Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 06:45
Behavioral task
behavioral1
Sample
192a90bced8e9129ebb06cf4a16dead5_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
192a90bced8e9129ebb06cf4a16dead5_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
192a90bced8e9129ebb06cf4a16dead5_JaffaCakes118.exe
-
Size
5.5MB
-
MD5
192a90bced8e9129ebb06cf4a16dead5
-
SHA1
ad57b451cce4484c58804baa4a396078ad18d893
-
SHA256
31fd8cfeba3c744c0a94d62b8d9115514cdb3c398d213264a94ccae72c4ece99
-
SHA512
4e4847fae4c47c243220a56a939a07b756e2d58cf15b51420edf121dab60352c5d6ad97aeaf0ee11055dc590fc91c92ed3e8d97e8e825cb710d2f61c7b5df1b9
-
SSDEEP
98304:UVxWnBkUqJoWdhe3sL7WKRZSwDf/8dpupEakkQ:UV0kRJJh2GCKxDXKUpE2
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader First Stage 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2924-0-0x0000000000400000-0x0000000000977000-memory.dmp modiloader_stage1 -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
192a90bced8e9129ebb06cf4a16dead5_JaffaCakes118.exepid process 2924 192a90bced8e9129ebb06cf4a16dead5_JaffaCakes118.exe