Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24/11/2024, 14:05
General
-
Target
9524fca16d2814c953d15de5e0cc9473_JaffaCakes118.exe
-
Size
117KB
-
MD5
9524fca16d2814c953d15de5e0cc9473
-
SHA1
6068582eafe4a0ef19993c22171fbe9859de172a
-
SHA256
ed131301a469a80bbf5365317dd00fdae80b54d2e8039a39ee8dfc3d3a1ff5a5
-
SHA512
b7b888e3510fa35d3c6b94ad2d8295a17627549519a6f1a51e84898e65c7af2f6cc73312b7e30d35060e3ca0aa6d1004ff2f551ab37094bf95754e346d9d9103
-
SSDEEP
3072:a9tz39ULS/mysYKaJCDx3nS/ByyRaga0nZxEBg:a9tztULS/mH3hyRazYxEG
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 25 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
UPX packed file 29 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9524fca16d2814c953d15de5e0cc9473_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9524fca16d2814c953d15de5e0cc9473_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9524fca16d2814c953d15de5e0cc9473_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\9524fca16d2814c953d15de5e0cc9473_JaffaCakes118.exe2⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\mstwain32.exeC:\Windows\mstwain32.exe4⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD587490b0a8038f5a991fb03a80aa6c1b6
SHA1678b41ba1d4f91afaecf2b0adcaa3b09a29cbd21
SHA2564e3bd099ef1d982938254e71edf1b5142ecd13a2f131c6dbf22f862a90358c94
SHA51260f6377e693f7c258eabb3babd192f62dbc0cad66d01098e78d73006ea42f78f03ea220085b98af52bbe864810ec4b4f357ec0bc3b2110578bbdba114b31da29
-
Filesize
117KB
MD59524fca16d2814c953d15de5e0cc9473
SHA16068582eafe4a0ef19993c22171fbe9859de172a
SHA256ed131301a469a80bbf5365317dd00fdae80b54d2e8039a39ee8dfc3d3a1ff5a5
SHA512b7b888e3510fa35d3c6b94ad2d8295a17627549519a6f1a51e84898e65c7af2f6cc73312b7e30d35060e3ca0aa6d1004ff2f551ab37094bf95754e346d9d9103
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
32KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB