Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
11-09-2024 15:37
General
-
Target
daab2f9d6999401781c20e5bc0647dea_JaffaCakes118.exe
-
Size
337KB
-
MD5
daab2f9d6999401781c20e5bc0647dea
-
SHA1
7f990620bd6f31b3fb3da8d8c18b954ab90cd34f
-
SHA256
6310ec3f7fb15835ab9e627f13f4a28c6236e07488f35b6e8dfd4742aec2c2f5
-
SHA512
f537a5ebf0ecd8a936332afecc4faf55d7c4166009d834a85991a7ac44ad5c697e5ccba14b579a8aea88001efbaa53b949ccabb11b80037c2d489a8e4831383a
-
SSDEEP
6144:dBNlDX3C5F9kk6op30syEV9+mNxGIrPj0NmWtNvUnoSW:dBPDXS5Dkk6op3+EGq0Nx8noSW
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 15 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 7 IoCs
-
UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\daab2f9d6999401781c20e5bc0647dea_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\daab2f9d6999401781c20e5bc0647dea_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\msx7EB1\dfdf.exe"C:\Users\Admin\AppData\Local\Temp\msx7EB1\dfdf.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD53c2a3925e83ad16d471d026c7e7b5088
SHA151649239a4ec3fc034e00a98c1dd7c91acad4947
SHA256b42d3bd429db93f6b09ccdc587ca0aff47088e7a965b8f4443e55c7d1e7a8002
SHA5121d340a881f15e007996567597ddd9de3d039e52fc306eecb68a5b068495290f267bc009f7fec24de0800135a19d15df00001b75719dff7010224370f1f2df882
-
Filesize
109KB
MD51d38c8c2eca91b6f6c422d509178b05c
SHA1919102985834f0cb3069d7ade1f05127c5c35354
SHA2561155f88ceee3ca1c11ee3e356420996ccc4d053e8b1538b0196855572cbe66fe
SHA512b9d002a333c367f2aa39e477f7cb1695a39785324a594e5a4cfc93ad276edf4c2cde5e113c57fd2588b1bcf9f435992fca5d1f53146785d3f2b4a89b50d11152
-
Filesize
32KB
MD5889ff60934681dfd9b63972ed9f28170
SHA117dab79117f3751896f0d1b428b6e021dd300ec6
SHA256be895f8877128467b05eaeb04e61d197725884bae09dac1985b3468b1decfed4
SHA512c6e75f49d0198d8762dddc475af5cc6d315bd3eef17615814bc3d0e2ec933cdf8734fce2531cf5f1578ec45be9acd8e399ddd78e68b8e7969ebf07f64966f34d
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
320KB
-
Filesize
8KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
32KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
