Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
24-08-2024 19:32
General
-
Target
bf431a57b9c1e56e7161451e6722ebaa_JaffaCakes118.exe
-
Size
108KB
-
MD5
bf431a57b9c1e56e7161451e6722ebaa
-
SHA1
531fb464e9c0b1009686f64038f3e82bce7a92fa
-
SHA256
c925a08142e38938c60d7cd2c0183749fe979707224b7a1fd1d164514e97245b
-
SHA512
41bf5f4ad9b6d7cddc2158bf33e411f737c8c4bf25b9622cf4bf209dc7c0f3658150c4e8913f11e888e151e5576ddb78f1364262c654a1a66504eb7f7aed3cd7
-
SSDEEP
3072:01+MJKrUnFYY5z1i0Nmbi5fJBNL/Jjoout:kIrPj0NmWtNNjooS
Malware Config
Extracted
latentbot
ibryzyoussef.zapto.org
Signatures
-
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 15 IoCs
-
Loads dropped DLL 4 IoCs
-
UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf431a57b9c1e56e7161451e6722ebaa_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bf431a57b9c1e56e7161451e6722ebaa_JaffaCakes118.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD52c1b6b73da6f51fe2859274ba5190f80
SHA1f458c1e70dcf508493aba27b1588ed727df13552
SHA256283e1619c5449d50c666534f2f4184521183e15b39a36f666de92703ecac1560
SHA5127036c07e23ea8249141f36fd45732b38b7e2109a2a955ac8239ce6dc5936be95aeded2e546256092205ff62d4f09b4568c6437ee4dcfed6de22f5a4916a8a201
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB