Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13/09/2024, 04:34
General
-
Target
ddaea766555af7970b1fd03874a594b9_JaffaCakes118.exe
-
Size
423KB
-
MD5
ddaea766555af7970b1fd03874a594b9
-
SHA1
57efc17d80a0b3c75b3182f3036e54fc1b650bb8
-
SHA256
4e88ce9cee10a31d3416e85e30a8da824883a90746154c53362ff5b945d86c49
-
SHA512
ac1512ffb575ace196246bac910deefa1b952a16a10aff3e129b750c3ede7d7bbb5cb21bcd90f59d95f629bd206ebfd0f9107ca586e8be61f6ece94b7e797021
-
SSDEEP
12288:HHLUMuiv9RgfSjAzRtyf9/+NV+PdeCg3YQ6zy:btARsmNQ83Azy
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 15 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddaea766555af7970b1fd03874a594b9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ddaea766555af7970b1fd03874a594b9_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Fix IE Utility.exe"C:\Users\Admin\AppData\Local\Temp/Fix IE Utility.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
270KB
MD56537ee1da2211940e4248dd1ef42f66c
SHA1d25d48826214a339a0d13c49f260cbba50ee7ba2
SHA2562716dd203896444df6551fe2fa4c966818d91ceeebfdc0b83bae67a2330824e6
SHA512e88ae4e0906d2032bf55553d8db44fb1e217ce7709a520a97815c6f4380032a542bd9c141b5b1cd21adf0239125ba72a5951d9470a08e4a4d959ed59841acb9c
-
Filesize
32KB
MD50040493dbb4543bf9bb5b7f517b143e7
SHA137960edf7bd3985b86274d72dfa1179b28a1a012
SHA256fc507273ebd3668b1303085d0e8df5a37f0762a9a1ec96b66569874d1a84da80
SHA512d3bc0e630471c06742371786d99c443ae4d30f6509cbf0b691e69669d913c810d33d019e4c14ad34ef9fb7189aac0dd94b7638b855391b28ee89af0d5fccb703
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
688KB
-
Filesize
688KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
4KB
-
Filesize
300KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
300KB
-
Filesize
4KB
-
Filesize
300KB
-
Filesize
56KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB