Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25/11/2024, 15:53
General
-
Target
9c7bc55eab954749fe30c024051387e3_JaffaCakes118.exe
-
Size
833KB
-
MD5
9c7bc55eab954749fe30c024051387e3
-
SHA1
a6ba5e8d172ac91ba8473d32919f94e0dd615a8e
-
SHA256
5a2a4c83b09301c0f1d1dac46839d472602531342a1896c9fad3733bf1fcfe88
-
SHA512
70b08e7dd40b1cfdb1243d10ded0ed3f9471d340d328146da1cdd2b0b3a63d7febf7a20b0620061f60066e7981bc7522b385db124ea4219aa3a63a6b7dc9a2d8
-
SSDEEP
12288:sIZIJ8lG4FMng6oWoMtmo2vay2oRzSMlpQwxBcdpVAfgR3HD0uPF6Izrmmjhdg9O:/ZIJ8lG4Fj6oWoMbSayVlpMFJhd6Ib
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 7 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c7bc55eab954749fe30c024051387e3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9c7bc55eab954749fe30c024051387e3_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QQ自由幻想挂机打怪全辅助v7_1.exe"C:\Users\Admin\AppData\Local\Temp\QQ自由幻想挂机打怪全辅助v7_1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5ff1c120c29eeb3ed4af0bb2e98d15fd4
SHA13cbefd32ce25e59f9187bb2eddb1a8cbec6a8b54
SHA256071a0231dbdb0da96fdaabc7c60afaf3bf7b367017a03a47cfa3ad059be7b4c9
SHA512eb31249e4d61220ddfdb3dc6027a9aebee24e75abf0e3dfc219f5742816e7efd2747be91f2722b6d5068335998f40950ed67913d615854fcee23e7f784f423ea
-
Filesize
21KB
MD586b514c4863d1b12f905f4c134327fa4
SHA1369d3c6f21bb0b7c76a6b91f029aa6e7e21a64ea
SHA256d5181669b083d571b8150c379bf4172f755f2e7288fea007271612071e646ce1
SHA512c64a837489c3086880ddda9dc14dde06739f964961ef685cd017d8d3965d7ac447f128b39d7d35565586f5a716fa4dfc155b7fe8262d60b80e1e4b7d5a4cb96c
-
Filesize
2.0MB
MD5fdbed00762b8fde103ccf85a8d8bfbff
SHA115a3f8659786819dc0bade20eb2c7b7f0f34b1e4
SHA2567694d554a43aaf77c93c683b793b809533ec8f20340cbf7649867fcb99ddf1e8
SHA51258a138d55675206f8540b5d1b97ca2814957d2e04f66a83a6bbe4b4353737a243bd940eb8af62ad70871acc79dac8618b2f6dcacacc417078c5c200d3ba9b635
-
Filesize
60KB
MD5b46a277054a58d119d72af954bafe427
SHA1521212f5e3b5de55d9faa68a407b3711dc2c6de2
SHA256f0cdb5444f2a984d847600a6f622611ad468a7a344d31b57770e18ba0c817c47
SHA5121ebcbeb82150f447202433571443c01389e3e85e6f733fe66be3ad76abdb984b8222b6f94e3feb8d322b4b481c89400edd534cf07bf4919eeff5696f0e1fb514
-
Filesize
40KB
MD527682b80ff14db4b639ec15c0812dac1
SHA181d590d833ce7f8586f17b9bbf3f72165d09aaa0
SHA25603ddcff7ce97c7d24eace30dd4cc93c4436cdba4fc5ebd81cb8287b06f0555a1
SHA512cbb2c4994198d3ad0446c640c517e9185559e49e2df3d17c40ba488296b46a8a948fc8e4cbd7763320ad464bad27dbb15b13cf841832e84ba633e82a8fb70073
-
Filesize
688KB
-
Filesize
212KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
212KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB