Analysis
-
max time kernel
146s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-01-2025 07:01
General
-
Target
JaffaCakes118_0b611c2a068464b5e159c42a52323e8f.exe
-
Size
204KB
-
MD5
0b611c2a068464b5e159c42a52323e8f
-
SHA1
90cb86e2e5795a8266b6a416f017fb8aa08454c0
-
SHA256
f016ca0df3328d1c9e1a700005a868e138be98b21e9057bb779ee46f1f41976b
-
SHA512
f6cee97f346e319b18d2703589df7e974dd1f464a87a04d3df9efc82efb8223473725b5f45aa4095d059afff9d80e0d6f1e88b1d06a39b3542d49f55cbb6d77a
-
SSDEEP
3072:IVLWUJOubym6q/iU0XrxIh1V/mxIPTB+7GBuZmr/xo7vpavphHD6q:gp6q/iU0Xr+hGATEaBuZKC7vYh9O
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 25 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
UPX packed file 29 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0b611c2a068464b5e159c42a52323e8f.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0b611c2a068464b5e159c42a52323e8f.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0b611c2a068464b5e159c42a52323e8f.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0b611c2a068464b5e159c42a52323e8f.exe2⤵
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wins\setup\javascheds.exe"C:\Windows\system32\wins\setup\javascheds.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wins\setup\javascheds.exeC:\Windows\SysWOW64\wins\setup\javascheds.exe4⤵
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe + command.com /c regsvr32 /u /s %WINDIR%/"Downloaded Program Files"/JaguarEditControl.dll5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /u /s C:\Windows/"Downloaded Program Files"/JaguarEditControl.dll6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe + command.com /c regsvr32 /u /s %WINDIR%/"Downloaded Program Files"/tebedit.ocx5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /u /s C:\Windows/"Downloaded Program Files"/tebedit.ocx6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe + command.com /c regsvr32 /u /s %WINDIR%/"Downloaded Program Files"/JaguarEdit4ISB.dll5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /u /s C:\Windows/"Downloaded Program Files"/JaguarEdit4ISB.dll6⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD50b611c2a068464b5e159c42a52323e8f
SHA190cb86e2e5795a8266b6a416f017fb8aa08454c0
SHA256f016ca0df3328d1c9e1a700005a868e138be98b21e9057bb779ee46f1f41976b
SHA512f6cee97f346e319b18d2703589df7e974dd1f464a87a04d3df9efc82efb8223473725b5f45aa4095d059afff9d80e0d6f1e88b1d06a39b3542d49f55cbb6d77a
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB