Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
07/09/2024, 10:09
General
-
Target
d1afb8abbb2c849aefe1287e24beabbf_JaffaCakes118.exe
-
Size
804KB
-
MD5
d1afb8abbb2c849aefe1287e24beabbf
-
SHA1
548e28251e61b930f2a4708fb2cb3ae0d015f468
-
SHA256
53b65ed186c601fcea4cbc95c701b1922bf1389df1dcb1245006c4aac1c802df
-
SHA512
c564b4f2f19c90d4b2a9ba59e39425726da8d969b16f810227d93774bdf2c57630b52ad32c9ce4234038828ab8cf6f607ed9e8ac87de54bb2a350c4b32813fed
-
SSDEEP
12288:UzarulTjM9OPo0VdfG1mIn0sSelRnlUZrHQ7l9pnhTOgcDiIXbJJvHT:UzaKTjzJH6m0hl9lUtw7l9pcq6JvHT
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 18 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1afb8abbb2c849aefe1287e24beabbf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d1afb8abbb2c849aefe1287e24beabbf_JaffaCakes118.exe"1⤵
- UAC bypass
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD5c91baaedb16f1e649fdcd39a4163a312
SHA1a92d3e33b1ea5a0df1fda481b649f90360f3c2ac
SHA256f8381bf97e0259378598e4ea1f0e5a312a30338d483b39cb10360c0d6c77ae60
SHA512883bae4f7df72bb7f3bbbf7bf748e5b88a5959845ed40b34a35a8c85f697357bd1d2267cb1756dfd8fdc80eb02f991aa26b31e6df95907a3ade40524e4870843
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
548KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
548KB
-
Filesize
56KB
-
Filesize
548KB
-
Filesize
548KB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB