Analysis
-
max time kernel
136s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-11-2024 02:56
General
-
Target
8ecb49e4b3c9f1e4469ed0237d505b52_JaffaCakes118.exe
-
Size
1.8MB
-
MD5
8ecb49e4b3c9f1e4469ed0237d505b52
-
SHA1
6482f37a3568bfd0584881e678411534785bdce7
-
SHA256
fc05cc57a8de5b04ab4e329a8d42010461ef51a275fe5b0159de5210876d730d
-
SHA512
a35dab6f3f992c796ef58a9fa1e3d17eb3cd1c72cc769cfc056b953426d3787fe95fac84e3a927f3260371be661330af636c1be59d2da74583b4f2a879bfe8cf
-
SSDEEP
49152:X1dlZolYt6L163lEYZwIB6HL0zQIaZp+4faO:X1dl2lYt6Ls1EcAroQj+7O
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 12 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 5 IoCs
-
Loads dropped DLL 32 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 53 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ecb49e4b3c9f1e4469ed0237d505b52_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ecb49e4b3c9f1e4469ed0237d505b52_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\server2.exe"C:\Windows\server2.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\server2.exeC:\Windows\server2.exe3⤵
- Executes dropped EXE
-
-
-
C:\Windows\Driver Vibracion mandos Play.exe"C:\Windows\Driver Vibracion mandos Play.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Driver Vibracion mandos Play.exe"C:\Windows\Driver Vibracion mandos Play.exe" -deleter3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ISBEW64.exe"C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ISBEW64.exe" {DD19BC0E-827B-48CE-9D16-F7917E8B486C}:{0EA47093-3F67-4830-84B6-76B47148DFDD}4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5d186d961e211e4fd7f7c3a02a864cbe5
SHA11957aa61dca0bee7369cca48be318189c7940332
SHA256201b7ac5dc35f03b051bf7b599eb35bce96b24b468d347854038d6a01b452725
SHA512516f593cd2042ae69739622f8a1ac17545d9905c31f4571d2d3bf9835cd5c245be6fce4d696fda96c0be6dbb1c0060780595a4f63224d419cbb7458a0c652074
-
Filesize
62KB
MD5bb0f3eb5117f6de265e6aff38c2afa9e
SHA18bebbd64243faebfb166cc1e28cf4bc46551a884
SHA2560500fed441b3c2eab4492b2774daa1db751cddda3ef9b4d881cbd025af9ea7fd
SHA51298874f16ce63d157562f8faf6f5c78763b79945023378c48b60a16cb892ffa8eed5b3921f1907eb2998b8bd78692224ca3ec568438e427bd8f2912517f1f7225
-
Filesize
68KB
MD534fc187d14c58d715804983399f5faad
SHA1cbac7b4ce6e08fda00243e3df51a3e055dadf3db
SHA256027c07b861ed408c7bfe6cdd5c26c2440b1b8e9028bf28062257cd08bd2130b9
SHA512325efb47e9a86cabc9af228dcdde5613669fdd872d00430e9081ce7d07b0deea19beffdcc8fecb9c1c8d0a2e8f7e6d969b1b2cfd86e3edfed1aa4ff73a089ba3
-
Filesize
196KB
MD5cd37457a02ebb8cc8596ec1ec4805959
SHA1b280ab56de15b2ba67bef5152f1489c04da02bbd
SHA25607ced62e7f3611fb56840480778b3cce83ee02913de95bcd67f52dcb9fb0b0ed
SHA512b35fb4006d1290a56d60c04e10d87ea6768c88a83ac26b36b29b1fdc583b17f48461a6afce12a58f036980467a8859f8258b6c9dcaf8066a89f62613e67bdd84
-
Filesize
736KB
MD5594678e8fc20d430eb7bd2de53f8f307
SHA10fa3e19b6444847f840b53786d92f2847c07959d
SHA2568f137730eb7330b72ade6b67d6c4b3d6793280423a4e29c53973662a95fa24ba
SHA512f2a336d69ed17c3beb7ccbcfdae6a74a19a0faa9a9cc342a072aee5257d5ab2c2bf7cd69bab429f6c44449cbbd1763bdb72bcd50dd82b5df3e4276fdae406b84
-
Filesize
268KB
MD5887e758f5267b616905f0168b39d16d5
SHA1af5e36264f96965805c90d6f79fb59982f2da25b
SHA256e554dfbd961b65bc95250a3be7f6829c42880a4d6e320720750fe9bb68b04321
SHA512c7629eb4c217731b572c155ac0d1248d7f33ca4619a1139447224a2f0c4b168b53acd63ade2742df1b08087b108363dae75d2c9108074156819b8fc84555d6ef
-
Filesize
180KB
MD5f77a9df6057ef2998e656a236b08e768
SHA1d54eb3a96c72a53b71fbd0562324472c5226c9d9
SHA2561624f26f935ba6def4b42642b1e93aa2688d9b5af7f13f593d68ebb33b8f4660
SHA512c28768a2c8e4f51a82e1c0fb343e2e4d6a1ad93b9aa398d539b1ddc1f295fb6c7272b4c148a6ceb85c068dd0b31fda29c024cea400093ca2dd66b5f7d8ce564a
-
Filesize
324KB
MD55b5182aa2d922801cbf083b2a69b1a46
SHA16dd0c36b874374b9c16c77ed8cd95c8c405358b4
SHA25683412e1ed4caf8043a731b8cd86d739d85c831d01ccacc28c440343bbbca7a80
SHA512c81005b53b495f69170530ee0f48f6772f7083e1fe2959cc78020a595d27498e0242ccaa3845a9cedfb52eee227726b084ce882b2fc3528efb32d895738dff63
-
Filesize
2KB
MD5ea448d96f2751ef78e0d5fda86f3d143
SHA1617bce6accff48413b3add5ce241e8627bda3b40
SHA256161b807b4cbdb43aa1b6895ee47024d68ff0798cf670f440a551b2329f3e62d1
SHA512dc3fb29baa41eaf36d7bb0444cb0e72fb48bac10ef0ebd1079d82153e692b7e7ff4ab46ebe066993d96466d0144bff4980f52e6d00b7d922f2c8a7484f616347
-
Filesize
115KB
MD5d943779e389eb8f3ce4d8259be29f8e5
SHA1112060cb2caa6696f23c376cbe56edff3c115fef
SHA25638b3d8a37e89e8899be78f7787aa2f0ced65c77772689c11115146c8f6654167
SHA51268fd9e020d422ac21638cb38a57c70029cae3a080ea7c1263d51879f5a6d07c8b0bbcd93cad4ff20a5998b8f3804a70671971a0b6a1d4dc7d146af49fbce4fbc
-
Filesize
32KB
MD5b6d770559ec6b834bb2357fd5deaf218
SHA13558009a7bba8ecc9aa5e7188efded352ffce329
SHA256c641579c2686999689df03cd5b8e79c25ed11c0dceb2ecb4c5a03eaa7e25b52d
SHA5122e953b1fd55358a4a6b10a548226fbadccddff494a8f90f34eccb75dbc85deae0b1346900f55c103cb80e4eb6ceae2e64240e83df1aa4df9df7e6ca899f5afde
-
Filesize
337KB
MD5219e6f82e7acbdc03f42e6db695f4780
SHA1785c45bb15ab6fc13b5d7cbf5b5c3321f7e587c7
SHA256f28110e0b2791e6fcd450e2fc28a11e8b75902d3ca29d6b73953258ee9491e1b
SHA512ec34902e0db09855ee93f797bb77219f0bdcdb0cd7e79682828a465078ed949bb4238811e9397a2d4c952eb52bf9b9e543e04ca27ce9cc6cd8d84c920cfff8a2
-
Filesize
455B
MD522b57c52ff0bce4624618698b5d20dff
SHA19080a7b990851ee5a245ab951b01f0d083bcd670
SHA256f65ba2d5fb73e15340b12a428dd39856c4a05324816ecdd99ba7f820377f01b3
SHA512fd6e406ead6874298e419b6af888a743a43dc4768530ba3be94daa07da773904c8028a435a73f996601d3c20ee087ca59803ad9fe0e6a25fe46ed07a88aff921
-
Filesize
118KB
MD5bef1e6a9b97045ec3f2b9cf34acb6810
SHA1951681061079a820f02e4c62e4b9885f98da6d0d
SHA256ba4771a2fb260d697f7dc4ca7603ec927e969287776bf1bafc28aa6693ca13c8
SHA512b38f4d40627bdda7e56ade48298e378797ca36340861f6defab5eaaed1b41123eb8f6e5deb19411f39ccd202c54f5b311874e4f05775df4ff1768f01f2d5ffa9
-
Filesize
510B
MD5a0756030faf581cd764d7cc897fb8908
SHA1897c9cea93446ce83c9475256d737147b3bdfd8b
SHA256c82413c01e2b2ce7b839798f52a05a5e7da20c2e4955a262ed349925f91e0cfe
SHA5122c548c765994b94931632d63c973c8a7f0337f59be31281ff7791911c57ec30b19fdad1da484c7e2770baf10622e0beca6ee6ca9ba59694664ff1d5135eede4a
-
Filesize
80KB
MD5d564ef123694b57ffbb77d99491758d9
SHA144c0b40fcececc21f2029fda956d0f8c94c8a4ae
SHA256eca50e2f7313fc1c5b7e84e7efbee53cf598ea242bcf18223afed1f8f10b3950
SHA51263aa1267cbe7d0d036486b570a43dd7371b6b6597c0605f6cd34469c6ed2caca079da1a7b2ae5296e9550c14787fede1e6b33e762c10f5f175e6d89fee261438
-
Filesize
64KB
MD5973b9af82b9806bc1d88f56de566a8f0
SHA15629d0be44668d723cb9dedb9a1dfefbc2299e52
SHA25652829595a9633b8ad53ca2dd3ff6db46b12af8f53a3d4a5a05cef5f736544251
SHA51234e4c06db3a94a5be8851c3606eec0c59f5ce76b0c194499c3d2b990bc06e30c0a5a0e10aaf188f6b4035126cb3815f4053131b50391cb5d4d162966816f21d7
-
Filesize
750B
MD5d28f206259757bbaa8d227d8b71fd9c2
SHA11eb2f3fcfefa681b6d3d50e219bbbc9b8026e4fc
SHA256188e1d2afb0e52ee115005f8363b1cf7c33d859ef3b4bae99908a75d9db8028d
SHA51287f2ad5365182c5fd5fbdeeafc8631d14d39ea522266414f32ea5378ba587ab48ec989ee43a4848226f4c6d7b9b0cec577c7a45babe7a9743082060dd6d0caa2
-
Filesize
240B
MD50616abc885c8b6854559f2266182e5a0
SHA1d258fb92ae012188c59740795895be02e39a18c7
SHA2568e6f8e10c85a30d7d3b7e0e0f5206b163ff2a2e630c3b5ab044db573692c5db0
SHA512ba5413de121afe57f3bc088f4cdfc9376d965cc53a982966a08e0d1fb69477e1dd7b3a2089343eadd7ab2747ff93336a9564faffe8ca3ea4a2faa750086aeefa
-
Filesize
18KB
MD50998f298d088361fc518cb2ac48170e6
SHA1584b9051aec75978fd18f9ced4989ce887a78924
SHA2566f21fa427b6e3417d6b91e5deeb7cd13b0c3e7566c644fbe15521db1d981e468
SHA512a242c21400bcda5d24913caa244d0f3065e1ce6648aa7217a519f84ffd1a5902d2cf6a957aa4f875a56d41b4df8cf6d5ef3f2d8d9dc322c413fec3a90fe72308
-
Filesize
530KB
MD5f1388bda22a24abcdb0324903411bf7f
SHA16c005ca9286a016dd803b5335332e55d5b764cbb
SHA256362bf10edb8825839844f078c92b0e118f0a1a5615e6c77e2cf46fda76ede70e
SHA51222f18a7acab3ac51c31b074202c147de129ea03a7322c92e383c4a2a85a4e365aa15d8e179ac0a8018d6fbc84fc0facec2975ab2045bc4d63075d3c58d668f41
-
Filesize
386KB
MD59402376c4dce39be1021b5f7ee2a6a80
SHA12e3a387969b92a47b64fc606a12a680b6b026c79
SHA256e5908cd7a47f15dc7ac16b81ccb151576771e68594275dccff5119711afb6c0b
SHA51259af674c92733e9a068cc8df38a59d3867f167acd8c1b3317330d59244c4090b3e8caac08a62341a42678dd8914c07ded6041f8815f92664ab36e49ab5ceaeb9
-
Filesize
156KB
MD52656cb75c1f6b71cde6b7e7b3645e1d9
SHA17d20db395762e7ce19bf43c4e57820ac37d04db3
SHA25612440426c955f9cadf425222da0a592c7e16ed9c4486225f4dc53378b59ab7b0
SHA512bc1f6d579863a3435c4532b2dbeb3fb4258e9f0d0a85062b33709a28f3449197e86608d91e6ed5826291cde8328bc2238b1c7e4302e9f25bef4c7f50a1726af6
-
Filesize
426B
MD5ca1a1301364b46a88b557f920b0f15f9
SHA128cf00545bc21163255b6a4afb6379db103f4b4c
SHA25696e71796e327a59711b6f85da1a45d37af1d7c5c61d892a2510c21340c6de724
SHA51209396cfc5362c771e7caa2576d18882918581bbcf6f2fc1d84c0bbe7f05027cfeafd7a3d567692c930902e52ac52ef67fbcde81ba8577b5fcb83d30f77fed929
-
Filesize
232B
MD56815d3baab99961d11518e0298e03ceb
SHA152aa7841e6d5ae2ab8daf321b3df68f747d7e584
SHA2560e75c83b830678c435c1935f2067844e29c1b5e731f574981b936d956b86913a
SHA512ac2a50330c8dd2d9686a18590dab31c60e0374a756450dee5f0f385683198f66358ee086f952692e5280a17884c16d08a5fdac04563ebb264e583afc0db27565
-
Filesize
39B
MD500f313e3e007599349a0c4d81c7807c4
SHA1f0171f15aab836a1979d3833e46b5e59e4ea32e0
SHA256766ee687d90b0217eb41cb85aca04375bdc24db986a33536631f864b7ce1a08a
SHA5128bb25a62c0b1640dec36403a493ed54c05f7cde7b7357c8faea785a79c4b76bbe6a3d6fe78db52b558a37abac90c2b2e8b13868a76294554d51670e9fa8764ad
-
Filesize
536KB
MD5d28b31e1e3d9972cce01e4deb0288b31
SHA10a728f650bc72bbb30a83a90670367f6f59a3ca0
SHA25694b98bc569540cd7efae0bc37d4e4035aaa1303a48b336c7fb5f8a9c3c53d14b
SHA5127f8984681956eb25aef92670587fce7403c6850830c5c8232776a3a66911f0df6e4c3fe7189a027662c42c670ea623b7decbf4f4e1ba2272afaeee7551a469b3
-
Filesize
416KB
MD59a7790ae29bbadfa35650751ecceb0e7
SHA1b42ef960693d5d99289d2b5c986b7cee75caaf33
SHA256d5fed7777f35693cf9ceff1036fa77546098c59439ac4e619ad88f96ac6537b0
SHA5123fa69eefe8b223da3e54b4c09241aa5cfe7e3979a890e4a8bb7f92f191c23819caf16cd67976ddefa38dcb2514b78924d0f78fc61d38f2f0964680bcb82e976e
-
Filesize
186KB
MD5ba4fa9b7434a742765c24f645773beda
SHA1e7c1cf9c0e521374f10bd0f7917f0bc81d017560
SHA25669d53428d55fde1811e3ed98406dd7ebf7d8b0735183a30dd90df5d12bdcffc0
SHA5120859fb1b7a9a42a06d02b1b929097eeb51370bf00c14d104ef75a989e4bdc2c16fd791dd00b2fbd4d7afe8b2fd50f63b1be8a1eca39285d8d3e8ef6d9fb8859a
-
Filesize
1.7MB
MD5dae70bdab236221f0cbe52be9935373d
SHA1cce4fc25b917d607da94615b58581d97e36cab4b
SHA2564c59a8205e48dd8147cf9ebbd4b2e92957b383ca2d511d7a1ee569ad1bbabe5e
SHA512400be583af95897cfee0c09e1386a07198c5333fc942048e6c7efd7ccb1f5491258ca7bd7a472a68ccf288e9797494eceebccd83a7b289ae70e20c8b1b944d1b
-
Filesize
170KB
MD501d596d6eb627b47aecf33fc544b6581
SHA1388b67952e8761eadedb68e8874aba01c422a5da
SHA256754f0ecbd3cc9dc6da574ac0b612ce2901c7d84610654fe56d7feade25b62a45
SHA51261a672959634e907ea4f64495acdeb9849efd0022970f7a5fb9e670f1b22fcd1d04d02f795d61d1dbbbe19c56c4f146ed7430f71c5404185e300a87b9d01c315
-
Filesize
220KB
-
Filesize
180KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
12KB
-
Filesize
180KB
-
Filesize
220KB
-
Filesize
180KB
-
Filesize
220KB
-
Filesize
12KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
832KB
-
Filesize
544KB
-
Filesize
188KB
-
Filesize
424KB
-
Filesize
68KB
-
Filesize
272KB
-
Filesize
204KB
-
Filesize
68KB
-
Filesize
88KB
-
Filesize
332KB
-
Filesize
36KB
-
Filesize
36KB