Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-01-2025 04:15
General
-
Target
JaffaCakes118_9f421325958f64c7c2c580b1bca935bc.exe
-
Size
1.0MB
-
MD5
9f421325958f64c7c2c580b1bca935bc
-
SHA1
77d4c1a9bd8b56b82f91c743ba600c83d7bbbff9
-
SHA256
4e064acc797129d04bab6294b05a9136ff7cdafe3d247fe7a4e68004882845b4
-
SHA512
a698bfc4170bd5dc8d4ae192708ec746bb26ccd72f5680ba3951af5dbc0d1a4f53b7adea725bf54e8ebca384b05d93c49106153ccb4f794cc2cfc895d8fc2113
-
SSDEEP
24576:uZy2S/A6LFSGJDsGD+04Nm3l+s2svEYApU9aGiPVz5cFCf3:z2S/fBvDMN4NCp4i9zL
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 2 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9f421325958f64c7c2c580b1bca935bc.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9f421325958f64c7c2c580b1bca935bc.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
572B
MD5d0991db03db8746b6735c15fd6f15c8d
SHA1ed90eac617ab091a83d79edfdbd1047341d44caa
SHA2563750b619f7bcf32ff6b4b288f4f511d135cf6bc45e4baac94b1bc3e253ab372c
SHA5122f726d11a9d9e07184cae46deb3f9a65898d6e9d1ebc136816618a344e5cc5ffee152cae757a2c4d631c61b9aa76f51701a30a5002ab848494ee82fc1d7f6cb5
-
Filesize
3.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.1MB