Analysis
-
max time kernel
140s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
01-10-2024 03:29
General
-
Target
04351af7500e08cfd879936b3e35f8ef_JaffaCakes118.exe
-
Size
748KB
-
MD5
04351af7500e08cfd879936b3e35f8ef
-
SHA1
c7c5790c0b06cda8552adfa79b213fcb0eb5ca9c
-
SHA256
71fda8754f1a28bb4aaa9e21f0ac4821ebe7beb7699b6f9527b575573c96e036
-
SHA512
78181f0e2b136543192ff12eb303c3e154fe15c2e7e5918971781f58889c8761e5bdd8caddadfcef37a839597019c871e1cc0e0e0be843c519c0d1f114c062dd
-
SSDEEP
12288:NOmSDLYLhASuo7pUeqqrMhGJShUZMBGk5LeBCcrIwdAe73m4LmTh06jxUi7:NtaUA+77qqQgShlGk5LenIw9mOmTh09K
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader First Stage 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Control Panel 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 21 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\04351af7500e08cfd879936b3e35f8ef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\04351af7500e08cfd879936b3e35f8ef_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 5602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2324 -ip 23241⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
625KB
MD5eccf28d7e5ccec24119b88edd160f8f4
SHA198509587a3d37a20b56b50fd57f823a1691a034c
SHA256820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6
SHA512c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.5MB