Analysis
-
max time kernel
138s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-11-2024 23:19
General
-
Target
8dfe31b32fe7101633f79cca2f1e39d4_JaffaCakes118.exe
-
Size
501KB
-
MD5
8dfe31b32fe7101633f79cca2f1e39d4
-
SHA1
8feb727952f773c5e9d27b3884dd617c12846164
-
SHA256
0e28de626095d71a93bcf931abf1937793369e8ee3b883d8721710f148e63f96
-
SHA512
d1a7cb27147422dd85c7eb1a897dbbae2b9b355d53381d18b8a65352ba591e03eebbfb7429b9bd2b46edd4fa26bde536acc2c1a5cb0167d5a9eeb44f805af144
-
SSDEEP
12288:JJBu0QgQ7pO6aPhUJIDhb5QVsF3Z4mxx4Nrv4vEFBpu7SwmCPhb4Nx:JXsgyO6aKcQmX4Nrv4MVu7lmCh4r
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8dfe31b32fe7101633f79cca2f1e39d4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8dfe31b32fe7101633f79cca2f1e39d4_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ClipBookk.exeC:\Windows\system32\ClipBookk.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
501KB
MD58dfe31b32fe7101633f79cca2f1e39d4
SHA18feb727952f773c5e9d27b3884dd617c12846164
SHA2560e28de626095d71a93bcf931abf1937793369e8ee3b883d8721710f148e63f96
SHA512d1a7cb27147422dd85c7eb1a897dbbae2b9b355d53381d18b8a65352ba591e03eebbfb7429b9bd2b46edd4fa26bde536acc2c1a5cb0167d5a9eeb44f805af144
-
Filesize
212B
MD53128b3104e67f0ceb5c29060916a7c36
SHA14327985f894e769402bc30ad4f1b489e3c4a218a
SHA256f005fb0cba9716bd3ce318a87cda84dc68f7b7236bd536c58d3f6deaff84ffd2
SHA5123f592f89470ac0f092056e7cb486628a5645d074c792a412d8634b44adf75bf5a2752516f984e0c3c0eda567ea7fceb136615d4b01a5194d2122ff3c5e7400f3
-
Filesize
1.1MB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
484KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB