Overview

overview

10

Static

static

3

JaffaCakes...55.exe

windows7-x64

10

JaffaCakes...55.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-01-2025 17:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe

  • Size

    341KB

  • MD5

    6f818a61dfa71206a4623bbb5d740355

  • SHA1

    acb882ef9cfb9385726d396dbf039e2e83e0a038

  • SHA256

    28fcbbde6300e0bad903deebe8b42a260edd1ec36697ab4eacbeaa4552ac9a8c

  • SHA512

    4e0b14e7c674dff52fe15a2bf1b71b342227179871908a9cd9779cb0d0864ec68166f342831747640ad5a83ac3bcd51c388fba3003f862877fa4827d8ffbb9b1

  • SSDEEP

    6144:uI/HfAcuOdxftHKe/PViSx5JCylaX7BkujtKCTvk5/JYHFeXsvDg/0bGo/7CdSQm:NHIYxfIwFHlOpjtKnFKcXsM/0bGHm

Score
10/10
modiloaderdiscoveryevasionexecutiontrojan

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modiloader family
    modiloader
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
    evasion
  • ModiLoader Second Stage 9 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1856
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Looks for VMWare Tools registry key
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4112
      • C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe
        "C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3736
        • C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe
          C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Looks for VMWare Tools registry key
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2328
  • C:\Windows\system32\mshta.exe
    "C:\Windows\system32\mshta.exe" javascript:jVrRheFI7="L";e5g=new%20ActiveXObject("WScript.Shell");x1IHBgD="eQBXZ";IwMU0=e5g.RegRead("HKLM\\software\\Wow6432Node\\9nsvoU\\9HzFTJP");XyOEvPL19p="Qj7n";eval(IwMU0);eKoF2ii8WO="YirCKus5";
    1⤵
    • Process spawned unexpected child process
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3236
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:yedzpq
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4932

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r5h0z44e.kpt.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe
    Filesize

    341KB

    MD5

    6f818a61dfa71206a4623bbb5d740355

    SHA1

    acb882ef9cfb9385726d396dbf039e2e83e0a038

    SHA256

    28fcbbde6300e0bad903deebe8b42a260edd1ec36697ab4eacbeaa4552ac9a8c

    SHA512

    4e0b14e7c674dff52fe15a2bf1b71b342227179871908a9cd9779cb0d0864ec68166f342831747640ad5a83ac3bcd51c388fba3003f862877fa4827d8ffbb9b1

    Download Submit

  • memory/4112-12-0x00000000008F0000-0x00000000009B2000-memory.dmp

    Filesize

    776KB

    Download

  • memory/4112-2-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

    Download

  • memory/4112-8-0x00000000008F0000-0x00000000009B2000-memory.dmp

    Filesize

    776KB

    Download

  • memory/4112-0-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

    Download

  • memory/4112-11-0x00000000008F0000-0x00000000009B2000-memory.dmp

    Filesize

    776KB

    Download

  • memory/4112-10-0x00000000008F0000-0x00000000009B2000-memory.dmp

    Filesize

    776KB

    Download

  • memory/4112-9-0x00000000008F0000-0x00000000009B2000-memory.dmp

    Filesize

    776KB

    Download

  • memory/4112-13-0x00000000008F0000-0x00000000009B2000-memory.dmp

    Filesize

    776KB

    Download

  • memory/4112-7-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

    Download

  • memory/4932-16-0x0000000004F10000-0x0000000005538000-memory.dmp

    Filesize

    6.2MB

    Download

  • memory/4932-17-0x0000000004CE0000-0x0000000004D02000-memory.dmp

    Filesize

    136KB

    Download

  • memory/4932-18-0x0000000004E80000-0x0000000004EE6000-memory.dmp

    Filesize

    408KB

    Download

  • memory/4932-19-0x0000000005540000-0x00000000055A6000-memory.dmp

    Filesize

    408KB

    Download

  • memory/4932-15-0x0000000000EF0000-0x0000000000F26000-memory.dmp

    Filesize

    216KB

    Download

  • memory/4932-29-0x00000000055B0000-0x0000000005904000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/4932-30-0x0000000005A80000-0x0000000005A9E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/4932-31-0x0000000005B00000-0x0000000005B4C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/4932-32-0x0000000007170000-0x00000000077EA000-memory.dmp

    Filesize

    6.5MB

    Download

  • memory/4932-33-0x0000000006B30000-0x0000000006B4A000-memory.dmp

    Filesize

    104KB

    Download