Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15/01/2025, 10:57
General
-
Target
JaffaCakes118_54fbb576b1f0fa161bacd5d33faaacf8.exe
-
Size
244KB
-
MD5
54fbb576b1f0fa161bacd5d33faaacf8
-
SHA1
86c186bb282206d5fe29e59912f7542b05aeeda4
-
SHA256
1356ad121a34f5144a53ef34f5a40d1e9215aa56b3904b430636885c43f71a65
-
SHA512
ffc479715f854a7575bbce54b3d972df3c038b1100f77e42974473b33e7e62def838a3cf2768433958d224696d77f5172583bc510f956c133794fbca344db995
-
SSDEEP
6144:syKxrIoZrIjf1Md2W9GmNoCiRwvmbpgEArU4PwaXvvCc:EIOIbSMmNviRmmbpgEIHXvl
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 15 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54fbb576b1f0fa161bacd5d33faaacf8.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54fbb576b1f0fa161bacd5d33faaacf8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file1.exeC:\Users\Admin\AppData\Local\Temp\\file1.exe2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
109KB
MD5b797a79d4ca165ca4c4641a21d074a49
SHA14719047bcac5ed21284456f0f41b9073678fbf80
SHA256e4bec9a8782192ad699c126a2f3f966d9a5953e11c13442cd2cb45fcfa796a07
SHA512f7af892be13bfb74bef41735fc60b0bc9ee0d1dae4b1feee04e3ece038f32d0244b1496b9e8edc62faaeeb19d632c7c918d4b518bafd0f7e247314c77dfda0fb
-
Filesize
32KB
MD51fee39c36108f891bff64c1b84d37b2b
SHA18888624b2b77799c3a161624ab6afa80c82f58aa
SHA256b244d254773f2e53d6d3d3ee87b81339b5b4a3d713dad051cebdef74ddf86da1
SHA51243066f9816cdeea2cf850c280f5964d881bd514714d172634366aa2d7f32468537bc209e5b731f5c25aac23baa719fb26d91212f6c4d93d7b0b166b76e3c139b
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
960KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
320KB
-
Filesize
960KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
32KB
-
Filesize
320KB
-
Filesize
960KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB