Analysis
-
max time kernel
145s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
16-12-2024 04:23
General
-
Target
f74847ac00fb57c32eccce3722ade9a1_JaffaCakes118.exe
-
Size
57KB
-
MD5
f74847ac00fb57c32eccce3722ade9a1
-
SHA1
2e73fa9f05fe017480e99130e99622d91921704b
-
SHA256
91a65707cd0f289114466cc18dea89ae2de7bc998c43a23feb19fa8aac805168
-
SHA512
521938ceaab475ee6ddca6c6c2ac86990ea5a0b156a04e502f3d455e1974939b2bc2e8a392413ea2a07e4216fe93c342afc13ccac94738159101ab083b1799b5
-
SSDEEP
1536:vnaZCf1j6YA1wqSc2H/p1OxtvSsS4jc5pAdPdU54Qr5z:BR6VyqSFGtvZjc5p8GT
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 16 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f74847ac00fb57c32eccce3722ade9a1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f74847ac00fb57c32eccce3722ade9a1_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Win Types\lol.exe"C:\Windows\Win Types\lol.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
343B
MD5ddc820c7b0bc0d80f284761d8d392230
SHA1e6a3c23356f1393359251499dc5dfb49f4a40dd1
SHA256b1673c32ca91989278f10c174d89b3d1fa6fd316b031cd3c944fed8ea0dfca46
SHA512a4b4bcd72ed2a4d0ab2272230f98c57c5102882b812880cc93816bbdca570670cb3688dd8d9e9b0cf71a84d9653192f48e0128254db04034c486d06d3f189b7b
-
Filesize
57KB
MD5f74847ac00fb57c32eccce3722ade9a1
SHA12e73fa9f05fe017480e99130e99622d91921704b
SHA25691a65707cd0f289114466cc18dea89ae2de7bc998c43a23feb19fa8aac805168
SHA512521938ceaab475ee6ddca6c6c2ac86990ea5a0b156a04e502f3d455e1974939b2bc2e8a392413ea2a07e4216fe93c342afc13ccac94738159101ab083b1799b5
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB