Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-12-2024 22:06
General
-
Target
f9086571870240ec25d0932ff2190076_JaffaCakes118.exe
-
Size
37KB
-
MD5
f9086571870240ec25d0932ff2190076
-
SHA1
3a3bc5ae3524fa233757fb02c14af4d007d72e2d
-
SHA256
ed0076670d5d3cf8d39ebdc790cf164d74503a9583975e3a7715a257fcbc76a1
-
SHA512
416692d3fc9814a3749184101a4043d73348a908ef0440abb716c53b49d0db200ce3b13074df5fd7b1ce76d7307105f986728736e38679ce29559b1f60fd9868
-
SSDEEP
768:i2hqVaXthyz8IxtonIJ4yY5rGfF3J1Rd/5va7OO/sedCKFRYwX4Kpje:i2UV8tzIx+nIiywifhQ6O/s8F244Ai
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9086571870240ec25d0932ff2190076_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f9086571870240ec25d0932ff2190076_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5bcc6fef0e4cdd191bbcf7c6c78a755ad
SHA1d888383f36a4b182dfac5ad9fdc404917e64be5b
SHA2560522e8ca6f1e33299678c78cc4109dd8a9d46db0af763093b5fd06bdd877afbd
SHA512383e2c4d310a5898013a907ffb972addea181500ddfcdd831916138270d25f4e946fbf87022011e73c82fa0425b91804f0f5dcf5bdd12c4aa1515b71e59b4348
-
Filesize
4KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
4KB
-
Filesize
140KB
-
Filesize
140KB