Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26/11/2024, 17:31
General
-
Target
a339ba528ddd0c3d91c52103fd12b143_JaffaCakes118.exe
-
Size
227KB
-
MD5
a339ba528ddd0c3d91c52103fd12b143
-
SHA1
2f0428dd455d3513783a91c5e4ffb273b9e6f1cf
-
SHA256
65d13d2b5d3fb706d29acd79faeb3ba7180a07fb6f26035fd6ae15c6048cdc92
-
SHA512
6acd7041f7fb188c31cf9b21880bfa18b22ac13f03fc003719ec39adbd2e1db79588ef9e2b15a6f7dbf7eabadd9bf8df4334e10f2005a8afdf97f2ac4f5152db
-
SSDEEP
6144:ZeYH3V2NRlPwWF6hhdnV7AJV69Uc23Gym7oQlyHnbSaBk:Zem387l4WI1VSI9UcNyF72Z
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 6 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a339ba528ddd0c3d91c52103fd12b143_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a339ba528ddd0c3d91c52103fd12b143_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\winupdcenter.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\winupdcenter.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\winupdcenter.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\winupdcenter.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD5d12f80819105bae5811221d33005618e
SHA17107f29727181a018150fc583ee1b89a3ee2aa5b
SHA256210e3488f9493106bdeada58bb1b7abe5522d3559fe712ec21ba76fcae69d0a3
SHA512f78fdbc3031db76802207373bff2ed44c51d38d9db6047f1c45fe5df1a5a2f4332b7a1cdc738ee29287f64ca4753ec6976d1d12b64cfed98d198dd4cc52c8f7e
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
208KB
MD5ebe0a383ad09480cb42c3852816e7d00
SHA1972306525923de45d20e00f7538ed1d0591319a0
SHA256c9d13e597fa013613cdb235f1a20a3d617cc6a74b4da9f2b87790bffc3b494f9
SHA512400f8861c1e3d436df8d2d155b11f8c614921f54cceea00aa04a9237cb8658abd1c4de2d0db2460b067723f233b4889636852da48024a37d123c42f9304a05a6
-
Filesize
9.6MB
-
Filesize
664KB
-
Filesize
4.8MB
-
Filesize
9.6MB
-
Filesize
624KB
-
Filesize
9.6MB
-
Filesize
304KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
32KB
-
Filesize
56KB