Analysis
-
max time kernel
143s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 21:09
General
-
Target
ee6dd3e734fd3984fe06f36c1d899c8a_JaffaCakes118.exe
-
Size
312KB
-
MD5
ee6dd3e734fd3984fe06f36c1d899c8a
-
SHA1
b2112136ca92dd45ac51b4155f8a82bb629f91ad
-
SHA256
9646eb19397ed3bf1db4a9ba674ffb9a8373efdc1d4d3f043daa3c82e1daadca
-
SHA512
92d68a81db1d798ff1a05ab152c35701dd8d289412cace29c52938c2b3fcfc69df6763aa062333d73e7d0752671001106627a3193fa115687aa87420a1c88b30
-
SSDEEP
6144:HG377xS2Vp2CeiorXhwTBN536pcCJJvHX1oS:mr7xS2Vp6FwTQbJJvHloS
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee6dd3e734fd3984fe06f36c1d899c8a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ee6dd3e734fd3984fe06f36c1d899c8a_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD57a407316335ce07efbbe72a2cac5bcaf
SHA1694e601de52e514df30bb1d86de644fca4b7f4ff
SHA256903cd78449bf2a75c9a5070c5ddc07eae6eb34dc431a48d943c910b948088ee1
SHA5129231159796519a0150126745d8ea5beccc517c2e4bf84dfae5fbb3700e118924ef8e41b3bb1b7fd29ff08c7b401fa4cddd35889b7bcb6dcc60c3629aabe661cb
-
Filesize
312KB
MD5ee6dd3e734fd3984fe06f36c1d899c8a
SHA1b2112136ca92dd45ac51b4155f8a82bb629f91ad
SHA2569646eb19397ed3bf1db4a9ba674ffb9a8373efdc1d4d3f043daa3c82e1daadca
SHA51292d68a81db1d798ff1a05ab152c35701dd8d289412cace29c52938c2b3fcfc69df6763aa062333d73e7d0752671001106627a3193fa115687aa87420a1c88b30
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
32KB
-
Filesize
56KB