Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-12-2024 13:01
General
-
Target
fba3d2be385e7eab336a937b41f21f45_JaffaCakes118.exe
-
Size
822KB
-
MD5
fba3d2be385e7eab336a937b41f21f45
-
SHA1
cf10274577392364dbaba54df65fc7fa133b5bb3
-
SHA256
d8c9e0bd6d353bbed10ef8b5178a647ac0ada2776338db5eee7dc5a1f969a55c
-
SHA512
0b5642a0f94ddc6ae973e3010c34e8d6563f05a6fdad1c077e5785d3bcdf24f7a11b1853c6a73209bb01aa50ba232a6ef76265b290b215f85864320eafc79430
-
SSDEEP
24576:4bCIner3IvJShw9HQdIY8Y/emv80FJ2Joyep4wOzNMbPeqXwD2D:VcMcci2D
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 15 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fba3d2be385e7eab336a937b41f21f45_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fba3d2be385e7eab336a937b41f21f45_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bbb.exe"C:\Users\Admin\AppData\Local\Temp\bbb.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\ee.bmp"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
271KB
MD5662552633bea6dcb7df061ca31750c58
SHA15df487a378fa62742a3e8154c8548aff0684c11e
SHA2562ef5d35c33917166c0badc26131e4d3aee7662c2393485755943b5b26610aca4
SHA51282d38a4331ecf3d66a2c53e5418efbaf9c9bbdcaa61297ae30aca2247b666a6f3be92749d2776652162d6795ad107b3acf959b2bb1e50f5533ac8e04fea33924
-
Filesize
33KB
MD520a6038b488d9672665095e07d5365de
SHA1dba8ddf557165e1e6f970d0fbc58878831d4e510
SHA25625f5deb652dcfb4bd2372f526774d8328085f18d13b30b0d72d73428d7367199
SHA512df1766b764df51fd75f721a6df64a797479c9b0ade3c5fef585b3ef8b10bd0591fe40671d7bc5c7df4b0288751ef89ea541763d00b55dd8555f58fa784021311
-
Filesize
550KB
MD5d52763872d7d1d669d0f7d63da77a800
SHA1e5dfaf631fd913bea8a9c02138112f4e7f83579d
SHA25699b44dba7c364a26f44f215fd21bb31d63aaef03524332d50d9d09ef409f189b
SHA5124efe39078ac92d6aa7c5c42847d0410260f3b4028e90cd78f103c1164bffd63c5b291e0c7c9e0e321c75e86f6da9f637206ae2101ecf9e572f6ca508448606dd
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
56KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
4KB
-
Filesize
300KB
-
Filesize
4KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
