Analysis
-
max time kernel
146s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-01-2025 00:12
General
-
Target
JaffaCakes118_08a1e3adc6206524f6235e7e1b2c6d6c.exe
-
Size
465KB
-
MD5
08a1e3adc6206524f6235e7e1b2c6d6c
-
SHA1
a1aed00b03bfaddeab1da87bcb31a98f3625efa4
-
SHA256
f60fa90d9233788b02de6739d3f69a5d0ffdb5cc1b492c1d73c2552b05d410e1
-
SHA512
2b3f03b96da4bfecb4b3f9f5dcf5919cc61d02a2dd9636149fd3c4da23529428e970ec8f40230a5d84bd219d1fb3ce017ef9e810dcad42f28fef314db83b7973
-
SSDEEP
12288:28TWmhxpOHQ87F3Z4mxxP7sIcOa/Y91TVK2E:YEHOQmXDsINwr2E
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 2 IoCs
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 2 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_08a1e3adc6206524f6235e7e1b2c6d6c.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_08a1e3adc6206524f6235e7e1b2c6d6c.exe"1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_08a1e3adc6206524f6235e7e1b2c6d6c.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k network1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
123KB
MD5c5fda079cfe10e3e22facd55841a9c23
SHA16c79e530e5cb70e51b446d57f000845939a4f666
SHA2563ee0715f16e3bec83efc602844cc2493db1f1c19a14f020757fa9d03fdaeaf21
SHA5124b679a1117d6f9c3b9c0a85fdf9797c5fd14438762fcf3ed2c1847a29c7508970794a9d6c3cc6141645788c7cd7316f4636bc0e61dc3e4bf80ff4274c5952613
-
Filesize
336KB
-
Filesize
824KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
824KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB