Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-12-2024 07:36
General
-
Target
ea98c184f1ff5acfc1fd276b204960be_JaffaCakes118.exe
-
Size
39KB
-
MD5
ea98c184f1ff5acfc1fd276b204960be
-
SHA1
3dfce7da77b9bc14a8e0598e20fa99daf6b0d133
-
SHA256
e22b7d1ff9dad3fefad8a2e1a29217aa2380d11aac671d000020a1c86568ae7a
-
SHA512
01711df1b34357d5dba9e37abeed2ceb07ac475b1410d632a7cafe173cd99433481157f5e27e0913a8cfa9e9982720646b38fa92b4126f93382b9eb76e2ed4a4
-
SSDEEP
768:02hqVaXthyz8IxtonIJ4yY5rGfF3J1Rd/5va7OO/sedCKFRYwX4KpjOP:02UV8tzIx+nIiywifhQ6O/s8F244AqP
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea98c184f1ff5acfc1fd276b204960be_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea98c184f1ff5acfc1fd276b204960be_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD568781edc5e85ebf7d050d16811725ed9
SHA1f8bb0b808036510c4835ba4a683a99c979ec18f1
SHA256197bc80cd34bc67852452a8939e9796bf4273ad1ee270af7891f354e444cbc14
SHA512720e71d6130ab953f246382d4750fe184746b003e1ad1669fa0711fdce35504616f6dda0ab30910e118946b4604e71a625f79d73cee8a2365a74a1cecc1d7c08
-
Filesize
4KB
-
Filesize
163KB
-
Filesize
163KB
-
Filesize
4KB
-
Filesize
140KB
-
Filesize
140KB