Analysis
-
max time kernel
135s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 17:00
Static task
static1
Behavioral task
behavioral1
Sample
08014704c3a311a2f6e942faa79959d3_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
08014704c3a311a2f6e942faa79959d3_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
08014704c3a311a2f6e942faa79959d3_JaffaCakes118.exe
-
Size
87KB
-
MD5
08014704c3a311a2f6e942faa79959d3
-
SHA1
c72b10b64c5f6e57e6cb04c932b3b10e6ecd077b
-
SHA256
346e8a4aac97ef863310b47248e216da02bd8c18ef39ab8b7035f15da57bbacb
-
SHA512
3ebc0a65fbd7c2c1a1284d40a6751fd570cad8112ae60e8dd0a72a745f937dee3abe13d7aca25cea2aa16ee1e27e48c9e7639f19fbd9610db4e9c26dcd5e4c08
-
SSDEEP
1536:WNtezYzcpxH8VBxYYKSry0NmiZ4Go048RxNZeECzQiGOBsZZ89:utezRfHWyHsZ6PcZOBsZC9
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/712-1-0x0000000011000000-0x000000001101C000-memory.dmp modiloader_stage2 -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4600 712 WerFault.exe 08014704c3a311a2f6e942faa79959d3_JaffaCakes118.exe 3544 712 WerFault.exe 08014704c3a311a2f6e942faa79959d3_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08014704c3a311a2f6e942faa79959d3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\08014704c3a311a2f6e942faa79959d3_JaffaCakes118.exe"1⤵PID:712
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 712 -s 2522⤵
- Program crash
PID:4600 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 712 -s 3922⤵
- Program crash
PID:3544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 712 -ip 7121⤵PID:5092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 712 -ip 7121⤵PID:2808