Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
14-12-2024 00:09
General
-
Target
ed5aee34382802fdee46c43cfb30307c_JaffaCakes118.exe
-
Size
183KB
-
MD5
ed5aee34382802fdee46c43cfb30307c
-
SHA1
0fe0836686ec9eb3a08768fe95ee9c836a186b62
-
SHA256
995f3a4f8dfeeb0d0e5b391fc89fb343d74940e58e798d586c8a8e43603ede2c
-
SHA512
8bf9038dd2446171fbbc1548168b48fb2481b48d489bc5a9352402f02aa828ff522d266038afc6e4f56e13b0226e2ebf6e1f461982fe6efb250f5e84dbae173c
-
SSDEEP
3072:7mNsB6jNa6kfaVSLHb5ZfH7Yy9L4Hybtz/NPxQ7VT5uUrW5YCWBECm8HeVDxdQMb:78q4HkfakH/ftMktz/aHryAEQHeVVdQC
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 15 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed5aee34382802fdee46c43cfb30307c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ed5aee34382802fdee46c43cfb30307c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\serverPk.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\serverPk.exe2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD56664be2c94dc0f0038dc6a47cd6801f7
SHA1ea9d3bf86b850f37f44900dd7b76b1aba0e0f8a4
SHA256a2151819dca9253c11ef1b73f419c755683de1c78f745d298b34f5d8d66621cb
SHA512851cbf90138e625a1562281a947268eb96ce3d2e73ce510c6fb3caaa6a338fcc0ab82d722a6552c13338f299b056da3dbab133fe283a14caa851991677fd5b60
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
113KB
MD5c68540e57233c5f0f256d4a5aa32841c
SHA1627438a12b595ef42c80eeb152cacc1bf6d80471
SHA256aa6aa9f74c94222513e2018a3ca73de8e30646f0022c0673c89adca77f5350da
SHA5121a7e9035a6a621dac596aa8ec930b861273c9f5c5badbc6f7a2ed1693cf3658c0da8beda774e79eac92d1ccefab53f26d29398c18818988c661e7fd40f4f0eb0
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
4KB
-
Filesize
432KB
-
Filesize
32KB
-
Filesize
432KB
-
Filesize
56KB
-
Filesize
432KB
-
Filesize
56KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB