Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-01-2025 15:26
General
-
Target
JaffaCakes118_ad7dba94eb8a26c36d18db095685895b.exe
-
Size
431KB
-
MD5
ad7dba94eb8a26c36d18db095685895b
-
SHA1
6d080fe28ea4f025bdccc1ae1e016d6a01c1cbee
-
SHA256
4c3cb226b9cc25f80a8c70f34bbf20302a55b17728c25b185dad6443d3908951
-
SHA512
5eeaed2a76903538cc09debd726dcd27d1a54b36090fdd75bb2b63853f261b27899ddc575d627d8d003845789bc1544685f32863447f062b4dde6a4edccf1d63
-
SSDEEP
6144:OR6sB2GKeE/FW1hhuQvAedsu+NxvczrfHKBpzWz26e+LTxczHIiJprR/7Yni413T:5sB2GKevLLYxviqBEDLVAJprRMBD
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 18 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
UPX packed file 19 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ad7dba94eb8a26c36d18db095685895b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ad7dba94eb8a26c36d18db095685895b.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\system32x62.exe"C:\Users\Admin\AppData\Local\Temp\system32x62.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\7.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\7.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32x6.exe"C:\Windows\system32x6.exe" \melt "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\7.exe"4⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Vaqxination v2.3.exe"C:\Users\Admin\AppData\Local\Temp\Vaqxination v2.3.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 2203⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1452 -ip 14521⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD54da2afc6e4c23123f60d73ca9d4c1da4
SHA12226f37f07a02dba56630b62d35f67f1c74b99d3
SHA25687562414272063925bb7a3a6df3264f2142b6147e368e125474645adc2287a0b
SHA51208ed8d38579be924a92e026953e47c04881ada6278b72f4931f21d358a365042c74018d1e4607ac6b64b82c8281ed94040146231902989f56c1bce773fd9e3ff
-
Filesize
106KB
MD50e8b36838a74bf0be959456d941a139e
SHA1252820017d906c0f2796a163d8366633c2511b42
SHA25626f7faa42c02149db51f24461db62f56881b837cb1285dc1901108509e043516
SHA51268a3206854bd741be556c433678c32e816708407cf913e90e493734db52e7325360056c865ffb37839e61122d4627f20c0b5f324ca9f504fb09e5a5f32001aaf
-
Filesize
447KB
MD5ff99ebe8eda2c9c7fb8678a4b1c51f4e
SHA1d44384473b744d2448ba6d672c3f773fad7fed3a
SHA2567647bcc3bfa01922684762ffb5988de3fb5d5f20926cb8851543719ec020a9ba
SHA51216bd2ba2322f5abac09a1bcc318acc2ff51b9436d24210b86da06cc46e20abbb04eec812a788069adf704941d00bef4302c7cd6c90d6d7c9d32a767f2a391a40
-
Filesize
33KB
MD55164a88f6354971ab9a3f91cc545cf6e
SHA161df99d3a7caff710daaf6a04287d2eed56513f2
SHA256eea85d487f0642b29822442a54a502c0520d40a62bc1ab6d61cea71218cb3ce8
SHA512121f79b0550647898e9d79b23a6dcf7eab21f2a6789bb831764ca80fbfb8ef21fd30aef5dcda9984a2df329394cc7cecdfaa9eb097fcc0f45b3582e5f10bd364
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
832KB
-
Filesize
9.6MB
-
Filesize
664KB
-
Filesize
9.6MB
-
Filesize
624KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB