Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2024, 07:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe
-
Size
57KB
-
MD5
27b17a062f258fcd5e422e98c2791920
-
SHA1
f5537588ac160856e4ec6e17a9530c93fdcd7c01
-
SHA256
7cfbbb7db8702779f46a4068776d00a40ca45dbbf30e816a9e02f331d75eb6c9
-
SHA512
62cc3b9e7c5efc8ad56fa95590a9d5c17db481e49a29215c5427973a1c5cd6f32c376a65e2f07b3f36907fd4373c0d36870221bf6ed1aae403a8a3a017344e61
-
SSDEEP
1536:NmXKngPbQ4l5MnLH1pepUS0YVoEIy5nmU3z2rmrV:NEKgPs4laBEUYVoALDrJ
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral2/memory/3372-2-0x0000000000400000-0x0000000000439000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msmsgs = "C:\\Program Files\\Internet Explorer\\explorer.exe" 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\explorer.exe 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe File opened for modification C:\Program Files\Internet Explorer\explorer.exe 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe 3372 27b17a062f258fcd5e422e98c2791920_JaffaCakes118.exe