Analysis
-
max time kernel
142s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
19-07-2024 06:55
General
-
Target
5ae3cafa3421ea2fb73b1648e20e5597_JaffaCakes118.exe
-
Size
785KB
-
MD5
5ae3cafa3421ea2fb73b1648e20e5597
-
SHA1
65e7f9b3e7456b9f525eb99d6b23a4713c27f22d
-
SHA256
350b3401252bc6dda2c95606516ea43bdf08a54513e5cec21e55ded632e8b73b
-
SHA512
003b5a7305b8311fe81305d057a255f7b3cc6caee29adf5bf0beeaed1114a4d1ad373b1bdb8b581369768a97e0114b5e8a5c8b7f4705c8f8dcee7b7f66be5281
-
SSDEEP
12288:u8/iRtoxzCImiq4LSnziWHs5RFmO6lQOzEme4yV7rjmlXWAK5gWyMwYncq3g93i:uSC2xzCeSqrzgTz2vVPjml5n8ND3g9y
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 25 IoCs
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 2 IoCs
-
Themida packer 26 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ae3cafa3421ea2fb73b1648e20e5597_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5ae3cafa3421ea2fb73b1648e20e5597_JaffaCakes118.exe"1⤵
- UAC bypass
- Identifies Wine through registry keys
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD5225ffa77917031a41828c75340ab35d4
SHA12dcb6f42aeed35213b0674ed4e95f8c31bb48075
SHA2565e4ea05c862d681cea705afc8a6bfd15d9defa41696f4c3fc93302f9d421ea08
SHA51206a3c412a92411c0d7e94562e6f66035fd0a4e41d4165b3853b72e98cc9bed43e078884fffc8dc694aeb0de71c740798bda68b50f0ef9e715c97c2013ea25be0
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
1.6MB
-
Filesize
32KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
56KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB