Analysis
-
max time kernel
95s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
10/09/2024, 08:56
General
-
Target
d7ee5e722cccdebe1884ac702230b3f5_JaffaCakes118.exe
-
Size
95KB
-
MD5
d7ee5e722cccdebe1884ac702230b3f5
-
SHA1
5b9d5ed8927a019dad2cbb40caa5fa43ec4a601f
-
SHA256
d4bd7d12511cfab6322192e115857c42bdc6f4acc5e24780dabc4a8ebcea45f7
-
SHA512
521ac477a37583a8a11783291eabae728bad43a71593a64e6da0e1dd1c93aafabb1f248010d66df18fc15f0eea93a0d8d3cb91d7bfbc60e33be46728f59e48b7
-
SSDEEP
1536:TjSVLEGCMPVBXaeoUVZRiwyMecWQTMzpT7ftWXdkzyk1Er931eXkr7dW995NIwnL:TjSq0VBXLtU1cW+KBwXdBd1f7Q9nawcq
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
NTFS ADS 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7ee5e722cccdebe1884ac702230b3f5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d7ee5e722cccdebe1884ac702230b3f5_JaffaCakes118.exe"1⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
400KB
-
Filesize
400KB