Analysis
-
max time kernel
99s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/01/2025, 16:03
Behavioral task
behavioral1
Sample
JaffaCakes118_5ba64e62511b193a451a0ef1ab45e487.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_5ba64e62511b193a451a0ef1ab45e487.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_5ba64e62511b193a451a0ef1ab45e487.exe
-
Size
98KB
-
MD5
5ba64e62511b193a451a0ef1ab45e487
-
SHA1
f7d0f982c3404beefb85254a6f6326b5f9db3a23
-
SHA256
af4d48b5f5c115308c2676b6797645e5641f2176fab647b31cf934821cebdd2d
-
SHA512
303dfd55a9df506a6dc573b9e2432347a2ab50d81f7672361c068e46319d7b8e08d9cab5dacfca992681bcce9e531b5bf62a93443e26e684fc9938e97078e586
-
SSDEEP
1536:fk3vCKr0u7EGSeLOeps1QLt13nUQvVB8EXOILbxu/PZkx2YvJGam8HwiQ:c3quIGSom1S13nUETeCxuZ3YvcaBwiQ
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral2/memory/4324-6-0x0000000000010000-0x0000000000036000-memory.dmp modiloader_stage2 behavioral2/memory/760-7-0x0000000000010000-0x0000000000036000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 760 apocalyps32.exe -
resource yara_rule behavioral2/memory/4324-0-0x0000000000010000-0x0000000000036000-memory.dmp upx behavioral2/files/0x000600000001e754-3.dat upx behavioral2/memory/4324-6-0x0000000000010000-0x0000000000036000-memory.dmp upx behavioral2/memory/760-7-0x0000000000010000-0x0000000000036000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\apocalyps32.exe JaffaCakes118_5ba64e62511b193a451a0ef1ab45e487.exe File opened for modification C:\Windows\apocalyps32.exe JaffaCakes118_5ba64e62511b193a451a0ef1ab45e487.exe File created C:\Windows\apocalyps32.exe apocalyps32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_5ba64e62511b193a451a0ef1ab45e487.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language apocalyps32.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4324 wrote to memory of 760 4324 JaffaCakes118_5ba64e62511b193a451a0ef1ab45e487.exe 82 PID 4324 wrote to memory of 760 4324 JaffaCakes118_5ba64e62511b193a451a0ef1ab45e487.exe 82 PID 4324 wrote to memory of 760 4324 JaffaCakes118_5ba64e62511b193a451a0ef1ab45e487.exe 82 PID 760 wrote to memory of 3960 760 apocalyps32.exe 83 PID 760 wrote to memory of 3960 760 apocalyps32.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5ba64e62511b193a451a0ef1ab45e487.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5ba64e62511b193a451a0ef1ab45e487.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\apocalyps32.exe-bs2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe-bs3⤵PID:3960
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD55ba64e62511b193a451a0ef1ab45e487
SHA1f7d0f982c3404beefb85254a6f6326b5f9db3a23
SHA256af4d48b5f5c115308c2676b6797645e5641f2176fab647b31cf934821cebdd2d
SHA512303dfd55a9df506a6dc573b9e2432347a2ab50d81f7672361c068e46319d7b8e08d9cab5dacfca992681bcce9e531b5bf62a93443e26e684fc9938e97078e586