Analysis
-
max time kernel
147s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-09-2024 08:40
General
-
Target
e8b9991365eb1ccf3c7bf63b38c35c66_JaffaCakes118.exe
-
Size
296KB
-
MD5
e8b9991365eb1ccf3c7bf63b38c35c66
-
SHA1
35007d846aeff0f7665a8f598f194b7ff5b5ae1d
-
SHA256
1cc1810deeb17985a34565ae1c4d9d2e407a7ee532943a743ca57eac6ef6fa77
-
SHA512
50d1eea3220a3a815600f555a357bccf9079167ccff0fca1a2ff82629b7adcb5d5c2f20d5c9e17afe333215d668bb8e3b969f41ac70af56abc11b4f3dc37bc73
-
SSDEEP
6144:1J/eKIIL4fdyTrluzfd5Y7aDbeuTNQ/EQyRwlrm9ZEOf5KB18F:L/VIILMduydSieupQcLXeOfw38F
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 15 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8b9991365eb1ccf3c7bf63b38c35c66_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e8b9991365eb1ccf3c7bf63b38c35c66_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MSN.exe"C:\Users\Admin\AppData\Local\Temp\MSN.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
276KB
MD52999d89f2036fe02513ec1e103f0ca2b
SHA1e7c88a4a3fd13fd62ddaa14ef66677c22a0b6dbc
SHA2568dd8946b9e8fd9fd7060626f028352bd82f589b75066d6ab9ed8ff6debeb1100
SHA51255e267d4fde8343d3dbf295103f6589a92f329f2f566004ebe8b04998915e365990621c30b45ffae93a39d0a63c952cb0516dcf988dae9d5b433b9db5514e753
-
Filesize
33KB
MD5593ac7212b6ed0b4d06602c0dadcffce
SHA1e4864de9d57a452e0cf50ee3b9a766d24b55eb49
SHA256ed455c47f7b8530f95eec300c4f0196dc38f2a95be07e276659abe332a989811
SHA51258f0973d6a648fef25a1ae01a856d3e55b56511fe0c9af7cfbade8b381f018cd6c1c0ee3bf4783c9da32825415f5727c1df537e5486c43ec983a8d08e13df514
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
308KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
308KB
-
Filesize
56KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB