Analysis
-
max time kernel
143s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
28-09-2024 04:18
General
-
Target
fb7d1c076a51b5b38f11de3747b3ec93_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
fb7d1c076a51b5b38f11de3747b3ec93
-
SHA1
4ff46496372ab5d15d2a0d3ef7345a0d062d973b
-
SHA256
e0dc9970bcab8579699aefa136f1ffaa1eef1100fe5b5290bd9afee1d0dac07f
-
SHA512
084d918901454278d1f51e1d0bd8370572191e2205688ae1e02ce49113a681c8adc516b08a3f7a1e1572db6569a68ddf3ba603eb52c1f890a4eb1e5ef34ab95f
-
SSDEEP
24576:nSiOuvRfZ+JgAj/00weVcTS7RssiRZ+VT:rRf4JD80+RZQT
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 17 IoCs
-
Executes dropped EXE 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb7d1c076a51b5b38f11de3747b3ec93_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fb7d1c076a51b5b38f11de3747b3ec93_JaffaCakes118.exe"1⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\mvrsynci.exe"C:\Windows\mvrsynci.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
777B
MD58b9479c20d8436de7a4a200ec706a960
SHA1c477c09fdc223d47a53c4e2c7ab91cb3107e275b
SHA256d78fd5bf448f44efcd0fc2213710efb8ab22584d19bdb023a024235edc5f174a
SHA512a5ec139274415e4f7ccf3cb8ba4a4986c9af8999e9ca559629af9ce4ebb10c4d154d96919e0eb326371e562d1a3f21785514d689b85e08a40d242c13548a3d80
-
Filesize
1.3MB
MD5fb7d1c076a51b5b38f11de3747b3ec93
SHA14ff46496372ab5d15d2a0d3ef7345a0d062d973b
SHA256e0dc9970bcab8579699aefa136f1ffaa1eef1100fe5b5290bd9afee1d0dac07f
SHA512084d918901454278d1f51e1d0bd8370572191e2205688ae1e02ce49113a681c8adc516b08a3f7a1e1572db6569a68ddf3ba603eb52c1f890a4eb1e5ef34ab95f
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
960KB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
1.3MB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
1.3MB
-
Filesize
960KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB