Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
12-09-2024 06:02
General
-
Target
dbf230bc00d136b4455dbf7c502f4e05_JaffaCakes118.exe
-
Size
319KB
-
MD5
dbf230bc00d136b4455dbf7c502f4e05
-
SHA1
07d94205cf3bc8b6245e17a91236d59d5004576c
-
SHA256
13f7e100f306b1197f234e33bb37474bbe926073ab404858b49c0ff00a4f2758
-
SHA512
b4081f493a08bf417a58cbf5f3895f0fdbbe36dfb6f7c953e00060f657e93562407519e386d2634d82afa201b4578818b3df41ae56542cc835c8c0e76b2b0cc3
-
SSDEEP
6144:iGyjnBSkuV1d4eZd88ORJIf/wTBt53Ypc4P0oS:xYnBSkuVUeZdYqwTaF0oS
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 2 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbf230bc00d136b4455dbf7c502f4e05_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dbf230bc00d136b4455dbf7c502f4e05_JaffaCakes118.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5532268d017fe575b19c1cfcabdee4237
SHA1107eb8fb817c09c504f0c60b4e2180b301435b74
SHA256be3e446e1486df23a2507956ad01e89624c76d6842019ea7a4ef5ca13c28f631
SHA512114922c78e6f8d4980c79b94142a7b2d5b46aae3e2988c85093c54f1a58a8fb54931a2375549eaa782e15270234660a5590b2c70c2c776488879cb2014c95d5d
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
332KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
332KB
-
Filesize
960KB
-
Filesize
32KB
-
Filesize
56KB