Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/03/2025, 20:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe
-
Size
30KB
-
MD5
96edd38829fe0b9921bbfa91cd5e2811
-
SHA1
93d1a44d125b55c8ffe1e0d717821a6c2cbf7cf6
-
SHA256
31cb74b13fd8a47a6695519ef0eb72d58e44cbc20e79f36fdbb76a64932dbfa7
-
SHA512
a8769e9f7d0ec8ec835e736dbcf2b756b9336e734afbeed7cfc506c9464fbe93a1776a08fa2c0efa50074337c3b7bf9839779bab76bf3f6dc7db41db086074a2
-
SSDEEP
768:KhGC2uTOMxIEhhG2mE12HXyCNRewmcsuuM:Kh32bMlkE12CCjewmQl
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral1/memory/2316-2-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral1/memory/2316-4-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msmsgs = "C:\\Program Files\\Internet Explorer\\explorer.exe" JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\explorer.exe JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe File opened for modification C:\Program Files\Internet Explorer\explorer.exe JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe 2316 JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2868 explorer.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 2868 explorer.exe Token: SeShutdownPrivilege 2868 explorer.exe Token: SeShutdownPrivilege 2868 explorer.exe Token: SeShutdownPrivilege 2868 explorer.exe Token: SeShutdownPrivilege 2868 explorer.exe Token: SeShutdownPrivilege 2868 explorer.exe Token: SeShutdownPrivilege 2868 explorer.exe Token: SeShutdownPrivilege 2868 explorer.exe Token: SeShutdownPrivilege 2868 explorer.exe Token: SeShutdownPrivilege 2868 explorer.exe Token: SeShutdownPrivilege 2868 explorer.exe Token: SeShutdownPrivilege 2868 explorer.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe -
Suspicious use of SendNotifyMessage 16 IoCs
pid Process 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2316
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2868