Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-10-2024 22:10
General
-
Target
83b49c34f9755bccc851d9c4e880f8ec_JaffaCakes118.exe
-
Size
137KB
-
MD5
83b49c34f9755bccc851d9c4e880f8ec
-
SHA1
3735c90eecb12c7d9b5d49b5466823757760c286
-
SHA256
e6a370939a91855426d62d9673f45a21537e71a0569309fd695f63dffec33f32
-
SHA512
9c74ef793a26c51ab9ba7ebe70b38cf013c32bdb2a99b4b607971f49a90ac3edf1b8ebe9de19c9e328be7fa62ebcaa96438499f21002b18d28aacb90c36657b3
-
SSDEEP
3072:NQF8b1RkJpKUsmWt/Gljj0lyXi6rwKSeEDU5uLdiMekkvYildDQIr:1oJwMjADiiUg8MKYK0
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 4 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\83b49c34f9755bccc851d9c4e880f8ec_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\83b49c34f9755bccc851d9c4e880f8ec_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\83b49c34f9755bccc851d9c4e880f8ec_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\83b49c34f9755bccc851d9c4e880f8ec_JaffaCakes118.exe2⤵
- UAC bypass
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD51f2a672d74a160ee2fdd64d58dd355e7
SHA1d3f7c70a5175a989be3ae49473509b0ca756a0a9
SHA25696b3d21250db5a767462ebe8149a80b26b8f9461a918f35d7aa8bb11e37fa9db
SHA512bfda3f80b55256b7ade89dfc6c4aeda5b0095cf6ec825d7861a0a22aca9cc6c405b05aed62eb500a7b9f196d77822d29848f5c9b7aca295f08164bb28cc72d29
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
161KB
-
Filesize
161KB