Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
09/07/2024, 10:23
General
-
Target
2ffee0549d25705749899ffd40659aee_JaffaCakes118.exe
-
Size
131KB
-
MD5
2ffee0549d25705749899ffd40659aee
-
SHA1
3d9e5c98808d3f5849c9e6297091cd3e31bb00ab
-
SHA256
f844ec58312e82ef971baf66bac74f7e352c40355f61588f4e69f186ef395bc8
-
SHA512
34244dfba32eda76606d26d0f70b187479fdd50e4713875134e408d8472dd0d2367b23a0d5e9116747e327339cd370688498d2601450f4fcfe2f43ff3052b52a
-
SSDEEP
3072:L84G+rAP0gCvpBTnXi0QCrqFfQshCCIAnAh9yxdfZfJL5out:LfYPQvp5Xi0J2QQXu+BlJtoS
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 16 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ffee0549d25705749899ffd40659aee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2ffee0549d25705749899ffd40659aee_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\mvrsync.exe"C:\Windows\mvrsync.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD58173fa0b2a0f8a2043c86474d27700d0
SHA15e0e29a43a271638a53dd4ebbc4043ac34292dd7
SHA25642dbcfd33bf1d634fd8c1591a903c283689f71147b8d1491029dad154d59c5eb
SHA512592ff0061d87fafc6c2a5c3bae1f51264bfdf7b9adaecd54dee2763065d3e8fa5c7a58b964faddc12146e2bb9b71b186c61318c22da765d377f6d12202c0e92d
-
Filesize
7KB
MD54e390e571995682798626a5e23d45629
SHA15986e1578878c1c3c7f0d9a224946b17fc2e7b0f
SHA256fa00c11a01a9c4db01bbb76d0d80e12a69a5f9f45f5c295fed3d4210418f4940
SHA512d2e11ac01d6348f6cf82995767d13f9c8e687a35b2715021568a366a7d81eb5fd25f1ca9d8cd1da63f79c6eda5c8ae396a09fdfae79e66c054e7404339953b9d
-
Filesize
131KB
MD52ffee0549d25705749899ffd40659aee
SHA13d9e5c98808d3f5849c9e6297091cd3e31bb00ab
SHA256f844ec58312e82ef971baf66bac74f7e352c40355f61588f4e69f186ef395bc8
SHA51234244dfba32eda76606d26d0f70b187479fdd50e4713875134e408d8472dd0d2367b23a0d5e9116747e327339cd370688498d2601450f4fcfe2f43ff3052b52a
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
56KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB