Analysis
-
max time kernel
141s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-09-2024 05:24
General
-
Target
f15c1e96f902e16e171b14623835cf07_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
f15c1e96f902e16e171b14623835cf07
-
SHA1
13be5000fd6e2f0accfb51372d65830c5dee454a
-
SHA256
01fee8c117a98181f1308fc8cde7baeeb9e74975ae59d4c1208ae033d4f06818
-
SHA512
5cc8e399bd7aa3c9989152c6e0a1a4e21476fa1a5e248f10c2285628fb9aac11084a82f32ba52e40922f3cc47cead02193d59fbbc7ef4ab993f212b051c0a317
-
SSDEEP
24576:dsr2gVyCGDQJ4b4d51CwL0B+NwZokqrqvm13na2Waf/mbXbs3aEq:OJ/d5/gkNAokqr713nHWaf/mIaEq
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 23 IoCs
-
Loads dropped DLL 2 IoCs
-
Themida packer 22 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f15c1e96f902e16e171b14623835cf07_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f15c1e96f902e16e171b14623835cf07_JaffaCakes118.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD54d770d1b8709fa4892dea04979a6f06f
SHA172907fb96122337dadbb11f4c906db77d2ca82d4
SHA25666d18a70288867b9ad479b25c89f6bf9870cf4523bd08618ad9b66d6e9ea0659
SHA512eaa8009f7a8771bdc59e5aaff53acae6b1f735a51d1627f0dbeea65b399404ae49327a7a42e92448ea4839df935aea86ffdf924f6bc8f774835cc873e7409d40
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
928KB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
4KB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
108KB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB