Analysis
-
max time kernel
147s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09/09/2024, 14:02
General
-
Target
d67697ab632ca5f62471eef288d2b5e7_JaffaCakes118.exe
-
Size
270KB
-
MD5
d67697ab632ca5f62471eef288d2b5e7
-
SHA1
b9fd67f900fd8abe27582a002df6efbfb26c5dfa
-
SHA256
baabbbd11ccba0d1f0fb35a1b5b5866f9a477b3c50eec3d313fd112d48ecc9de
-
SHA512
d363330892472b9f8eeebb1659dfe8fa6c186097bc58384c1afb143817612af1c76931dfe8495657df40e3201495650be5788b9eb3fa277fb518bc0ec523fef0
-
SSDEEP
6144:KG377xS2Vp2CeiorXhwTBOz53SzpcCJJvH:Zr7xS2Vp6FwT3bJJvH
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 16 IoCs
-
Executes dropped EXE 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d67697ab632ca5f62471eef288d2b5e7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d67697ab632ca5f62471eef288d2b5e7_JaffaCakes118.exe"1⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
270KB
MD5d67697ab632ca5f62471eef288d2b5e7
SHA1b9fd67f900fd8abe27582a002df6efbfb26c5dfa
SHA256baabbbd11ccba0d1f0fb35a1b5b5866f9a477b3c50eec3d313fd112d48ecc9de
SHA512d363330892472b9f8eeebb1659dfe8fa6c186097bc58384c1afb143817612af1c76931dfe8495657df40e3201495650be5788b9eb3fa277fb518bc0ec523fef0
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
300KB
-
Filesize
960KB
-
Filesize
300KB
-
Filesize
32KB
-
Filesize
300KB
-
Filesize
960KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
56KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
4KB