Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
15-12-2024 02:32
General
-
Target
f1e25f0ba30ab1557f6bb0478bc59073_JaffaCakes118.exe
-
Size
40KB
-
MD5
f1e25f0ba30ab1557f6bb0478bc59073
-
SHA1
c8f59fc2b649f8b39f99a8c9eb71fa477ea45f3f
-
SHA256
ef3a9fdddcf17a8314e887f78b4e1f91a34e9f5981c8c2893d718cad593f91ca
-
SHA512
ceb6b2834ea1cdbdd226072cf922264cb0ca5b9d9557159f60236c4d468a98ac17cefee31b1d2526644260d9f0439b847afaa613734d60d06533603a98948c1a
-
SSDEEP
768:B4B2JGYVNfV6vrFDPwp2Gt7YHN0m5vcdXwPXDzHvzExAPOE/3MwVrJ7H8oWXRrK6:BC2oAfIrJwp2Gium5vcxwPzzvzEx6L/U
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1e25f0ba30ab1557f6bb0478bc59073_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f1e25f0ba30ab1557f6bb0478bc59073_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD525a74f9ab0a1b77075427cf904b4a2b5
SHA1dcce1808fd3fad85bcbc3005b69a040e44a14c95
SHA256ba26f72e52fe46f7da78fc31c1de4a8eb249bd7542fe3fc024cdeed056f5dc31
SHA5124eb010ce63da3d2de22f672b69f19c964422e968939af71e6c77623e8ed1a99545d37bd628ff18b82cd01a7ee00ee8bf1746bad1fc4f71029adc2d0768aa47d3
-
Filesize
212KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
212KB
-
Filesize
4KB