Analysis
-
max time kernel
93s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
10-07-2024 15:47
General
-
Target
355fd493636ce4aa57a42c612b741fc1_JaffaCakes118.exe
-
Size
370KB
-
MD5
355fd493636ce4aa57a42c612b741fc1
-
SHA1
cb02556e412b53fa5c99528d77e69090be01c4b5
-
SHA256
e53dd3b12700f2bffe7226cbccf955d3314d70c7861d65fd523dccd12b88a215
-
SHA512
6adb3b62061572e38ae09649bed9d96a730bb02abfa67be24f39aab95d4e50eecfe54118756b1ea2815f6d4353b5e8633bc9adae9e32ea334efb0f7f79b82e98
-
SSDEEP
6144:ZUEKZ6ck4ZE6fasFGxuUUJR8DO30gqO42qNm8Xfk6rkRpg/7U/rjpO2fzKI83NSX:CZ6cZfSu4a3dI2qc8Xf58pg/7qZfzk9h
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\355fd493636ce4aa57a42c612b741fc1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\355fd493636ce4aa57a42c612b741fc1_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 19242⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2604 -ip 26041⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.0MB