Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
22-09-2024 13:30
General
-
Target
f21d68148deff93a17a339c28c8eca38_JaffaCakes118.exe
-
Size
288KB
-
MD5
f21d68148deff93a17a339c28c8eca38
-
SHA1
49cc7ac4d643340db8eca92ba1959987d2fd874c
-
SHA256
e9f3533696cedee49be4dcbcffea540f3462c780923f424f26736a9bc8962365
-
SHA512
3765760f36dd9804aceda46c9ff1c1a3b748b729034db00e7671248d40ff0b3a45b044cca6d8bad7ca657cb13eaac1eb3d7f5913aea6e92403819f9af3132222
-
SSDEEP
3072:+8n5i7vlWw+IgDGD7m//iTnqpdH9kDv+p89aR4igbkgmZNTBfD7Bvg+d+3Np54:J5i7vs2MS7mirpKp8aDglSNTB3fSf54
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 16 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f21d68148deff93a17a339c28c8eca38_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f21d68148deff93a17a339c28c8eca38_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\msngsr.exe"C:\Windows\msngsr.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288KB
MD5f21d68148deff93a17a339c28c8eca38
SHA149cc7ac4d643340db8eca92ba1959987d2fd874c
SHA256e9f3533696cedee49be4dcbcffea540f3462c780923f424f26736a9bc8962365
SHA5123765760f36dd9804aceda46c9ff1c1a3b748b729034db00e7671248d40ff0b3a45b044cca6d8bad7ca657cb13eaac1eb3d7f5913aea6e92403819f9af3132222
-
Filesize
7KB
MD5d667884e3938200ecbcda4aeb2a087ba
SHA11e34726204fd71edb5d8f1d22c63c67224feac6b
SHA25642255943c850e10bab5900e3c9ebbf0da4ac1632dce4733e5e22fae3020d4d58
SHA5123ed6ca048988e2e7e0dda5e31cbb116c43d007eab4428c1f94d0497bf8297606c65dd85ac148846a701a5695a89e69f64a058f4c8fe7f94de8661e1ecf7a9a85
-
Filesize
32KB
MD5d5b11c8111a08adf5dcbc38d82b4b0d6
SHA1718e80f3fdaf46df7b426fa915e8da41c6a891cb
SHA256e0c14cee17036c09b108c3e5763b51c56c7a5cd8050b55dcb2e80f5f7d80c769
SHA5127e4a3903f6fd356cb23c9fd5d28a75586a59d0c1a27a402a8ed52d1d8ac9de989767272d1eb263049df7d45a02526a241223d38e55cd03f12c11be56387a00c9
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
32KB