Analysis
-
max time kernel
150s -
max time network
55s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 13:15
Behavioral task
behavioral1
Sample
054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe
-
Size
447KB
-
MD5
054572711af1299d6004c3bdf4b35239
-
SHA1
bfbe2514a9141767b0619588b32ed185d851705b
-
SHA256
b7ff3db5a804ad2eda388345f63848b6c8adad73170c85dfd70567a2639c4624
-
SHA512
d01fa87b56c505ea9b99ca0fbf5f38d3b0f27bbfe2fe99203dc48fce9116819e346d4cb6348caad89d6183cf84c964dc1bc042923887ac680d37cf469788c369
-
SSDEEP
6144:wLy84u9nSO2GjZkD10BIY3rb1YfBdfpoZ3u/Ht52w6JSeiFPXRo6sm:E+u9nx2GjMY3XKfd/H/9Pm6sm
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4680-1-0x0000000000400000-0x0000000000476000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
054572711af1299d6004c3bdf4b35239_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe" 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
054572711af1299d6004c3bdf4b35239_JaffaCakes118.exepid process 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe 4680 054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\054572711af1299d6004c3bdf4b35239_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\explorer.exeexplorer.exe1⤵