Analysis
-
max time kernel
21s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27/11/2024, 02:56
General
-
Target
a58c643d9ba9679e24a0fbd4ce28d021_JaffaCakes118.exe
-
Size
136KB
-
MD5
a58c643d9ba9679e24a0fbd4ce28d021
-
SHA1
67e273901d78750eec00c277bc6dfa634ba45116
-
SHA256
d76bede45059fce7836e3e3bb7470be2cf4b694569302aa82cd9eca880e0c660
-
SHA512
101624925a4ffff9e524f6edc2609090058be272519dc84a8cb3d0419005420d6f78daca44e53b61c0cece340199df56a3f647cb2ececca928e37ac706d23012
-
SSDEEP
3072:Qoy8j7VnNdrPHaSekwi+mW+2IuoutCqaY7Y5ag:A8jZ7rvaU3+mWrFoSfMsg
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 16 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 6 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Enumerates connected drives 3 TTPs 9 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 4 IoCs
-
UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 3 IoCs
-
Drops file in Windows directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a58c643d9ba9679e24a0fbd4ce28d021_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a58c643d9ba9679e24a0fbd4ce28d021_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258B
MD5088e78a6bed048329a4d74e2efcd2399
SHA1d3baef7c101f9dfafc29315e93fc8f034c735edd
SHA2563ce901d6fce81062683827a0a184c87e49c5922bb08e5926449f29293ef7a30c
SHA512c3550d12c90057bbbea6f50539ba4786a407324816764479311042cbcea66402c3f01ba399d415dd02a595bc161d8ee2d5137a739bea978ebd4db6937356ab04
-
Filesize
25KB
MD5fed957eb1ba973775cf98404c51ddb91
SHA1f8855c34695dd7414e57a2156adea98909dcf598
SHA25633e71d67ed8322d05542d4587fbc91a0aa309c45f41d1a35d493336751fdc644
SHA51279da603974b773e03d1c8e7b5acf131f379e54adee81d632ce46a5cb466e0736e01215abee61cba98fd6f23d7048bab9970861716757a19ea9976ad769f3fb0b
-
Filesize
40KB
MD503ebc053c8eec6b4f4afbbb5dc64b169
SHA19ed172dbce1a6a1dd20e08a9720afba210eee79c
SHA256ad25714f5c7eb2e27742b5e0886e865fc8884e8b65cb863d2aeba0c6dbff2d02
SHA51240eab99574ea6614341b869239b014a74cdc24da0c4be69681eaab18de72bbef14ad4cf36215e39eff4978b8ed074762ce25bb85a042219ac5db5cb46390e9ff
-
Filesize
33KB
MD5c378b1f5a0f04125b70d48cb684eeeb6
SHA10d0aab75ff4dead60b51e8ca48bfbfca6eb03c26
SHA256017a45d7a340236b3b9ddbb519f3514e89f4c170369abce044bf4f55bc6ebe3b
SHA5128dc498106220294e1d125328c35268a42f54659962b6b096779ecb298c28b3d2786ccd6c76de67f87e9e0d38454a25be21502f3a4f98ceb90d03d1c4eb765626
-
Filesize
136KB
MD5a58c643d9ba9679e24a0fbd4ce28d021
SHA167e273901d78750eec00c277bc6dfa634ba45116
SHA256d76bede45059fce7836e3e3bb7470be2cf4b694569302aa82cd9eca880e0c660
SHA512101624925a4ffff9e524f6edc2609090058be272519dc84a8cb3d0419005420d6f78daca44e53b61c0cece340199df56a3f647cb2ececca928e37ac706d23012
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
32KB
-
Filesize
348KB
-
Filesize
84KB
-
Filesize
4KB
-
Filesize
348KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
56KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
84KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
84KB
-
Filesize
348KB
-
Filesize
84KB