Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
24-09-2024 12:00
General
-
Target
f398517a15895995c3cff9134fda0c02_JaffaCakes118.exe
-
Size
683KB
-
MD5
f398517a15895995c3cff9134fda0c02
-
SHA1
ae3b41bda142f50f4cf3a9f697ebf6416c2d5180
-
SHA256
11d3325cffe09e9e836d8fd9047b540435f53651f8e2c03485e45061917605e9
-
SHA512
acaa2d692b10a7c746d3f8c2ccac5f114d80a5d3929bbca9674001aee134f86daba61773fde1f3a586150c3f31eec0aa5ebdf4833a1620c4386e586c166731e6
-
SSDEEP
12288:Ij8qn0fOacQv+rxMgXVUgG1d8iAcdB9VtOlVZBpY2xJX9fmgZjD74:Ij8q6iC+rxMgFU78iTVeVG2jtbhU
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 22 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
UPX packed file 14 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f398517a15895995c3cff9134fda0c02_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f398517a15895995c3cff9134fda0c02_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\XXXXXXXXXXXXXXX.exe"C:\Windows\XXXXXXXXXXXXXXX.exe"2⤵
- UAC bypass
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
683KB
MD5f398517a15895995c3cff9134fda0c02
SHA1ae3b41bda142f50f4cf3a9f697ebf6416c2d5180
SHA25611d3325cffe09e9e836d8fd9047b540435f53651f8e2c03485e45061917605e9
SHA512acaa2d692b10a7c746d3f8c2ccac5f114d80a5d3929bbca9674001aee134f86daba61773fde1f3a586150c3f31eec0aa5ebdf4833a1620c4386e586c166731e6
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
56KB
-
Filesize
988KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
224KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
296KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
224KB
-
Filesize
988KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
64KB
-
Filesize
988KB
-
Filesize
296KB
-
Filesize
988KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
68KB
-
Filesize
68KB