Analysis
- max time kernel
154s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
11/04/2024, 01:01
General
- Target ec5c6c5ccec12857f59f7b19272538c5_JaffaCakes118.exe
- Size 142KB
- Sample240411-bdql4sga52
- SHA256 00b80a84f335d090efa2b5712d1a07d25a027c0c4790a767aec0f413c249e17d
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- UAC bypass 3 TTPs 1 IoCs
- ModiLoader Second Stage 14 IoCs
- Loads dropped DLL 4 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Drops file in Windows directory 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec5c6c5ccec12857f59f7b19272538c5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ec5c6c5ccec12857f59f7b19272538c5_JaffaCakes118.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1348 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
cmsetac.dll
ntdtcstp.dll
memory/4860-25-0x0000000000400000-0x0000000000450000-memory.dmp
memory/4860-12-0x00000000024C0000-0x00000000024CE000-memory.dmp
memory/4860-15-0x0000000002470000-0x0000000002471000-memory.dmp
memory/4860-16-0x0000000000400000-0x0000000000450000-memory.dmp
memory/4860-17-0x0000000000BC0000-0x0000000000BC8000-memory.dmp
memory/4860-18-0x00000000024C0000-0x00000000024CE000-memory.dmp
memory/4860-19-0x0000000000400000-0x0000000000450000-memory.dmp
memory/4860-22-0x0000000000400000-0x0000000000450000-memory.dmp
memory/4860-0-0x0000000000720000-0x0000000000721000-memory.dmp
memory/4860-28-0x0000000000400000-0x0000000000450000-memory.dmp
memory/4860-31-0x0000000000400000-0x0000000000450000-memory.dmp
memory/4860-34-0x0000000000400000-0x0000000000450000-memory.dmp
memory/4860-37-0x0000000000400000-0x0000000000450000-memory.dmp
memory/4860-40-0x0000000000400000-0x0000000000450000-memory.dmp
memory/4860-43-0x0000000000400000-0x0000000000450000-memory.dmp
memory/4860-46-0x0000000000400000-0x0000000000450000-memory.dmp
memory/4860-49-0x0000000000400000-0x0000000000450000-memory.dmp
memory/4860-52-0x0000000000400000-0x0000000000450000-memory.dmp
memory/4860-55-0x0000000000400000-0x0000000000450000-memory.dmp