Analysis
-
max time kernel
144s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15/01/2025, 10:00
General
-
Target
JaffaCakes118_53cc5de31c283160e38c370833a0d256.exe
-
Size
240KB
-
MD5
53cc5de31c283160e38c370833a0d256
-
SHA1
32c4503b5174b4d8587fad2471b5cc1560e7c680
-
SHA256
4f31e3ca7d0033d9aa2a062a444eed0de9f0bed17f6291563883d77b44cecda9
-
SHA512
abb11a6e34eac3010e038841fda59115e1d8f6768b1283b263c6e91422d1314ef04f84c23aabe174fd7ece84f6936e884b668179d774aa79cc977fad857591cd
-
SSDEEP
6144:Rf3GfQW8CEOOCbNa6snMmFZ6y3GfQW8CEOOCbNa6snMmFZ6O:4fXEOOK4yDfXEOOK4yO
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_53cc5de31c283160e38c370833a0d256.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_53cc5de31c283160e38c370833a0d256.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD54d708fc16ce8f074841cb573eaa054ca
SHA111e9b28832d0abc9bff20059ab033402d591e367
SHA25612b9146ac2a79f0ad99b7606d0d4bb1614459f3a175ef3096a4f7d7ed49e0f8d
SHA51212dbdc4407d7b31e146a195ad140572350690e33694bbbea17792168153ab9af4b971333adaa3dbcd0bfdfde3464eaeb729de370b1a2e1ebd7ee0588ebafb901
-
Filesize
33KB
MD5d2b20db3f5352befbf6d2a38f3dd8d5c
SHA125cdc577ac81bca03def5b34916d4ffd81444604
SHA256ef61b13e879b9ddacff5a073a53640b485951931fc68c6399fa6ffacaa91c5f6
SHA512474a35c11a80f6bfb3718a520b89f8d747f4ac1e0ca9bda66c34a0692e08d8e0d4841c1931035faa4ccebc14fa26dac660331278d4a0696b59d8704092771435
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
56KB
-
Filesize
960KB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
320KB
-
Filesize
960KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
28KB
-
Filesize
320KB
-
Filesize
28KB