Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
24-11-2024 16:43
General
-
Target
95f31ff993bae4f21ae09c0e125a280e_JaffaCakes118.exe
-
Size
36KB
-
MD5
95f31ff993bae4f21ae09c0e125a280e
-
SHA1
f98f63955731c0030c7adf5b3d3a19d133c1f7c2
-
SHA256
d7faead97e5eaeb26d21a2ac323d1b3d4e71588598a4e92f519500de36c23bef
-
SHA512
8701501f49aa6a934b7d8874e67da0f968783c6d6a22efbf71687a09d11c33df13fcba9bd363b6979fba72852d1263e61c1f63874e40fd60697af9f0273cc2ef
-
SSDEEP
768:i12QAp628zKGIxxfKECu33C2N37StWSv7/o3NxwhayQ:i12QAp3MKGITfK9/24tvk9xKQ
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\95f31ff993bae4f21ae09c0e125a280e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\95f31ff993bae4f21ae09c0e125a280e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD54d2c3e8101cecf97f3ddf40f18fdb5f3
SHA196b872d6d7529f276dc18d2945fe57c9c107dea5
SHA25612b9265049deea1c139c3cbcdfc37680a46f560c57e602ef646f59fb7c62ea2d
SHA512c6d3751ae463f1b1b3677d319888721d32ec9bf478bd9443fe42093be5ee3ec84d33150f2eb60a55ec88ab09879c4d04d8d8a22925bc7a980304c4c1587bd3a7
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
120KB
-
Filesize
4KB
-
Filesize
144KB