Analysis
-
max time kernel
145s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
03-01-2025 02:33
General
-
Target
JaffaCakes118_69b17881162f1592905cecd69fcdea18.exe
-
Size
582KB
-
MD5
69b17881162f1592905cecd69fcdea18
-
SHA1
458730fdc0c13ab065424a5082e34fcaa41d2c3e
-
SHA256
94372f1a3c02a36d8e8151fef3ec94c8ff785a0366f727b0616c5a6d37a74e69
-
SHA512
e28a02f4dc4f6a3893fcb0f8234c9d7be3771f85eb7d3474fe78b2366b1b5a771917496ef03c2573e7568ddd02ac851dc294e1614c0d9e255d0447127016a59f
-
SSDEEP
6144:4kkwa+lHZcQHAB4+6qdrK4gt5MNsXhmwQXwRItnjqX0JUf8RQFoeEBgmlEp3ef:4x34a24gXM2hmwcwRItjqmQKFgmg3e
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 16 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 3 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69b17881162f1592905cecd69fcdea18.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69b17881162f1592905cecd69fcdea18.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Carta Escolhida.exe"C:\Users\Admin\AppData\Local\Temp\Carta Escolhida.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32.exe"C:\Windows\System32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\Carta Escolhida.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
431KB
MD57f4c94f5c873edad527b59d689dc73a0
SHA113b60513fcf8e3fe17e39298a89034b8362f91a4
SHA256938822db845da629fbc182687ecc40838dca8650ea598bf69796bfe819a08e78
SHA5128a8d3a7bbf42e130ef9e18055b05386da5c5de89753ffb7fa2d19b3a837c97fe7f83116aefffc6c5a9272d252ae983d378b9981025b5c7c0f97ce7e27d4ecdef
-
Filesize
460KB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
32KB
-
Filesize
460KB
-
Filesize
56KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
56KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB