General
-
Target
74bc321f7ddf5c4cea5ad439ade8d944_JaffaCakes118
-
Size
543KB
-
Sample
240726-tfwj9axhmj
-
MD5
74bc321f7ddf5c4cea5ad439ade8d944
-
SHA1
4c3fa52416095dce153f64bf905a422498219cde
-
SHA256
1a341b6537b59a56e455fd8800f47b3e67ccce248a12ed9d14e6b3357bac58e3
-
SHA512
21c7354c8ae270e9bc983b919c4cbc4a099739a3b19da9b92e8e36177fa98809d758f9e946077238a5481814f56c886cf690dca8386e85320b83fc0c631d48e4
-
SSDEEP
12288:AQ88SoZOf7DUIHa8mZgCO0JF2U/wGiOW1q0RJX5yltD:Ax8SoZOf7wc1mZgCO0/2UsOSq0NG
Static task
static1
Behavioral task
behavioral1
Sample
74bc321f7ddf5c4cea5ad439ade8d944_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
74bc321f7ddf5c4cea5ad439ade8d944_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
74bc321f7ddf5c4cea5ad439ade8d944_JaffaCakes118
-
Size
543KB
-
MD5
74bc321f7ddf5c4cea5ad439ade8d944
-
SHA1
4c3fa52416095dce153f64bf905a422498219cde
-
SHA256
1a341b6537b59a56e455fd8800f47b3e67ccce248a12ed9d14e6b3357bac58e3
-
SHA512
21c7354c8ae270e9bc983b919c4cbc4a099739a3b19da9b92e8e36177fa98809d758f9e946077238a5481814f56c886cf690dca8386e85320b83fc0c631d48e4
-
SSDEEP
12288:AQ88SoZOf7DUIHa8mZgCO0JF2U/wGiOW1q0RJX5yltD:Ax8SoZOf7wc1mZgCO0/2UsOSq0NG
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3