Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13/12/2024, 10:34
General
-
Target
eb1841ff8af520cf9c61a281f2297023_JaffaCakes118.exe
-
Size
114KB
-
MD5
eb1841ff8af520cf9c61a281f2297023
-
SHA1
345454b3c38c7cc3d88718fbe765a0865e20a2b9
-
SHA256
e1a22d89d4d5a9cd4c64aabd36b61a688df563084ca3fd5271f7f14d9f2ca083
-
SHA512
8cf8c5b59f9a003736329e3684228943f06ed1153209b7376b70beb52cc063d2fe68a134ea8a957c75685b066ae9d67e5c2db2b3456dedd0a1b8ab35e78a514e
-
SSDEEP
3072:/eovXPoYcswp7Uclw3BwQaq9NUqxTDa0outn:2ovQYjwpU8OB3aq73tXoSn
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb1841ff8af520cf9c61a281f2297023_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eb1841ff8af520cf9c61a281f2297023_JaffaCakes118.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD52442387713105ca5f30661dc19881ea6
SHA12d84a6cf7cab52e5a14d6e0672987f313062a71f
SHA256a8bede0a5ea17ce4b1a32ecb3cdae9f9e48472839e9a6dfedf925350cdcbc3f5
SHA512cc807b9fe080fa2c3595948ed1621e5d9e3e2b72f82c9e2ad8c9410c9ac5f3c2846b39682f600ea3d5c51969394cc8a54b1beefe5e5806f320d67c848cde8ef7
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
332KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
332KB
-
Filesize
32KB
-
Filesize
56KB