Analysis
-
max time kernel
93s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-01-2025 21:22
General
-
Target
JaffaCakes118_2f728665e85b4ce430a26fe3c0082998.exe
-
Size
3.1MB
-
MD5
2f728665e85b4ce430a26fe3c0082998
-
SHA1
85665542ac332a7f0448306643cf05d406eb1579
-
SHA256
11e4fd8b329c8d0e4d0679a284a095015623ae0df9eb511ffb7d5120254e6350
-
SHA512
a4637a13d65fe0b31a944c6f9840a5bf888ff2d85fa18993e92006965fedaf7c449d475759b549ff4a3ead71c19eafa1788cdd85090443f87b50c2439fd677e6
-
SSDEEP
98304:qKsxcnuD727T3eAswcNH0Q3sGAg8DWqo37x:fnuQjeAsBHtAg8DWnx
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 6 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2f728665e85b4ce430a26fe3c0082998.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2f728665e85b4ce430a26fe3c0082998.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.1MB
-
Filesize
188KB
-
Filesize
8KB
-
Filesize
188KB
-
Filesize
6.1MB
-
Filesize
4KB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
188KB
-
Filesize
6.1MB
-
Filesize
6.1MB