Analysis
-
max time kernel
146s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
24-11-2024 22:54
General
-
Target
97abbf0b1ef33c7106388d4778bb1c48_JaffaCakes118.exe
-
Size
1.8MB
-
MD5
97abbf0b1ef33c7106388d4778bb1c48
-
SHA1
43c0d70f6d9f1b245b9d6d7d8900efd0efb9095a
-
SHA256
e348b57dade9e6b807052d51062a964fc9be6caa3425587125f7c8a796715858
-
SHA512
e976969329859638a46c87157e922740b4266a7d1ff535ca3978945e9a15b6288bb670df0f96c703199e5e4ef2718299133c499fb9f2e8d0d95cb5a78085d2df
-
SSDEEP
24576:QyZBTGF2mygtszkp3TXh5r9RzEws3BNjSYAHb8erClz1MaUevrX/6Q7X6ezrRnmf:BvG7szk3rZVY3H27mRfrXd4ZQe1z+q
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 17 IoCs
-
Executes dropped EXE 3 IoCs
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 5 IoCs
-
Themida packer 4 IoCs
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
NSIS installer 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\97abbf0b1ef33c7106388d4778bb1c48_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\97abbf0b1ef33c7106388d4778bb1c48_JaffaCakes118.exe"1⤵
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\turko.exe"C:\Users\Admin\AppData\Local\Temp\turko.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\ctfmom.exe"C:\Windows\ctfmom.exe" \melt "C:\Users\Admin\AppData\Local\Temp\turko.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
-
C:\Users\Admin\AppData\Local\Temp\ducsetup.exe"C:\Users\Admin\AppData\Local\Temp\ducsetup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
112KB
MD55541eeec419ade4d4e8cc760f2bd144b
SHA1a5263e4de342da4658fed98844e7dd5a69f9b4ee
SHA2562192508bb8e9e0c4a759777bd5115b93500ee3a74fee458cfa5898629d50c576
SHA5122421a4b16841d133fe78a51eb093bddfa3bc9751d651dceaddfd874652d35621ff6fa38c52399a55939a3ae80680ee9718e24e430edce7752ea5186fdb54d1e8
-
Filesize
33KB
MD58c96a09c3fe09e4a948d8240d313e227
SHA19f92327e675f9c14abb62f072a53593c1a69d053
SHA256bcbcfed7837c29f63ec637e898a94d1b8fdf7a6e406bce55d30d578797dacbc4
SHA512e6ba96ab77704db3fbfd655b4b3c3284d39a4aa703e882d5832f3c8e562476906c2a33229d2a4ec1ca2b8e3a4bc0a0ef95c3d951b2a297d7e69f5b4445ac2648
-
Filesize
1.1MB
MD51572340c8226f3fa6e7fb66e0c32d3b8
SHA1499f9f39ed540959c959e8c18f4e2411d6fc24d6
SHA256c592963191a06cf6a88f7375f3424d6bb94d21990a34074c2d7b7a7ce28cc8eb
SHA5122469042806bdd91c2f04bc45e1fe0b36f3ad719f409d55bacbc496264a34fb70cced9ce73f8c63b3028ebc992f542ceff392711fb2a8f26b941468a80846154c
-
Filesize
7KB
MD54e96f412a8cc653053d5d918df6b0836
SHA1a3c7d59043feecb1603874b27c23d4166b341f2d
SHA256e4a54bfc327986a89165bdef361069810aaa985c3abecd442c786725fabaf977
SHA5122fec61b4ad31250bdbdbbfd551d831801790b96902c67200661e8f4f2753378bbf6c0c88b12e1be9173a29597827c1c4809511b6d52666dc3324bd7031c8229d
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
8KB