Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-12-2024 01:07
General
-
Target
dc51e3c7fdf443110ef0b42251a74c5a_JaffaCakes118.exe
-
Size
565KB
-
MD5
dc51e3c7fdf443110ef0b42251a74c5a
-
SHA1
96650ce61fb2f3aa18ac55b8782e6a4186027ea1
-
SHA256
5e41dc342bcdba4d3e085f52a35721c6b03d8f3ef95310214577d009817faf82
-
SHA512
84f9294d794ae29fdc2b65d54acd0e0f44cd8b3ce42bc01ef3c3c1dc1862fcbb043b7e22842add0586097c38120366dd06c21449ab455425e92a470807c26f5c
-
SSDEEP
12288:PCmBr+buJqVzYKj86swbdOVzYKj86sz6OaDDVzYKj86srv7Xxd:P9Br+bu8pYOepYOIPWpYOKvzxd
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 2 IoCs
-
ASPack v2.12-2.42 2 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Loads dropped DLL 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc51e3c7fdf443110ef0b42251a74c5a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dc51e3c7fdf443110ef0b42251a74c5a_JaffaCakes118.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164KB
MD5ea1abe49f7704d313a13bd8a7b348a64
SHA141b0e07da99f9dd4087f9e3e8369156d5994c78a
SHA256592a7d7622833a627f898566d7cfdebf9f2655cc328c132e44b2c010f44c0a52
SHA5129594971e293cfc11868901fd3fd5890f7f9403669b2b4736ead0ce828bc0f72b1d31207140e628250b788de233a1d17780359a86d0b36b0dbb371c2d73aea444
-
Filesize
145KB
MD5174abe04b1a7b6c0197aa0789e8f66bb
SHA1af84173fb7ec0a2d2000c98ef22ae6da170ff8e9
SHA2566e8433d522920db97e52f8f67797f9d596347f7b19b56eb96d1f422617b5c4da
SHA512b8555dce4ba2fea3345df8d85cc01c7f23a5673f1f840576ec9029b73d07f6029a3172a4467cdf7455850ee1a7586aa950dc464db8159a5e781ba8f164f33204
-
Filesize
948KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
948KB
-
Filesize
396KB
-
Filesize
424KB
-
Filesize
948KB