Analysis
-
max time kernel
147s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08/09/2024, 06:42
General
-
Target
d3c4a6a57c91bc8f54ebd945b6dd3437_JaffaCakes118.exe
-
Size
204KB
-
MD5
d3c4a6a57c91bc8f54ebd945b6dd3437
-
SHA1
1cf832a8a5c3370edd541c3fc0282f9d39c3c63c
-
SHA256
d87b37d5346312ccf3b629d2911c8c4802fffa4ad20bfb001ae85cff1186320d
-
SHA512
867bef2d7f34c67b18042c22650085232507b4ef373a1490af8ebd4c287d5b1c0d5a5601a5ae08e530ea0457c41c8ae94247f5edf0d582918d3ed703420e747e
-
SSDEEP
3072:k2WwClXMPvigKs4pkuVlxh5lRCQVG78q1cDTy5724UcihckMOUIVJRkYy:vWwCl8PaBsyVxtVW2nE24PfkLUIZk
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 20 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3c4a6a57c91bc8f54ebd945b6dd3437_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d3c4a6a57c91bc8f54ebd945b6dd3437_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AIMBRC~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AIMBRC~1.EXE2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AIMBRC~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AIMBRC~1.EXE2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD55a9157faaa9e0207d3184496fd8c6e41
SHA131fffaa8810f722fafe0f822f0f4a9f4db81d26b
SHA256fe4324b51047b743519c90d475273e1076d1437820dd35255d0c5341a3dbdfd8
SHA512dd983d25ac60b898fb5f3ed5cbe0afc4e4b9023a1cda5c7fe1a5ddc854c6b3d3639094c9408b6b70a53fc8b3a7c74e7bed005b9c3a2f5348be82ef3cb7729fae
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
960KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
960KB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB