Analysis
-
max time kernel
147s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
16-09-2024 17:47
General
-
Target
e54c0e8588af934fa8f9029f8aa95db9_JaffaCakes118.exe
-
Size
2.1MB
-
MD5
e54c0e8588af934fa8f9029f8aa95db9
-
SHA1
9ea4e7ff2886a076377255e2de9c52a007d8517f
-
SHA256
9552c05cb8f389f918169ba343ed8ee673678e559201e7c9e9c8d60367617635
-
SHA512
bccdca42b602be964f63ac1da4ce1fb9b4904bcb4b801ff22c05543a55b664f9e2bea6929470f000ed26641c7356457711d2b2dbf7411c10a488f3572a07742b
-
SSDEEP
49152:IgNXwsgb3SUpaEt4B3YvksfCuMk2TpRnEy:IgwsoSCNt4B3Yvl/D8
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 26 IoCs
-
Loads dropped DLL 2 IoCs
-
Themida packer 25 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e54c0e8588af934fa8f9029f8aa95db9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e54c0e8588af934fa8f9029f8aa95db9_JaffaCakes118.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD551751db0dd62f407ba18f08273738c6f
SHA1903b80cc66f581f1ee46e5f4ad5c5b9c90e3372d
SHA256dc9fc915708f99f065629300d40e25050512be5d82a06f48fefccacea970155d
SHA51298d35b918433ff76b70f19f1cee63ad490e2887ce7904b57ae3465993b50f395efb55921b8261b1c9354caeb48a664c7663a05003a30b9709297b74ba7323f0b
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
56KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
108KB
-
Filesize
2.3MB
-
Filesize
56KB
-
Filesize
2.3MB
-
Filesize
32KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB