Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
10/09/2024, 11:40
General
-
Target
d83472befc6a5164fe8ba26d6c06e1e4_JaffaCakes118.exe
-
Size
246KB
-
MD5
d83472befc6a5164fe8ba26d6c06e1e4
-
SHA1
bc93750a2c54f5d51784b4c69d56ac2ba70b327c
-
SHA256
6d5ef730dd3d9d5f190bbf6ec34af6c4c593917dda67e2e9c35cd4e5b198626b
-
SHA512
1efdde4798a7b9d5519b55969dc07f8104e1d0e7161e9bb1789efca7bc06f97062dc6878ed03b9dedd9017ec7bacc3e4d5d184fe0e711793e435ca462f06bafb
-
SSDEEP
3072:b3yWdUqq/3sxTFLrfaydCmVhkirsbZntEvdXPBCZZZZZZLDDDDDD7HlnOqO0pcs4:b3ddUd+sgCShZszEJBmHlnC0pKclzE
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 17 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 20 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d83472befc6a5164fe8ba26d6c06e1e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d83472befc6a5164fe8ba26d6c06e1e4_JaffaCakes118.exe"1⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\Svchost.exe"C:\Windows\Svchost.exe" \erit "C:\Users\Admin\AppData\Local\Temp\d83472befc6a5164fe8ba26d6c06e1e4_JaffaCakes118.exe"2⤵
- UAC bypass
- Deletes itself
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
774B
MD50b5265792e906ad9b016e6a4792f27bb
SHA1eca89f4ca1207300589a39b5d30604068ab93840
SHA2565c0b6a1e3745ba5426ef7f24b585f3b5565236fc868d947b8e8ac45cf32835bf
SHA5129aab5a6029fec98e6a25127eda4d29374ca5f8c898565bc464eba1bbcd11a657a7c945f7d74a71f51d890c7cd5e4f2f8de2ca57e688ad96cb8151931a5e4135f
-
Filesize
246KB
MD5d83472befc6a5164fe8ba26d6c06e1e4
SHA1bc93750a2c54f5d51784b4c69d56ac2ba70b327c
SHA2566d5ef730dd3d9d5f190bbf6ec34af6c4c593917dda67e2e9c35cd4e5b198626b
SHA5121efdde4798a7b9d5519b55969dc07f8104e1d0e7161e9bb1789efca7bc06f97062dc6878ed03b9dedd9017ec7bacc3e4d5d184fe0e711793e435ca462f06bafb
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
1.4MB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
1.4MB