Analysis
-
max time kernel
141s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 20:15
Behavioral task
behavioral1
Sample
1760ef324e16cb5a1a548415bbebfb69_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1760ef324e16cb5a1a548415bbebfb69_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1760ef324e16cb5a1a548415bbebfb69_JaffaCakes118.exe
-
Size
2.4MB
-
MD5
1760ef324e16cb5a1a548415bbebfb69
-
SHA1
c98afef475301ecabad928ebd62e229baefb14a7
-
SHA256
08670d7d07855b5bc374eef63dbbfcde5c3cd72ec0863eb4418feea0bb67c411
-
SHA512
d1a81068ad7a55fd58b1a0bf922a8a2be373a6f93a3802b2c2554268a1f2866ef51873b35ca39f9d8de42a78a671afbbb5203a06c3677e1f32a2446d61eacc7b
-
SSDEEP
49152:RYFBV9nJ5RjGb4sJdCvCzjyCsNftjyCsNfB:RwBV9JY4YdCvCfyCsNfpyCsNf
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral2/memory/624-0-0x0000000000400000-0x0000000000675000-memory.dmp modiloader_stage2 behavioral2/memory/624-2-0x0000000000400000-0x0000000000675000-memory.dmp modiloader_stage2 -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
1760ef324e16cb5a1a548415bbebfb69_JaffaCakes118.exepid process 624 1760ef324e16cb5a1a548415bbebfb69_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1760ef324e16cb5a1a548415bbebfb69_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1760ef324e16cb5a1a548415bbebfb69_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4408,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/624-0-0x0000000000400000-0x0000000000675000-memory.dmpFilesize
2.5MB
-
memory/624-1-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/624-2-0x0000000000400000-0x0000000000675000-memory.dmpFilesize
2.5MB
-
memory/624-4-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB