Analysis
-
max time kernel
149s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 09:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe
-
Size
27KB
-
MD5
cf467479fdc99b3db98e8564e6cac482
-
SHA1
38059448b95dadef82accb6502c96e918ec99749
-
SHA256
bb8962e9ff8731f21efd36f63e398cde9339820351bc00d6a9c923abadb7862b
-
SHA512
eb3aa0ed8c16065f0b7833eb499d6c3ca96a6fb7f807b70bf0ae2d83a7f5619a296e377dc358adbb57614f234adc7afd52a820e553aff71f941e6b29691d0d7a
-
SSDEEP
384:M8Yr2vDf3mtjmzuhNuQ0dZOKa7EAfH5+3KJIYfIpljPWfcfbfY6Lt3unzvRZG0cK:XM2RauhagGH83kreW2ZAVmc
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral1/memory/3020-2-0x0000000000400000-0x0000000000420000-memory.dmp modiloader_stage2 behavioral1/memory/3020-4-0x0000000000400000-0x0000000000420000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msmsgs = "C:\\Program Files\\Internet Explorer\\explorer.exe" cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\explorer.exe cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe File opened for modification C:\Program Files\Internet Explorer\explorer.exe cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe 3020 cf467479fdc99b3db98e8564e6cac482_JaffaCakes118.exe