Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
30-09-2024 10:13
General
-
Target
00cde09ecf98e8466c0bd53915d3e27b_JaffaCakes118.exe
-
Size
228KB
-
MD5
00cde09ecf98e8466c0bd53915d3e27b
-
SHA1
32d94897377dd916f2020bf7a6c75f1527539fce
-
SHA256
98b7424c2fb620efcd76a06d021bca5f1a88662bcc49d2f37ed4bea4fb41b4a3
-
SHA512
8633a3e1db8324dd0a545f6abf7c1260f1b4a6fcf30d85202c2adb3f0e0cafca2c0a99165b84082bf923a6872f9787556542b69f8f60b1ba9a4d041259dea3d1
-
SSDEEP
3072:k1q1+MJKrUnFYY5z1i0Nmbi5fJBNsjkOoutQBweDO+lV4S16smBDdtQSo4L2SetF:ZIrPj0NmWtNOkOoSuzOK4SARtQ14LSaq
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\00cde09ecf98e8466c0bd53915d3e27b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\00cde09ecf98e8466c0bd53915d3e27b_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 5882⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1520 -ip 15201⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
540KB
-
Filesize
4KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
540KB