Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-01-2025 02:33
General
-
Target
JaffaCakes118_69b17881162f1592905cecd69fcdea18.exe
-
Size
582KB
-
MD5
69b17881162f1592905cecd69fcdea18
-
SHA1
458730fdc0c13ab065424a5082e34fcaa41d2c3e
-
SHA256
94372f1a3c02a36d8e8151fef3ec94c8ff785a0366f727b0616c5a6d37a74e69
-
SHA512
e28a02f4dc4f6a3893fcb0f8234c9d7be3771f85eb7d3474fe78b2366b1b5a771917496ef03c2573e7568ddd02ac851dc294e1614c0d9e255d0447127016a59f
-
SSDEEP
6144:4kkwa+lHZcQHAB4+6qdrK4gt5MNsXhmwQXwRItnjqX0JUf8RQFoeEBgmlEp3ef:4x34a24gXM2hmwcwRItjqmQKFgmg3e
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 16 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69b17881162f1592905cecd69fcdea18.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69b17881162f1592905cecd69fcdea18.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Carta Escolhida.exe"C:\Users\Admin\AppData\Local\Temp\Carta Escolhida.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32.exe"C:\Windows\System32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\Carta Escolhida.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
431KB
MD57f4c94f5c873edad527b59d689dc73a0
SHA113b60513fcf8e3fe17e39298a89034b8362f91a4
SHA256938822db845da629fbc182687ecc40838dca8650ea598bf69796bfe819a08e78
SHA5128a8d3a7bbf42e130ef9e18055b05386da5c5de89753ffb7fa2d19b3a837c97fe7f83116aefffc6c5a9272d252ae983d378b9981025b5c7c0f97ce7e27d4ecdef
-
Filesize
33KB
MD5f7ffed13f77c8d2afd460c9bb1107aa5
SHA107b0ecc5c6b4dfc893b265cbc7e4faf4a6f0d9e3
SHA256f2d6399f5ee2191059df4c244b4cc60851296f3263921ae16fe09500fd77623f
SHA512034d64b037c2d6529f9958e02976dd3f614a24540410ededd757c2644d217fb081931642d016fd913f6a6eb570f7fa196d9de2271f65a7a962b65e74a0d02cb2
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
56KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
6.0MB
-
Filesize
460KB
-
Filesize
6.0MB