Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 20:15
Behavioral task
behavioral1
Sample
1760ef324e16cb5a1a548415bbebfb69_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1760ef324e16cb5a1a548415bbebfb69_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1760ef324e16cb5a1a548415bbebfb69_JaffaCakes118.exe
-
Size
2.4MB
-
MD5
1760ef324e16cb5a1a548415bbebfb69
-
SHA1
c98afef475301ecabad928ebd62e229baefb14a7
-
SHA256
08670d7d07855b5bc374eef63dbbfcde5c3cd72ec0863eb4418feea0bb67c411
-
SHA512
d1a81068ad7a55fd58b1a0bf922a8a2be373a6f93a3802b2c2554268a1f2866ef51873b35ca39f9d8de42a78a671afbbb5203a06c3677e1f32a2446d61eacc7b
-
SSDEEP
49152:RYFBV9nJ5RjGb4sJdCvCzjyCsNftjyCsNfB:RwBV9JY4YdCvCfyCsNfpyCsNf
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2232-1-0x0000000000400000-0x0000000000675000-memory.dmp modiloader_stage2 -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
1760ef324e16cb5a1a548415bbebfb69_JaffaCakes118.exepid process 2232 1760ef324e16cb5a1a548415bbebfb69_JaffaCakes118.exe