Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 18:11
Static task
static1
Behavioral task
behavioral1
Sample
08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe
-
Size
102KB
-
MD5
08866ec866bc6324a21580821f7880c2
-
SHA1
b509a89828f717dcc73037ae247c36777b9be19f
-
SHA256
6524578837a74f96b5d4a259d58299e2763306f040edc189c6386a62199cfe06
-
SHA512
13c7235f1d6f838b84da18cf827f358a2d20c8e37179ff840dcb74ec580e626329bcd588ebe7cc116b6ef8a3c031d957e5be231e98ce0fa6b762dcaf118fe65e
-
SSDEEP
3072:CbaxebqluFJtiCkZf19qhftlFS2SKtB3cmpEwjtLN5:Cm0ap9oT3SuOcEwV
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1056-1-0x0000000000400000-0x000000000046D000-memory.dmp modiloader_stage2 behavioral1/memory/1056-14-0x0000000000400000-0x000000000046D000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
08866ec866bc6324a21580821f7880c2_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msmsgs = "C:\\Program Files\\Internet Explorer\\explorer.exe" 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe -
Drops file in Program Files directory 3 IoCs
Processes:
08866ec866bc6324a21580821f7880c2_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files\Internet Explorer\icwhelp.dll 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\explorer.exe 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe File opened for modification C:\Program Files\Internet Explorer\explorer.exe 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
08866ec866bc6324a21580821f7880c2_JaffaCakes118.exepid process 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe 1056 08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1056