Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
29/03/2025, 20:04
General
-
Target
JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe
-
Size
30KB
-
MD5
96edd38829fe0b9921bbfa91cd5e2811
-
SHA1
93d1a44d125b55c8ffe1e0d717821a6c2cbf7cf6
-
SHA256
31cb74b13fd8a47a6695519ef0eb72d58e44cbc20e79f36fdbb76a64932dbfa7
-
SHA512
a8769e9f7d0ec8ec835e736dbcf2b756b9336e734afbeed7cfc506c9464fbe93a1776a08fa2c0efa50074337c3b7bf9839779bab76bf3f6dc7db41db086074a2
-
SSDEEP
768:KhGC2uTOMxIEhhG2mE12HXyCNRewmcsuuM:Kh32bMlkE12CCjewmQl
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_96edd38829fe0b9921bbfa91cd5e2811.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Program Files\Internet Explorer\explorer.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
-
Filesize
4KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
4KB