Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-01-2025 07:27
General
-
Target
JaffaCakes118_4c3ca5ffc98faf804206bfc3bb3dd29e.exe
-
Size
130KB
-
MD5
4c3ca5ffc98faf804206bfc3bb3dd29e
-
SHA1
b18c577b31f9d3c8b4f4813a0356e7f1c703fecb
-
SHA256
b5e8f26d15ba23a11fca0acb7ecd4f006d0a37d7cd65339ed7719aeefdb95301
-
SHA512
12fbc44157572c27742ecd317875c31b1373ec03fa5f7f962d56d3bfee2fe2f6b8401a3e269f2c4b704f0c39c540d66781a9c43140b4c28e87ec25823961ae82
-
SSDEEP
3072:Y84GNptB3kujWxpmqhzCVPSE+9lI4py/MyFB8TyF9out:YfIppyxsueBStzI3/MWBWyF9oS
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 15 IoCs
-
Loads dropped DLL 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4c3ca5ffc98faf804206bfc3bb3dd29e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4c3ca5ffc98faf804206bfc3bb3dd29e.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5c39ec2622aa0d0afcfbf9e4bb3a1b9a6
SHA16174e8c18402ec200a741d5c21520262b226e2a8
SHA256f8f62ab5f60571e6453341489c6369486004176d9c5dc7eaa09ab350de6dd229
SHA51263da27414c1433acb645211ea3dda63968ea1a5ee176b5f8b26e35d9e3bb767b5e0a0a3c7a94154aabc984294161cdd686607d202fa098a73528fef755a63752
-
Filesize
7KB
MD5e02c2c35c1866e34590953e0441b6e1f
SHA1528b6ed481db2ae67eba75564fc87c25c424071e
SHA256548c7779f17161b0b7e3596ba9c295cb737913f1a4c4e868d62d3e9a2e4019a0
SHA51228445ee24112852b76450684cd348e854e3df584921cfb1676d56b876cf0abdb8bf7e3453c734aa7205be8e0757e7772f356adddd46581a4aca44b1c2c348c6d
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB