fb0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\00115d494aa5c8938625f8be6f360fb0_JaffaCakes118.exe"1⤵
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
24KB
-
Filesize
472KB