Analysis
-
max time kernel
91s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15/01/2025, 21:08
General
-
Target
JaffaCakes118_61fbfcb111b0f4a647b5821dc78cfca5.exe
-
Size
3.1MB
-
MD5
61fbfcb111b0f4a647b5821dc78cfca5
-
SHA1
76db6d7df093c1b26d26704fd7a613c08493c120
-
SHA256
1d875037b95448da1a5339b12f4b5a3e727df207cb412cbfaf15191bd3bbbaac
-
SHA512
d7ed7f252395b18ee05b05c7c4acff7ca4256eaf90edbe34757f98b9503ff93a59894835dcf31932f385c6b1a817d3e5cd4072f324e2760fe6cdc363751421e2
-
SSDEEP
49152:stpKsxcfB8AjupDmcAa27TuU5s/4+GSw095zH0Q3su2rwAGk+8lGor5sWW:mKsxcnuD727T3eAswcNH0Q3sGAg8D1sb
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 6 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_61fbfcb111b0f4a647b5821dc78cfca5.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_61fbfcb111b0f4a647b5821dc78cfca5.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.1MB
-
Filesize
188KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
188KB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
188KB
-
Filesize
6.1MB
-
Filesize
6.1MB