Analysis
-
max time kernel
146s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
10-12-2024 01:07
General
-
Target
dc51e3c7fdf443110ef0b42251a74c5a_JaffaCakes118.exe
-
Size
565KB
-
MD5
dc51e3c7fdf443110ef0b42251a74c5a
-
SHA1
96650ce61fb2f3aa18ac55b8782e6a4186027ea1
-
SHA256
5e41dc342bcdba4d3e085f52a35721c6b03d8f3ef95310214577d009817faf82
-
SHA512
84f9294d794ae29fdc2b65d54acd0e0f44cd8b3ce42bc01ef3c3c1dc1862fcbb043b7e22842add0586097c38120366dd06c21449ab455425e92a470807c26f5c
-
SSDEEP
12288:PCmBr+buJqVzYKj86swbdOVzYKj86sz6OaDDVzYKj86srv7Xxd:P9Br+bu8pYOepYOIPWpYOKvzxd
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 3 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
ASPack v2.12-2.42 2 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Loads dropped DLL 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 8 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 14 IoCs
-
Suspicious use of FindShellTrayWindow 29 IoCs
-
Suspicious use of SendNotifyMessage 24 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc51e3c7fdf443110ef0b42251a74c5a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dc51e3c7fdf443110ef0b42251a74c5a_JaffaCakes118.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\Uninstall.bat" C:\Users\Admin\AppData\Local\Temp\dc51e3c7fdf443110ef0b42251a74c5a_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Active Setup
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
207B
MD5404745120599709daf7901f17c43a7e5
SHA1247c9e558241de4415f383ada3b4198259e0b59e
SHA256b8206f0dd8276874d88a69a3e9e79c914a6f9cb9bfa6de7bdf4f216f0f105d3b
SHA5120c3d7295b5eef46dac8377485ecb1ff4423a2a4c414b50a0ed813ee6171499b172063c199e69788bf0c8f4909e5775d06d17bdac18f7dfaffe810639470ffc6b
-
Filesize
164KB
MD5ea1abe49f7704d313a13bd8a7b348a64
SHA141b0e07da99f9dd4087f9e3e8369156d5994c78a
SHA256592a7d7622833a627f898566d7cfdebf9f2655cc328c132e44b2c010f44c0a52
SHA5129594971e293cfc11868901fd3fd5890f7f9403669b2b4736ead0ce828bc0f72b1d31207140e628250b788de233a1d17780359a86d0b36b0dbb371c2d73aea444
-
Filesize
145KB
MD5174abe04b1a7b6c0197aa0789e8f66bb
SHA1af84173fb7ec0a2d2000c98ef22ae6da170ff8e9
SHA2566e8433d522920db97e52f8f67797f9d596347f7b19b56eb96d1f422617b5c4da
SHA512b8555dce4ba2fea3345df8d85cc01c7f23a5673f1f840576ec9029b73d07f6029a3172a4467cdf7455850ee1a7586aa950dc464db8159a5e781ba8f164f33204
-
Filesize
4KB
-
Filesize
396KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
948KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
424KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
396KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
424KB
-
Filesize
396KB
-
Filesize
948KB
-
Filesize
64KB