Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
30-09-2024 23:30
General
-
Target
039def375458b49a8bf7432f0902c511_JaffaCakes118.exe
-
Size
111KB
-
MD5
039def375458b49a8bf7432f0902c511
-
SHA1
c730030fe400b7aa7a19f9de918182e314eeeb5f
-
SHA256
e428887a9595d30d2eed571b63588530ce6799a66e7c2852c35183c730068afe
-
SHA512
d8e8fe202f5e75c0692af4c02cc8db65e1bf39173375bab687e84771e92b0065bfd3e45b8d3290e4e3cd5d0218569d1b91c46acb58f5590f7f1ef601a3e12365
-
SSDEEP
3072:moy8j7VnNdrPHaSekwi+mW+2lAzO6105/3out:G8jZ7rvaU3+mWr/6gvoS
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 15 IoCs
-
Loads dropped DLL 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\039def375458b49a8bf7432f0902c511_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\039def375458b49a8bf7432f0902c511_JaffaCakes118.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD58bb6e52aa875e133861987151752a583
SHA1b8cc68e9af3a80e51f36dab1e96fa60e9d9f3043
SHA2566bbe4e3e36dd169cfd8286350f8b92adaf707b8ce47a3277db13727a4a052794
SHA5120024ca45d33af318683a895dc87d0397f6939dfd035c2f70c6a3537d1d27182a9e3c9156e6f5f32d84c233d72cca41d7489656d8e9fe38daf795e523b6e374cd
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB