Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17-09-2024 03:02
General
-
Target
e5ec659cf211fb86b002bdfc8bafa71b_JaffaCakes118.exe
-
Size
189KB
-
MD5
e5ec659cf211fb86b002bdfc8bafa71b
-
SHA1
036fda53c0696ac9a0e3efb24a9b11460df09290
-
SHA256
99144a3062341ff040436600132a45ba917b8661e4128094e6f0550f7707a012
-
SHA512
b7587b2a63cc9cefb69badcabb8dbdb29fe248518ddd9f95a39e4b1514c2431a04f465391aaf0c56ade5fdaea89cd4033997bb68e9dbeab5327387ec5a9252e2
-
SSDEEP
3072:b/I0NfZAp5tPeAFtzcSsXie+ZZ9w6eo4OxCLzx2g437U:7IsZOnxchSep6eo4OGx2gC7U
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 23 IoCs
-
Loads dropped DLL 4 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5ec659cf211fb86b002bdfc8bafa71b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e5ec659cf211fb86b002bdfc8bafa71b_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e5ec659cf211fb86b002bdfc8bafa71b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\e5ec659cf211fb86b002bdfc8bafa71b_JaffaCakes118.exe2⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD5ba8aaa1fad7e35b86ac143179b1616bd
SHA1b19789ed5256d829596f06d36c2f16dc95646412
SHA256152786dde90388e45c73ce4fd5528ccb11deb2cf1e3a4c62fcb4ebc8fec7652c
SHA5129d6e90450c566df7707062556dc6d0c6ec0b700b604726c62d439377d2a2ab11db04e02af957b10c38eb080c73c4630aaa67b1e59d05414a7bbf4188a10bde5a
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
56KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
56KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
32KB
-
Filesize
316KB
-
Filesize
316KB