Analysis
-
max time kernel
140s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
12-09-2024 20:22
General
-
Target
dcfcf069efecb58748649ba124075825_JaffaCakes118.exe
-
Size
138KB
-
MD5
dcfcf069efecb58748649ba124075825
-
SHA1
1719f3267a39ccbca9b1418d484967a526c58790
-
SHA256
eec87dc9b4f106958348e2f6837a443408199248b51f16b9edce876a589c8f75
-
SHA512
25e61eefd6cde8cb6af235ee9593451c25c1a8eb8546eb11fc250afcad1efaa56627134b028bbd1d79573734d62e65c317a3e838e3d841b98a7462268522e2b4
-
SSDEEP
3072:sXe+egc8/u7pK+S4Z9agxLWyEmup0EBRBOI9CftDFILS:ubZ27p84Z9agxLW/OI9CL+
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 19 IoCs
-
Loads dropped DLL 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dcfcf069efecb58748649ba124075825_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dcfcf069efecb58748649ba124075825_JaffaCakes118.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5dd9507b8b41e6e7136f39c08fb0e385d
SHA1f393b678700b01c14148aa51efe89a5acc7ab48c
SHA256f9884ba153a5ca76b85ce39626f0240de42dd2a081c22b3df5919280d1f0e82d
SHA5126ada9e17f6320fc58b31f16b7f16f5901d4817bf42ac79a7f5fc16d635ae176a25e776917bcfa43a7e9d4a6acae72b5fdf0714d1fdb3c833d56cb43a5bfd448d
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
32KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
4KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB