Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15-12-2024 10:11
General
-
Target
f383be9182fdd35b0304bcc9b4954bc4_JaffaCakes118.exe
-
Size
168KB
-
MD5
f383be9182fdd35b0304bcc9b4954bc4
-
SHA1
107c0106602c9696998351e9238d6f596891d4be
-
SHA256
caa047559ed25ab0aff1ebc1798003103cd672d67fa63ac8b012c8e09809b32b
-
SHA512
50be953234d0a1c140c859f8c1e6e942035875e0dbdb6918cf23e1771c99ac92854d9ba38b295d22b059cd4f2c228b8e78fb77a5b2905141fda630f2719eef19
-
SSDEEP
3072:oospd4uYT7LCGo4/StzIAnIiywifq6O/VF2Y:oR3a7Lq2wIiMi6O/VF2Y
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f383be9182fdd35b0304bcc9b4954bc4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f383be9182fdd35b0304bcc9b4954bc4_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5aa15ad0ac910720526d9dd807c9cf496
SHA17ad8bc40e6d1fca1f16cea4959e067c6d89ebf82
SHA256e017c901e7044e5708ac5db6e9645eae637fbf41a43789ace3f527fe30a393ab
SHA512062f87b5bcd673f5b3325b7a72eb570910be165a8c999078c7ecf1d0cbce9c942fc50265fe6795c702816e7e362f3413e7b823b2532764b3474c6e20c0979dd9
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
140KB
-
Filesize
140KB