Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system -
submitted
29/03/2025, 20:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe
Resource
win7-20250207-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe
-
Size
102KB
-
MD5
97d8cb0f89b46630b233d89be54c7677
-
SHA1
1ad569d0ef33184367325011de80431dffdcfb77
-
SHA256
91da54aa19bc8c764326c0c15079d8863b3c7ebd5beb2edfbb06dd861c3bcdae
-
SHA512
55e3ba09d906b9165a3f8a90ad6ed4f3ea3d03cf3b1bf6f3e209ec94d9bda406bbb288ff2aca27d8770c041eafb2a9e2aac57676e721a728300bdb34f4508fdf
-
SSDEEP
3072:u8fxebqluFJtiCkZf19qhftlFS2SKtB3cmpEwjtLxyz:uW0ap9oT3SuOcEwDyz
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral1/memory/2124-2-0x0000000000400000-0x000000000046D000-memory.dmp modiloader_stage2 behavioral1/memory/2124-14-0x0000000000400000-0x000000000046D000-memory.dmp modiloader_stage2 -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msmsgs = "C:\\Program Files\\Internet Explorer\\explorer.exe" JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\explorer.exe JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe File opened for modification C:\Program Files\Internet Explorer\icwhelp.dll JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe File created C:\Program Files\Internet Explorer\explorer.exe JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe 2124 JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2360 explorer.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 2360 explorer.exe Token: SeShutdownPrivilege 2360 explorer.exe Token: SeShutdownPrivilege 2360 explorer.exe Token: SeShutdownPrivilege 2360 explorer.exe Token: SeShutdownPrivilege 2360 explorer.exe Token: SeShutdownPrivilege 2360 explorer.exe Token: SeShutdownPrivilege 2360 explorer.exe Token: SeShutdownPrivilege 2360 explorer.exe Token: SeShutdownPrivilege 2360 explorer.exe Token: SeShutdownPrivilege 2360 explorer.exe Token: SeShutdownPrivilege 2360 explorer.exe Token: SeShutdownPrivilege 2360 explorer.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe -
Suspicious use of SendNotifyMessage 22 IoCs
pid Process 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97d8cb0f89b46630b233d89be54c7677.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2124
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2360
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98B
MD520ed142c3c82cfcc728c34821a6db2d7
SHA1387ed47d9c8130264d66a46f0008290439aa1d13
SHA25665b7013f80f1cfd7918e3177ffc2a0f1b05093cbaa1385d5b9aac1926d838fad
SHA512d525acad95c4fbab8933e3c6ac02fbe1ac5c1c2aaf5e12dea96f8a5ae9e709536a9033176622ac019bf149a936d03b1f5b5d6a2b1c89a7553d8c8e64835802c4