Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
28/11/2024, 00:59
General
-
Target
aa61435baa12d4470b7a9ce316e43164_JaffaCakes118.exe
-
Size
319KB
-
MD5
aa61435baa12d4470b7a9ce316e43164
-
SHA1
129cb131c077e8c1599a4c599a9ab2d0ed53edf2
-
SHA256
e3312d93400a74c780d9b7229eaf0fa5c1d57861c300503f98405ae81bd3297a
-
SHA512
180625f00956a528b53a3a0e7931df59a35cc35d7afb2d169a15263efe4bbce4fc5b8d5a95a5552fce7f2cf3b8713fcaca194780eaf8d320dfa5ecc7d585e8c8
-
SSDEEP
6144:oG377xS2Vp2VpU5A4rwTBl53SpcCJJvHiazXOoSB2:zr7xS2VpmUmQwTwbJJvHLjOoSB
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa61435baa12d4470b7a9ce316e43164_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aa61435baa12d4470b7a9ce316e43164_JaffaCakes118.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD5558124105c7d8767a54d15aa08016e50
SHA11200460c945de49680322ca27654c11e333669b4
SHA25636a5ed15ba89b854f0b8399c75f2f5816fd6fa2e315d096c8954ecec4e6b74b3
SHA512dcf393972c6821f8609f0fa49a0292cd5b2fb097edd174d90188b307bd3a32aab3cac5b6a27d7c72e16af193b422e9c4168ddc2edbdd798d9278d75792e22141
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
960KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
960KB