Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
21-01-2025 21:33
General
-
Target
JaffaCakes118_07a7a2c25db3fded7ebe24343b1838c4.exe
-
Size
40KB
-
MD5
07a7a2c25db3fded7ebe24343b1838c4
-
SHA1
07d8c2a5daa86add74bcd1e72094af409bfcaec3
-
SHA256
a89cb09e20c51047fb3910bb551f29e3300990d036f08d03d2614dc249d72f93
-
SHA512
bac099b09d83875c10a2b1a089f6b030e201b211c2d8e584453f89abf4da9e2cf25825758eea8b7f13aef0b2de8f885ea7173a3378facbcb065cfabc159ed4b2
-
SSDEEP
768:B4B2JGYVNfV6vrFDPwp2Gt7YHN0m5vcdXwPXDzHvzExAPOE/3MwVrJ7H8oWXRrKM:BC2oAfIrJwp2Gium5vcxwPzzvzEx6L/i
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_07a7a2c25db3fded7ebe24343b1838c4.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_07a7a2c25db3fded7ebe24343b1838c4.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD584f3dae486d7d89328baa27a8c94dc01
SHA1135cc2b065e089918009ccaa4c6f4456f30cb851
SHA2560ca89eedd6992c1d7ae0cda111c814879c35654a892cb6a2ec03dabdef2b6482
SHA5124031adcfccfebf3e051373dafc5aa84bae6ea8bc19332c3e8a8dca890e6d47b23a213cc0459959a9f8cf39503a2efea5593dae14249ff41dfb708add9ad9c38c
-
Filesize
4KB
-
Filesize
212KB
-
Filesize
144KB
-
Filesize
212KB
-
Filesize
4KB
-
Filesize
144KB