Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24-11-2024 01:43
General
-
Target
91dca0b8307d539333644a88ef538818_JaffaCakes118.exe
-
Size
523KB
-
MD5
91dca0b8307d539333644a88ef538818
-
SHA1
254bd77afdc7f5ffed927a07a8a8c8652efb6c67
-
SHA256
06bf07e9d9c219bd9fb325c3b9a205b9346a3b1c36d65646f31b0f84e136b7a2
-
SHA512
9bb021b247f84bfaf07cda4b9db15529f5b3ee6cf5370dd279a4a42e4e232f970b097ff3d88f1f148461fdf6809c9b312bb95b8c6369ccd3967ba843be71eb27
-
SSDEEP
12288:oaKX/poYW/6Nrv3RxmVMF3Z4mxxIJ3YSiikCp4K7W:5KxLrfmVMQmXIipCpzW
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Modiloader family
-
ModiLoader Second Stage 9 IoCs
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\91dca0b8307d539333644a88ef538818_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\91dca0b8307d539333644a88ef538818_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Favorites\netservice.exeC:\Users\Admin\Favorites\netservice.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\91dca0b8307d539333644a88ef538818_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\91dca0b8307d539333644a88ef538818_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k network1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
523KB
MD591dca0b8307d539333644a88ef538818
SHA1254bd77afdc7f5ffed927a07a8a8c8652efb6c67
SHA25606bf07e9d9c219bd9fb325c3b9a205b9346a3b1c36d65646f31b0f84e136b7a2
SHA5129bb021b247f84bfaf07cda4b9db15529f5b3ee6cf5370dd279a4a42e4e232f970b097ff3d88f1f148461fdf6809c9b312bb95b8c6369ccd3967ba843be71eb27
-
Filesize
393KB
MD551ce9d0ba81719576e8db8d9a692322a
SHA1a7dbaa43df003658beb71560a0be63494ba29777
SHA2560927ba82f435fcd4f15256092f5f4e730ef713e01c904dbc9b36e4ef6ec92422
SHA5124bd15ba0b19a85f6dac1014704648d67e55176572bfa71c12d91e7771b68a53ef2e8b4a4c662ed86d7fc900891ecce3125d5fd15dd3cc2f9786d570579228cfc
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
336KB
-
Filesize
1.2MB
-
Filesize
1.2MB