Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
08/09/2024, 14:06
General
-
Target
d488f9d7edfa1af1b0e9d104f341d1d6_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
d488f9d7edfa1af1b0e9d104f341d1d6
-
SHA1
50a2b043d39f6344b8b111ebe01ba5817a2808c9
-
SHA256
159d6e7fc6277b76afc8ef6c8d172cd95233be4bea4a2c14a4e4f21569121aff
-
SHA512
07f51de0cf823cdfe521d347484657b2b076b3240d2e5cc5b6273f46339245bca4d52a16b6035347c36775cebbc3496168cf4b76f562f4c0a01eb0b62ea5425d
-
SSDEEP
12288:9r7xS2Vp6FwT3HbJJvHvoSQV0nuKGQZh:fS2Vp6FwTFJvHKpKGQH
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 2 IoCs
-
Loads dropped DLL 4 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d488f9d7edfa1af1b0e9d104f341d1d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d488f9d7edfa1af1b0e9d104f341d1d6_JaffaCakes118.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD5935ee6cdb94ea5048aef7a33303c69c4
SHA124e0923d80ceec7d288585788f44cd0b0475713a
SHA256e9f75bea6ecac11f1aad7fa5c46578cb3f0a9714791a2cba36ab276897edbe24
SHA5123f6f73dc41a1eec3aead0f2f05a2e8d7dcb7fa3a3651976e75a41ba597623b507c91b5ecbea2af0e0f624831536f7cc8ad43aebf17a97e8ebfb4d842aae791ff
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
32KB
-
Filesize
56KB