Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
24-09-2024 07:10
General
-
Target
f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe
-
Size
1.7MB
-
MD5
f3170806e0287d20298a0034618c7a45
-
SHA1
05422b6fff5f944e5bb6342e99d2c263e7e46de7
-
SHA256
43b7d587cb2c56d1736b8e67eadc199aa8487cab43ad4f2bc6914ae1857fb725
-
SHA512
107472be0c7ba7c5927186de9486e8b63c6b8f107cb5c8075c6623a29a8b6e8694eac38547edeba76ed1024cf916f88f7b730430815518fd3744058ff37d48ac
-
SSDEEP
49152:q0vOIoFWabTIegQAvEMxRzwtH6IcuQ30PzV4MI:vYWawegQKvEJDcT0p8
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 12 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 6 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
UPX packed file 20 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xx.exe"C:\Users\Admin\AppData\Local\Temp\xx.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\mstwn32.exe"C:\Windows\mstwn32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\xx.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
-
C:\Users\Admin\AppData\Local\Temp\ducsetup.exe"C:\Users\Admin\AppData\Local\Temp\ducsetup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\chromeinstall-6u18-rv.exe"C:\Users\Admin\AppData\Local\Temp\chromeinstall-6u18-rv.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD58777484978e7741c0630da2df3127bc3
SHA1d7a646404a5ddd280ff9bb1e5f0eee749a7fec74
SHA2563b0e7c69acad31d6404f6bc6124e6f264c856044bce2b30db2ef237ed28a1078
SHA5122680bc559eab130716dc708560d53e6115825cf05f0f074521ab653bac1bcd7c9ba66a0703710a6c13585275226f88817c852732be667079cbbe93db84848758
-
Filesize
898KB
MD5331e1435b63bdea7ac24e1217a05809b
SHA167447b199445d07f1fe6fd3b464cdbb8a50d2ef1
SHA2562152d1f7b036ab09d0a354831e5376e93a1db54d3a354b3c23a844f231403cdd
SHA5129b9780ad36fb7ac07790a0300964bc22c09343a52db39513d016037784f47ad94979ed7a19774678230b11da9d94ae5fa510bf75c32d596ca4beb323dc5e3c18
-
Filesize
668KB
MD543d3cc91d2078ef1b99c913cb9cfe921
SHA163f2655f8852a3341b0b1c8c8ecbea933dc7f25d
SHA256f46b22b0f4e301123e9901d42a32e3ececa1d7839e99a5af6d6470ee45f15651
SHA51262db61c009dd036c73c2bcba64d54bb48facac8d0706cbcb91e9125d2618d8d4f89a8175421105767aa5df9621264a5dc3d55b15d54ad88473f25375c75c2eac
-
Filesize
109KB
MD500311b735e05b1b775ff554eed913675
SHA1a3e884a2a307060e727ab42825ce3949fa0325df
SHA25659de2df15c0ed14a677932bf586378563fd60f116587b29ce54f21b0b9f15612
SHA512b5acfe6f3fea9e9e7da5f77d6bc75753176ba27b8ba2008c9d000f496fff34091f78f61e50e1c2cd905739b96eb9585db19b79fbcca269fb18a9085bcabe1b36
-
Filesize
33KB
MD5695cbf2cc0ad6756bd0094d784fe78b5
SHA162acdf1f09f83c094d861dc181200a96460b36c2
SHA256a9ffdfcfa2a87f4b903acadc325f08e8cda9d0e82a6c8e41b94de54791a86c74
SHA5122c3f6df18964d24fd367892cd092e38aa7a8439309f22d1e44a2d4ae30bdbd3bea51dca88d3a690ed008ae0464378dea7b3a7c7fc41b67d933d2d8182fc6a6b9
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
1.7MB
