Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
20-06-2024 02:55
General
-
Target
0235aa5c7a2945f9d2834533f5629b41_JaffaCakes118.exe
-
Size
367KB
-
MD5
0235aa5c7a2945f9d2834533f5629b41
-
SHA1
331581c66d5a9aee3b8310633e23e3c591d5548b
-
SHA256
f11d3ec60687e87915c59e2e78a0a6f4cc372978a784eca5aafd8a7d66fe87a6
-
SHA512
413bf6749e2f1ca849758cb6015aab13e24431bb22acebed37b712e1c3bcc3b1e359529eecbd8a7179c28d6ecdd5d8d5695d7024c6b648ec5fa631c2030e7b08
-
SSDEEP
6144:OX4RA3IqvyKW0cGBs++KYnNgsYoquSadQRs9FBegoRizN+DGlz9oSY30:OXLbIUsHbYpiQW9XSRG8DGlxoSD
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0235aa5c7a2945f9d2834533f5629b41_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0235aa5c7a2945f9d2834533f5629b41_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
-
Filesize
4KB
-
Filesize
784KB
-
Filesize
4KB