Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
28/11/2024, 05:42
General
-
Target
ab3144d57be7ba454b2d14ee748475ca_JaffaCakes118.exe
-
Size
412KB
-
MD5
ab3144d57be7ba454b2d14ee748475ca
-
SHA1
1fa0a2ebac016bd10c01decfcd29a1a0cc5add21
-
SHA256
5a20530a9caad1d18716c41a2f63c0ae69bd19553b8e896c9ec39075b1b64d35
-
SHA512
eba8cd84cd46e40a5d5a042e8ba7b19d2e16a9e3ee4e9eb9169cc0068d1698ecf5cf56741c473d9c1cfc9cc95fa1703783972923a932ad1cf95e55688d2aa588
-
SSDEEP
12288:HRVonqo83gzX7j6jOt4Y7Z5tqGOcmektNO:HR+n8s36KtBl5tAcmeYU
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab3144d57be7ba454b2d14ee748475ca_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ab3144d57be7ba454b2d14ee748475ca_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 2682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 324 -ip 3241⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
839KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
839KB