Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/04/2024, 21:17
Static task
static1
Behavioral task
behavioral1
Sample
e5e033f70a25c0feb59a0690bc26d9ca_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e5e033f70a25c0feb59a0690bc26d9ca_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e5e033f70a25c0feb59a0690bc26d9ca_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
e5e033f70a25c0feb59a0690bc26d9ca
-
SHA1
2c3b1f7a1bdf66e6620d2823531a0ab1de766a1a
-
SHA256
9ad39077181fbcf10e4fabafdb5a29f5aaf92c8096b71e2cce6a3f104fbd7b11
-
SHA512
70e842035ca5f8a5063005aae1de093d81d6825f16e85c9fbc19ddd40ffff8920f857a5daf3ed47deba7fdb4a018fd3ca4fa16e811bedc9c51a8d97fb1310df9
-
SSDEEP
24576:4z4ycZBRC7GW0MLFsSv2qOZWNlERKxRaBGNoifdGhwSx0bmcUZUXt0b:4zuZrHLcFsSY4NiKxloif4hv0bPt
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral1/memory/1704-14-0x0000000000400000-0x000000000070C000-memory.dmp modiloader_stage2 behavioral1/memory/1704-18-0x0000000000400000-0x000000000070C000-memory.dmp modiloader_stage2 -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1704 e5e033f70a25c0feb59a0690bc26d9ca_JaffaCakes118.exe 1704 e5e033f70a25c0feb59a0690bc26d9ca_JaffaCakes118.exe 1704 e5e033f70a25c0feb59a0690bc26d9ca_JaffaCakes118.exe 1704 e5e033f70a25c0feb59a0690bc26d9ca_JaffaCakes118.exe 1704 e5e033f70a25c0feb59a0690bc26d9ca_JaffaCakes118.exe 1704 e5e033f70a25c0feb59a0690bc26d9ca_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 1704 e5e033f70a25c0feb59a0690bc26d9ca_JaffaCakes118.exe 1704 e5e033f70a25c0feb59a0690bc26d9ca_JaffaCakes118.exe 1704 e5e033f70a25c0feb59a0690bc26d9ca_JaffaCakes118.exe 1704 e5e033f70a25c0feb59a0690bc26d9ca_JaffaCakes118.exe 1704 e5e033f70a25c0feb59a0690bc26d9ca_JaffaCakes118.exe 1704 e5e033f70a25c0feb59a0690bc26d9ca_JaffaCakes118.exe