Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-12-2024 11:04
General
-
Target
e613e3665886a0252b882f60bb259fa1_JaffaCakes118.exe
-
Size
2.0MB
-
MD5
e613e3665886a0252b882f60bb259fa1
-
SHA1
d11d192375480ffc3925be2d5894b2511454a763
-
SHA256
dedf60f11c1e93b67815e893bef1555c0fe5bdf9059b958b6b0a36e104c6ac1b
-
SHA512
ac2fd0f86d4edde9609a820b8936e43a3fb135b8f74547dccd82a3394a88322498be2f1af5b4b773249d65149ee43a57f6df43103c5ad8d57df3837c599b91c1
-
SSDEEP
49152:FkUGrCW+soiocGwLCm3vKIUSptLI8SGpuDO7nJhQUo:F7GrCWjotwLvyO88SGci7Ju
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e613e3665886a0252b882f60bb259fa1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e613e3665886a0252b882f60bb259fa1_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
572B
MD53ba5c67a9036d8e30c71015b9c8b3daa
SHA1cca9f934692cc3c0aa8dc285b09e9c32c8304551
SHA256c264ba82836fd0d312e7d57fcb1de42c49ca0c96ebe83be530dec1ee99fa4161
SHA512e1e0e51a533a5e574c6750d44e919838cb0d8c5c92bc165ba5f7dc5d5037d6b7c8cad26b7c4503c4d7967b7d7725fd9506848b177e716bb287cd9b384c18c0bb
-
Filesize
5.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.2MB
-
Filesize
4KB
-
Filesize
4KB