Analysis
-
max time kernel
1s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
31-10-2024 14:51
General
-
Target
835943eac669d28aed9ea1a70cc9d920_JaffaCakes118.exe
-
Size
139KB
-
MD5
835943eac669d28aed9ea1a70cc9d920
-
SHA1
75e5bd398a688a808b25f6702e2d1c86e3d5dfb2
-
SHA256
05ac6794b51a00ce07f74212ae32afe91b0d0294d40f310fbf4a4f388dff58c9
-
SHA512
93c7c3050877d1fc6279e614af9844d71a20011a418c0eac79bac673eafac226bb460e015cf109138c50d4efd53fbcbb13b05dc9e3a42e3c3e72d39fa066f88b
-
SSDEEP
3072:FuIVQGe+yaonwAyzwszwy9aujKjpGIrwMwTzlm32737s3uTcKOLVf11o:FVXePa9vT8y9asKAZThm387yVKQL1
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 13 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\835943eac669d28aed9ea1a70cc9d920_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\835943eac669d28aed9ea1a70cc9d920_JaffaCakes118.exe"1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\360sEfe.exe"C:\Windows\360sEfe.exe" \melt "C:\Users\Admin\AppData\Local\Temp\835943eac669d28aed9ea1a70cc9d920_JaffaCakes118.exe"2⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139KB
MD5835943eac669d28aed9ea1a70cc9d920
SHA175e5bd398a688a808b25f6702e2d1c86e3d5dfb2
SHA25605ac6794b51a00ce07f74212ae32afe91b0d0294d40f310fbf4a4f388dff58c9
SHA51293c7c3050877d1fc6279e614af9844d71a20011a418c0eac79bac673eafac226bb460e015cf109138c50d4efd53fbcbb13b05dc9e3a42e3c3e72d39fa066f88b
-
Filesize
503KB
-
Filesize
56KB
-
Filesize
503KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
503KB
-
Filesize
503KB
-
Filesize
503KB
-
Filesize
503KB
-
Filesize
503KB
-
Filesize
503KB
-
Filesize
503KB
-
Filesize
503KB
-
Filesize
503KB
-
Filesize
360KB
-
Filesize
504KB
-
Filesize
503KB
-
Filesize
360KB
-
Filesize
504KB
-
Filesize
64KB
-
Filesize
503KB