Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19-09-2024 18:44
General
-
Target
ebf86e06b3e60eb7989e8360c584637e_JaffaCakes118.exe
-
Size
207KB
-
MD5
ebf86e06b3e60eb7989e8360c584637e
-
SHA1
2f314e2cc1c0584e6119c24550d1d90d253b4eba
-
SHA256
75427846d6a5f1318d86c73853dfd10398079b9953a7c430a2dde36d801c792b
-
SHA512
2ab0fa898a052b3983e13c8d8b9c8a0d40e8bc378ad4f9fae2d679eaf2eee98102d6a2288a5b98539135758044f5711935bc058758fa6177ac6fcb785dbbaa68
-
SSDEEP
3072:i1+MJKrUnFYY5z1i0Nmbi5fJBNPmUpQzkkoutn7:iIrPj0NmWtN3IoS
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 16 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebf86e06b3e60eb7989e8360c584637e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ebf86e06b3e60eb7989e8360c584637e_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD54ba40f1bfe03e3f481a1ab033d12ec55
SHA11f81d0d36dc169066e08b056d874708358f9c229
SHA256be8e03ac5012a147d4d37c83811fc98841ab47a60181981e1a0b01bfeeeb171b
SHA5128117fb944b30d6756e9f834d8f6ab40992f54db9008ecac92922a0e1f3699049eb78169a9841c02aca0778cd0c3df4ce562cd258ee21487c7342329b0685175f
-
Filesize
207KB
MD5ebf86e06b3e60eb7989e8360c584637e
SHA12f314e2cc1c0584e6119c24550d1d90d253b4eba
SHA25675427846d6a5f1318d86c73853dfd10398079b9953a7c430a2dde36d801c792b
SHA5122ab0fa898a052b3983e13c8d8b9c8a0d40e8bc378ad4f9fae2d679eaf2eee98102d6a2288a5b98539135758044f5711935bc058758fa6177ac6fcb785dbbaa68
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
4KB
-
Filesize
512KB
-
Filesize
32KB
-
Filesize
512KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
512KB
-
Filesize
56KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB