Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-09-2024 14:31
General
-
Target
eb8886aa3c7acaab6a225199c05a1d68_JaffaCakes118.exe
-
Size
49KB
-
MD5
eb8886aa3c7acaab6a225199c05a1d68
-
SHA1
ad4b1a3a22a45eaa3935479e87c32f152b8d3295
-
SHA256
29230768a94648c6fd4df76a1384a4e36457321a088ebe0e5c429182fda14493
-
SHA512
da358a7d6eefdd5fce60c8794b3088eb3d91f47a31f7badf42c216b1c344b8059b12a662df6a191fc31d85cc8e57075e89d9a7416e834a018a8a257260efbdaa
-
SSDEEP
768:VeMFfFkb5v1as0ERUpW5MgPCMgDFevhVQX9qSLGcKuw4PXne0uClvFBmOL9m4s:7FNkVvrgWjC2vzQk4KJ4ve0FpFdLm
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb8886aa3c7acaab6a225199c05a1d68_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eb8886aa3c7acaab6a225199c05a1d68_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD532216dd1102ddb62c617e17c2b06e4f8
SHA1164ca1695c957577e77cd18fe41570784333ca72
SHA2566081150e3f1497483d90b3336419a29fce37e3c5f7484f2eb13d9991495d4e51
SHA51276313d3f0eee4536d32bedcb1a8b3b198b13ad06c384c772aac0733e17b2d74e40c6158fcf5c0772bbe49a4ad4ecc7edee3f2f074787e4a794537d05ede34da0
-
Filesize
144KB
-
Filesize
144KB