Analysis
-
max time kernel
149s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
18-09-2024 07:34
General
-
Target
e89e9384f008f59ee05f5017c0e9ec80_JaffaCakes118.exe
-
Size
795KB
-
MD5
e89e9384f008f59ee05f5017c0e9ec80
-
SHA1
d11bbf9c0fb5b72efa7bee4c0f0860e6215bb125
-
SHA256
cfae8034fef45650738b4bd719f9f492b252879722a19440e246635d4416e9b3
-
SHA512
b095cc7525a670fdfb9662ec07490d19095c4341f94938d6a41eb4cb14ae09767b64d6f691ef77b7bc4e3a80b6da2726bf71efbd7488e94614f0c53c0ff2676e
-
SSDEEP
12288:oIIQ4Jqe5+MRg7GzIXdqis7Ykorby/dRUixCOwq/lKILl/SaMpoKGz:oEve5+1GzSdqDofy/dmixCI/lHJk
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 29 IoCs
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 2 IoCs
-
Themida packer 29 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e89e9384f008f59ee05f5017c0e9ec80_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e89e9384f008f59ee05f5017c0e9ec80_JaffaCakes118.exe"1⤵
- UAC bypass
- Identifies Wine through registry keys
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD54a6ad2e0c289e22b2d4219c778a42f57
SHA139480642f57dc5a74a3b498a5705fe31df750f2b
SHA256998404b26fc79cd11f29eac0c0d850c2ffbef7e8892929dc515926f13e52aedb
SHA512a91b6067e9cd384358dc9f2b01f20d3316995505586b08b854712d2ed465f1e052eec997b493d0087ecb2e723962458ca157ab27c7a235d330203bf6e8a00bb6
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
56KB
-
Filesize
948KB
-
Filesize
108KB
-
Filesize
948KB
-
Filesize
32KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
56KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB