Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29/11/2024, 10:33
General
-
Target
b0aad0f35add50bfc322fdc65d6f9cd6_JaffaCakes118.exe
-
Size
172KB
-
MD5
b0aad0f35add50bfc322fdc65d6f9cd6
-
SHA1
46037503ee0f47b3a785a16c69cd794864a58b4c
-
SHA256
551323d074baa5e9014baf6e75ac12c859bd182c2b8a11f25659764f0a524d34
-
SHA512
be058dcae6ec468d34dd713d532e5150c41f5c4db7e2e66fa823e6f27053385765d409ff6280bfc222d918f5cdbbcd3422ddae640022967b6dd6042eb5cae5fd
-
SSDEEP
3072:X1+MJKrUnFYY5z1i0Nmbi5fJBNxqBoutIrX7eVKPuWXfQJLFhKExtduu:dIrPj0NmWtNxqBoSdiuA6LFhBu
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 16 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0aad0f35add50bfc322fdc65d6f9cd6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b0aad0f35add50bfc322fdc65d6f9cd6_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5c7589577c8f98bf39878226c3d41ec6e
SHA167221d8cf869e31845e4f88fc979fba92c9fce2d
SHA2568e5b174d0f877f1466731364b8626804ca809249193a873b6f6b96a640033e91
SHA5128a5985dab016c6c8c1637cd29e0b7b531275989a6b2497f45a9c8ff30c06f4d3229120e0a630877c718d403566e62a13ee9efb149c307abacb09019788d9dccf
-
Filesize
172KB
MD5b0aad0f35add50bfc322fdc65d6f9cd6
SHA146037503ee0f47b3a785a16c69cd794864a58b4c
SHA256551323d074baa5e9014baf6e75ac12c859bd182c2b8a11f25659764f0a524d34
SHA512be058dcae6ec468d34dd713d532e5150c41f5c4db7e2e66fa823e6f27053385765d409ff6280bfc222d918f5cdbbcd3422ddae640022967b6dd6042eb5cae5fd
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
4KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
440KB
-
Filesize
56KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB