Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-12-2024 00:17
General
-
Target
cfbf91ee3e6afdbf2d5c6138158e5c2e_JaffaCakes118.exe
-
Size
155KB
-
MD5
cfbf91ee3e6afdbf2d5c6138158e5c2e
-
SHA1
c1f43621d767c4a41e0df6f385c895ced71af495
-
SHA256
bffdf0531575427b7d592819ba66cb808dd22d91b123be9dcc2f05649f7663e2
-
SHA512
0d52570d081044adc1743232a9fabc1bee76b7a179363d627a7a0be6cb24480930254a372ec392a9e4beebeb1a34f641a137f0570e6529d5df15d74d3110caac
-
SSDEEP
3072:eSMt+tk5U4VYmEYGZuAS4876FRAKtCLICXpTq3cwOmeVD:Qtkk5U6YTgAS/6wguXAs8eF
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 14 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfbf91ee3e6afdbf2d5c6138158e5c2e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cfbf91ee3e6afdbf2d5c6138158e5c2e_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cfbf91ee3e6afdbf2d5c6138158e5c2e_JaffaCakes118.exe.exe"C:\Users\Admin\AppData\Local\Temp\cfbf91ee3e6afdbf2d5c6138158e5c2e_JaffaCakes118.exe.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\test.exe"C:\Users\Admin\AppData\Local\Temp\test.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD52a996d7cc35fe21d19fa868c8a1dfd49
SHA18f6b663e0761921c40bb7530137305461e62db66
SHA256e4cf66ab479685b41ccbddd33c8f292108784553a9c6a017598111955f7817e7
SHA51265d56536d291279a252ac5c4e0065dd4fe29c786b27e0fe465f7c70a33aa209757b2f4a9230b536599456ab1e50d3e8e4598f7150af0f08b56df61469f7a8ad9
-
Filesize
33KB
MD5d2b20db3f5352befbf6d2a38f3dd8d5c
SHA125cdc577ac81bca03def5b34916d4ffd81444604
SHA256ef61b13e879b9ddacff5a073a53640b485951931fc68c6399fa6ffacaa91c5f6
SHA512474a35c11a80f6bfb3718a520b89f8d747f4ac1e0ca9bda66c34a0692e08d8e0d4841c1931035faa4ccebc14fa26dac660331278d4a0696b59d8704092771435
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
108KB
MD5b33d6aced27ea175307a57d321a95b1d
SHA18696dbd0d54355e9691ea4b3fc1342c44b9e94fa
SHA2566610090c9c0e58e9121f9a5545ab2e17881ad5c43b2cdd8650b1c1b97b3d535d
SHA512ee6ad49bda1339e1a6d5feb8c8e265311d8f951536a5621b842db802528983a4a6352fb5a9597c71abe81f7c1a71e769ebde9a0541d4eb19de3ece8a7c7e172f
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
32KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
320KB