Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-01-2025 11:55
General
-
Target
JaffaCakes118_64e8032f58f8170870ca94b79c9adfad.exe
-
Size
286KB
-
MD5
64e8032f58f8170870ca94b79c9adfad
-
SHA1
77dfea488000302f566f98af369d5ea658177748
-
SHA256
e69c5aa421e0983b41282c666a79db75b1af55feeb5ec5fac0d26e34238a78b5
-
SHA512
e320d501dcae56be6c135fcc4e31d2cb08bd7d99671e46af1805f2d45da24e0c6777d5877e2ccd7efef72ee5ae79b2474ac8259abb96b7a6b326eda63e7121aa
-
SSDEEP
3072:vlE7s6PE8I8j00JrY06BlVAlMNL3bdP55ZV7D5LMjrDA4NTV:vl0s2E8hdwlilkvdPvZV9fa
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
ModiLoader Second Stage 23 IoCs
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Deletes itself 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 18 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64e8032f58f8170870ca94b79c9adfad.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64e8032f58f8170870ca94b79c9adfad.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"svchost.exe" "c:\users\admin\appdata\local\temp\jaffacakes118_64e8032f58f8170870ca94b79c9adfad.exe"path<<c:\users\admin\appdata\local\temp\jaffacakes118_64e8032f58f8170870ca94b79c9adfad.exe>>path2⤵
- Looks for VirtualBox Guest Additions in registry
- Adds policy Run key to start application
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Adds Run key to start application
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe" C17AAE3FCECD9432566C5A2D9C19DE493⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
286KB
MD564e8032f58f8170870ca94b79c9adfad
SHA177dfea488000302f566f98af369d5ea658177748
SHA256e69c5aa421e0983b41282c666a79db75b1af55feeb5ec5fac0d26e34238a78b5
SHA512e320d501dcae56be6c135fcc4e31d2cb08bd7d99671e46af1805f2d45da24e0c6777d5877e2ccd7efef72ee5ae79b2474ac8259abb96b7a6b326eda63e7121aa
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
304KB
-
Filesize
112KB