Analysis
- max time kernel
140s - max time network
120s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
01/01/2025, 07:27
General
- Target JaffaCakes118_4c3ca5ffc98faf804206bfc3bb3dd29e.exe
- Size 130KB
- Sample250101-jadgda1mel
- SHA256 b5e8f26d15ba23a11fca0acb7ecd4f006d0a37d7cd65339ed7719aeefdb95301
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Modiloader family
- UAC bypass 3 TTPs 1 IoCs
- ModiLoader Second Stage 15 IoCs
- Loads dropped DLL 2 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4c3ca5ffc98faf804206bfc3bb3dd29e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4c3ca5ffc98faf804206bfc3bb3dd29e.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
bguiv32.dll
drvstore.dll
memory/2720-15-0x00000000003B0000-0x00000000003B8000-memory.dmp
memory/2720-13-0x0000000077480000-0x0000000077570000-memory.dmp
memory/2720-8-0x00000000005A0000-0x00000000005AE000-memory.dmp
memory/2720-10-0x0000000077490000-0x0000000077491000-memory.dmp
memory/2720-11-0x0000000077480000-0x0000000077570000-memory.dmp
memory/2720-12-0x0000000000400000-0x0000000000553000-memory.dmp
memory/2720-18-0x0000000000400000-0x0000000000553000-memory.dmp
memory/2720-14-0x0000000000400000-0x0000000000553000-memory.dmp
memory/2720-16-0x00000000005A0000-0x00000000005AE000-memory.dmp
memory/2720-17-0x0000000077480000-0x0000000077570000-memory.dmp
memory/2720-1-0x0000000000330000-0x0000000000331000-memory.dmp
memory/2720-0-0x0000000000400000-0x0000000000553000-memory.dmp
memory/2720-33-0x0000000000400000-0x0000000000553000-memory.dmp
memory/2720-24-0x0000000000400000-0x0000000000553000-memory.dmp
memory/2720-27-0x0000000000400000-0x0000000000553000-memory.dmp
memory/2720-30-0x0000000000400000-0x0000000000553000-memory.dmp
memory/2720-21-0x0000000000400000-0x0000000000553000-memory.dmp
memory/2720-36-0x0000000000400000-0x0000000000553000-memory.dmp
memory/2720-39-0x0000000000400000-0x0000000000553000-memory.dmp
memory/2720-42-0x0000000000400000-0x0000000000553000-memory.dmp
memory/2720-45-0x0000000000400000-0x0000000000553000-memory.dmp
memory/2720-48-0x0000000000400000-0x0000000000553000-memory.dmp
memory/2720-51-0x0000000000400000-0x0000000000553000-memory.dmp
memory/2720-54-0x0000000000400000-0x0000000000553000-memory.dmp