Analysis
-
max time kernel
140s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
22-09-2024 16:27
General
-
Target
f2630e47f336d0962c149a301216443d_JaffaCakes118.exe
-
Size
1.6MB
-
MD5
f2630e47f336d0962c149a301216443d
-
SHA1
7ce89e91c3eb5c639e28f7a7e52e76af08523be5
-
SHA256
440181ad874891fa4429f6e03aea6493dcfbf3a309215de1b3917f8b5f161a5d
-
SHA512
44384ba1c24eb76933690310cf0aaa541ecab9f01f5c109a5f49e18f9183906a74031b420fa7bc74c1eaf08d13d5813b2e56fce1b2bcfe86fd39588ded288e1b
-
SSDEEP
24576:Xb0HNtAyFa7iyXl9BO886faAICrXB8bDmAK49gEHXHyXCct05SMNTrxpwb:wHNFa2yV9Yz6aJCbBIf5zcS5SM8
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2630e47f336d0962c149a301216443d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f2630e47f336d0962c149a301216443d_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
570B
MD5f307b24616c29ee1a6ee3a342589a5db
SHA195c1266517dcf4278dbdde8ab13490471e42d8a9
SHA256f832580c890ee0a3a88ea7b0104f0253d2c2ffd5a9aaf0e96a5e727f62b75ac3
SHA512a0fb8e92ef29dbfe1e4d1ca11fc8ff77b234ac55395684fb480cf823c31272ff3a644b2259e885170a23ef87643bf60609322f7b0729325bcbc826c986fac416
-
Filesize
4.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.4MB
-
Filesize
4KB
-
Filesize
4KB