Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-12-2024 19:18
General
-
Target
de4647924f965d6eac627712b5135de9_JaffaCakes118.exe
-
Size
373KB
-
MD5
de4647924f965d6eac627712b5135de9
-
SHA1
90af1a55a113ceb135a7b07de86820a2871e5804
-
SHA256
b1925f44345d9f742e63320c812839c5cf6f2938da0262b6e153bac22fefa5a2
-
SHA512
66a35ec351de0de6b383b82be295b16ed1b3086300dc9c1d71d85ba7df455944b054c04ddc445ede2bd27cb92454717757ede54498c875fe0615ec7b1c1e5326
-
SSDEEP
6144:0Vs61FDrfb139bFDMbtw7C6iKlve+eJq8pp3f/0RS2rmlcNMn9okhizy03y14:Unf13xFZ7OK1kq8bf/0RWCR3zy0C2
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 15 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 20 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\de4647924f965d6eac627712b5135de9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\de4647924f965d6eac627712b5135de9_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mod_sa_by_fyp.43.1.0_0.3e.exe"C:\Users\Admin\AppData\Local\Temp\mod_sa_by_fyp.43.1.0_0.3e.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\winmouse.exe"C:\Users\Admin\AppData\Local\winmouse.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
-
-
-
C:\Users\Admin\AppData\Local\Temp\easy hack.exe"C:\Users\Admin\AppData\Local\Temp\easy hack.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
351KB
MD58a269ea56f2753dcf4355c7092782986
SHA1cb7a075ed9b8b4da0954dac23531d83da3789894
SHA256956a24e3043659e90b070e53c19f1ea2077e3d5c08a37ed63682600db4430ebd
SHA512ce6a306fda60676e0acc557a8693ad907c1f56db7cc29ea0c378593f5337b727b190cda47108bffcb2cf84ec5489816a4f582bf751c72de554ea93035d475ea7
-
Filesize
17KB
MD5cfcc4f645a5319a4699a625e05b1fc7e
SHA18e2519efd7669dfa4a03740cabe9b09e79a6382b
SHA25678c76c6165021c2a6740cdddeabd67778565cd9e5627ab6c574c53c066ab3114
SHA51251e484410fa5f563888aae506042326514dfeffe95c650526a4cae0817a98be9f140e89b7bb7826e1dfdecd2cf59fff12748eacef142dc4df0bbdcf46625a4d5
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB