Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
31/08/2024, 13:29
General
-
Target
cce4b0bc4b6262a2da88040db894e7a5_JaffaCakes118.exe
-
Size
270KB
-
MD5
cce4b0bc4b6262a2da88040db894e7a5
-
SHA1
fa8f6d0f0b7128e27b7cbd050af70b30e22ff453
-
SHA256
11a769568692bad35094efbb3219542fec7ae55d7e92a7b98a52fb56123bae46
-
SHA512
26f837b86ff1dd33961fce275f111b6ca52245d4b9ca57bdd2c1f62aa83a3ff80ce8a199028bac3f9baf8509c9fbc831dc4b8126c5f18884e8c10a482649e5dd
-
SSDEEP
6144:qGyjnBSkuV1d4eZd88ORJIf/wTB4R53Eupc:5YnBSkuVUeZdYqwTK
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 14 IoCs
-
Loads dropped DLL 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cce4b0bc4b6262a2da88040db894e7a5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cce4b0bc4b6262a2da88040db894e7a5_JaffaCakes118.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD50428c6b1f342f50a3914165b0fb5458e
SHA143d9794abafcb0e22476ffb839dde7ba742be9b0
SHA256e611c61aeaef32fe2081afd56a2f03f81c41a605f9e8726a04014998976284d9
SHA512d8f6f3435b8137141b05916c8870e68340c25600dd9bff34b96831cf1a197eabc876ed7d0ca5d2ecaac8a1cf025396796897e596b022ad1d69d713d2413c5df2
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
960KB
-
Filesize
4KB
-
Filesize
300KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
300KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB