Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
28-09-2024 12:13
General
-
Target
fc460f92a64d39153db863a88e56686a_JaffaCakes118.exe
-
Size
138KB
-
MD5
fc460f92a64d39153db863a88e56686a
-
SHA1
5e519782a40c8448b7b4c8e3a63cc070f4849b35
-
SHA256
851ed0a017d1df9b77f65cc66e6ef0684fbeef9dfdc29b2ac0f030a13956a18e
-
SHA512
31d1090e72260d626f794d89e7316594c26dc35e7f8dc553338b8410d1732fc09d490cf93ed6a38fc347922256323d6b0c1e73f853aefb73e69cbb30a38c12c3
-
SSDEEP
3072:pNwpEBhzrbvCHXlZc6S3nhstA/u4X9mFV/yxAkHCMLKbhHLzjNODc:ThzrDGXE7nhstUtmFV/JqC2T
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 15 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc460f92a64d39153db863a88e56686a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc460f92a64d39153db863a88e56686a_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5c200deb575126b97609d020897aaa5ac
SHA19d086f32f5e6a134c5a9dffe35d29c2a3261a42f
SHA256a4a0c6545cd3990fcfb973ff5b76517520edf142d9f09fbcb118c92574ed2762
SHA512c8040e3997967d4c25401b53b9fb97545709829876031cdd985c46cf0cccb467a546c8563441b2fbe2e03de0c9829732a345eb629e2eb2eecb87026794e4b7d7
-
Filesize
138KB
MD5fc460f92a64d39153db863a88e56686a
SHA15e519782a40c8448b7b4c8e3a63cc070f4849b35
SHA256851ed0a017d1df9b77f65cc66e6ef0684fbeef9dfdc29b2ac0f030a13956a18e
SHA51231d1090e72260d626f794d89e7316594c26dc35e7f8dc553338b8410d1732fc09d490cf93ed6a38fc347922256323d6b0c1e73f853aefb73e69cbb30a38c12c3
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
440KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
56KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB