Analysis
-
max time kernel
94s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-01-2025 12:49
General
-
Target
JaffaCakes118_aa362023c011bc3c301149aa5df5ccf4.exe
-
Size
618KB
-
MD5
aa362023c011bc3c301149aa5df5ccf4
-
SHA1
7868bb9ecb04260be1f512f8f88a2b96cba0eda2
-
SHA256
6a4e0c17384ceaf73054766cbe3f73a7d0c830688f8f99aa377702c40d959e99
-
SHA512
da0532fcc7d9f4c28a2285610d31e5e67c64baca53f3c08161b28bcacaf503f20596f9ec9f4490260712c0b778fb7d908df8eeed41c761951be9b3d900932518
-
SSDEEP
12288:VWzyqzbMR9hcgkDMlGKF3Z4mxx32RqEBFLBigen:VWzyCbOSPDMQKQmXGDhM
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_aa362023c011bc3c301149aa5df5ccf4.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_aa362023c011bc3c301149aa5df5ccf4.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\program files\common files\microsoft shared\msinfo\20_server.exe"C:\program files\common files\microsoft shared\msinfo\20_server.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 5363⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1912 -ip 19121⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272KB
MD5b6814af1a0fdb4c555e1a55a4bbc831d
SHA1aded77bd4742cd649f8e5cafe2483a59dbacd6c3
SHA256e65f982bd5d7da9c05b8c3287a400906374fbec463fdeac3f144efdb2d08d0cf
SHA51259128a4789d468240cb99ef980651419703ca295e8e4c51ca21e44dc3ae4b33ea968d279fad07d8b7dafb292e8621151f7d4d69e286ad10357273fa29f26ec5a
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
660KB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
20KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
660KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
660KB