Analysis
-
max time kernel
94s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-01-2025 06:24
General
-
Target
JaffaCakes118_4a7127e00da464e1f16af88a41c53536.exe
-
Size
174KB
-
MD5
4a7127e00da464e1f16af88a41c53536
-
SHA1
3d42af9bd3a79da53277623f7d376a4672ae6c58
-
SHA256
85e1cb35b50db34959564ea43f5e06726e897b72d80029789e3479e643b4f2e6
-
SHA512
4a789ee4542afeff20ba49f1a39eaad95c2278bffdf723fc29e297dfade90c4901150afc0420a46dd6c8850028366727844513d92c36b27589c40c6f10e345c2
-
SSDEEP
3072:+oy8j7VnNdrPHaSekwi+mWdEv1Nout+9DbmpU91QMiiOJ+mE7rruqhSOS:e8jZ7rvaU3+mWd0NoSauUzCiOvyrxSOS
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4a7127e00da464e1f16af88a41c53536.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4a7127e00da464e1f16af88a41c53536.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384KB
-
Filesize
16.2MB
-
Filesize
384KB
-
Filesize
16.2MB
-
Filesize
16.2MB