Analysis
-
max time kernel
141s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08/09/2024, 13:10
General
-
Target
d46fbdecba50489c075431a4cca631ec_JaffaCakes118.exe
-
Size
443KB
-
MD5
d46fbdecba50489c075431a4cca631ec
-
SHA1
b7bdae7f08f58ec3b34e9f05227f09f29603b59c
-
SHA256
3400bbdee0568fee765d138e26038b1a8b1d301158f81fb8ba4326a4321101b3
-
SHA512
583cb69cb4e8e11cd61418103771bd3ee84a3fda41d1484e0d7eb0061cc4e881df512523d70774a209e5428b1ea805e90acddda6dcf7ea9fa0036add6361a7c3
-
SSDEEP
12288:zq0NxCsboStLn8V3EGAJi/WIFUucb/UrOPt:zqOksHA30QFiFt
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 16 IoCs
-
Executes dropped EXE 2 IoCs
-
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
-
Loads dropped DLL 8 IoCs
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d46fbdecba50489c075431a4cca631ec_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d46fbdecba50489c075431a4cca631ec_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\knightt.exe"C:\Users\Admin\AppData\Local\Temp\knightt.exe"2⤵
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\knight.exe"C:\Users\Admin\AppData\Local\Temp\knight.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD516a399723e66845fe21bdbfed806ac13
SHA1821eb9dff394955ef8f825b2fadde6d9feecc6fa
SHA256a5385e19691b5b78ab2239d2f786d16fd6cb6ef74809dbf4d1f3ca343cbcd6af
SHA51247223f1e2f19b9fbc1b99b9ae37c4977c5f0867299b94e93f7dbe6c33112fd8248f5fea39476a7ab4f7b0d676903a500f02dbfa7fc84fc70cdb21b10dd22feaf
-
Filesize
108KB
MD5756e0c180f495e03c7298ad820a32345
SHA12b254e949926500802e6855c7a74af5f1ecfce0c
SHA2561c43f6f606746fb641217ee42e1ffbb2c0e3bc1f7bcbc9fbbf470b91c436839d
SHA512cf33731094a91528b20487fb017dd2df981c0cc0febc97cb07ddc15350e0d1019d887c35ca3aeae898e64ad75791609a02d31d6660f3b5ba4d79990edeeb4d5e
-
Filesize
307KB
MD5a679feacb2b21d1c4aedfed0177688ac
SHA1ecd6b113eb31585342119d535ea2ba578e6de215
SHA256cfc32d37a459dff41d4b705d82b70b2d3bb48395886c2737c62c92e1cd286729
SHA512689237ef2c22179353d6d002ec8dc07d7f109a019c962a7415cc4f8ac9bd67be204699993c7d94d964725d0af4e5faad441d5d738ccdfbe1c5c1104abda231c8
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
56KB
-
Filesize
780KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
780KB
-
Filesize
48KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
780KB