Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
02/12/2024, 07:13
General
-
Target
b76f1a8162e6693db6388d6e894989a5_JaffaCakes118.exe
-
Size
36KB
-
MD5
b76f1a8162e6693db6388d6e894989a5
-
SHA1
5d0973a5eb06a0e297104e791d1c427822a4580c
-
SHA256
e354a943272bc3cebf9f62a3c28fdef6b51f95688b1ebc0e4e2f218385435db5
-
SHA512
cc6df17c39f510510586bb8aace926eaf6d8a6c2b2e1d5139a26aa65115c8fc5654073988f8091a3e5f728316d7f062d23b7ead7268009261df646dcebaa9156
-
SSDEEP
768:i12QAp628zKGIxxfKECu33C2N37StWSv7/o3Nxwhay+:i12QAp3MKGITfK9/24tvk9xK+
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b76f1a8162e6693db6388d6e894989a5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b76f1a8162e6693db6388d6e894989a5_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5ad1a2b90759eca68e1ac4a955d372db5
SHA1ec8bfcd6e0cd82ff8663373762b1853c2d5d2980
SHA2566fccb812e6efb56a21dc7d0453dae12d8d2735099bf1cce3c74c3e3c0dc8010c
SHA512bf53980e2c2108cbc55221967ed9b5e15157e7573b0875cda4c369697be4d17250ce269fad08bf7827b375424661dd5113d975eee41a944f293c214c0c932d03
-
Filesize
120KB
-
Filesize
1024KB
-
Filesize
120KB
-
Filesize
144KB
-
Filesize
120KB
-
Filesize
1024KB
-
Filesize
144KB