Analysis

  • max time kernel
    99s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/01/2025, 16:03

General

  • Target

    JaffaCakes118_5ba64e62511b193a451a0ef1ab45e487.exe

  • Size

    98KB

  • MD5

    5ba64e62511b193a451a0ef1ab45e487

  • SHA1

    f7d0f982c3404beefb85254a6f6326b5f9db3a23

  • SHA256

    af4d48b5f5c115308c2676b6797645e5641f2176fab647b31cf934821cebdd2d

  • SHA512

    303dfd55a9df506a6dc573b9e2432347a2ab50d81f7672361c068e46319d7b8e08d9cab5dacfca992681bcce9e531b5bf62a93443e26e684fc9938e97078e586

  • SSDEEP

    1536:fk3vCKr0u7EGSeLOeps1QLt13nUQvVB8EXOILbxu/PZkx2YvJGam8HwiQ:c3quIGSom1S13nUETeCxuZ3YvcaBwiQ

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 2 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5ba64e62511b193a451a0ef1ab45e487.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5ba64e62511b193a451a0ef1ab45e487.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4324
    • C:\Windows\apocalyps32.exe
      -bs
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:760
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        -bs
        3⤵
          PID:3960

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\apocalyps32.exe

      Filesize

      98KB

      MD5

      5ba64e62511b193a451a0ef1ab45e487

      SHA1

      f7d0f982c3404beefb85254a6f6326b5f9db3a23

      SHA256

      af4d48b5f5c115308c2676b6797645e5641f2176fab647b31cf934821cebdd2d

      SHA512

      303dfd55a9df506a6dc573b9e2432347a2ab50d81f7672361c068e46319d7b8e08d9cab5dacfca992681bcce9e531b5bf62a93443e26e684fc9938e97078e586

    • memory/760-7-0x0000000000010000-0x0000000000036000-memory.dmp

      Filesize

      152KB

    • memory/4324-0-0x0000000000010000-0x0000000000036000-memory.dmp

      Filesize

      152KB

    • memory/4324-6-0x0000000000010000-0x0000000000036000-memory.dmp

      Filesize

      152KB