Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-01-2025 10:16
General
-
Target
JaffaCakes118_645b47a73b0697dc02e1c2e62ef57581.exe
-
Size
40KB
-
MD5
645b47a73b0697dc02e1c2e62ef57581
-
SHA1
f30cc2dfc00cf2c1f2e2242d8e32e3be3c933922
-
SHA256
f34d9a278989fb288fae67ef5e249646fec3348a4e3da0100180ed86130b7976
-
SHA512
12b5d9266c8a932bd52b908d427c872a2c470c86a3aa27ab73eefb1ffcafee5aaa3bd3d6d4fcae82cc1c9f460863d71422800978d8d4695e6b387262a50b66d2
-
SSDEEP
768:B4B2JGYVNfV6vrFDPwp2Gt7YHN0m5vcdXwPXDzHvzExAPOE/3MwVrJ7H8oWXRrKu:BC2oAfIrJwp2Gium5vcxwPzzvzEx6L/c
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_645b47a73b0697dc02e1c2e62ef57581.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_645b47a73b0697dc02e1c2e62ef57581.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD5cc8eeb30c8cbc678b942ddaed7406b6f
SHA1bd89b815a106971b50655902385e6d931bb987a5
SHA256be9bf97498d159a78869392563c766f07a861f312ebbe0902c8ee9f8f3d262c4
SHA5125b23a326ff9883372ec12b1d306f53f63b4d96a59f4ef9e1dce66c6844257fd8b8c831962ff7750e5d82ae0feb5228780976b38c8675870acff743318975b8c3
-
Filesize
4KB
-
Filesize
212KB
-
Filesize
144KB
-
Filesize
212KB
-
Filesize
4KB
-
Filesize
144KB