Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-01-2025 00:51
General
-
Target
JaffaCakes118_d75beb3d5164bcc39ff2a149257902f3.exe
-
Size
270KB
-
MD5
d75beb3d5164bcc39ff2a149257902f3
-
SHA1
3a6a6880f7f01285b8d7bd57ee1bc98e75fbf9cd
-
SHA256
17a9641fcbe8718819a1b7c0d769d8f24747133926f056ef2ab4c3bff704f754
-
SHA512
a414cf9c1cc6a19a8ee02d72e4c8be72d2da66ff58177cb9ec2be4f82974df22ffff2d3da870128914458ffdbda027bdd89233190378a627f42a50a9cea6b686
-
SSDEEP
6144:GGyjnBSkuV1d4eZd88ORJIz8wTB42G3opc:lYnBSkuVUeZdYdwTt
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 16 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d75beb3d5164bcc39ff2a149257902f3.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d75beb3d5164bcc39ff2a149257902f3.exe"1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5c7cb6723835f9b7c14df80bfa9d2e3f1
SHA11c0c4b8f8294cb1832b384b63015d234570a1b06
SHA256270cee6aa778fe27d27e50a7246931078641406328eed068b0e8fce2bea10c1b
SHA512b5ad23a55fa2cd3510e2c44660cf839219c661fd25daf232d61025f33f847793675ec220bb7a75dad14f306928a8e3c565922dcc1d130a505772ebd58334c9eb
-
Filesize
270KB
MD5d75beb3d5164bcc39ff2a149257902f3
SHA13a6a6880f7f01285b8d7bd57ee1bc98e75fbf9cd
SHA25617a9641fcbe8718819a1b7c0d769d8f24747133926f056ef2ab4c3bff704f754
SHA512a414cf9c1cc6a19a8ee02d72e4c8be72d2da66ff58177cb9ec2be4f82974df22ffff2d3da870128914458ffdbda027bdd89233190378a627f42a50a9cea6b686
-
Filesize
7KB
MD5d524040ac2eba70a6bf5c1250ba4260e
SHA1a369d4dbebd02191afa9f9aecd374e8158c89eb9
SHA25684bb5f65e05ae4bb902f9afc9a4a669e2f6769cd8ce1fa2d3ecd4021359e7d43
SHA51255f6bd8806875d1e82c5bbee1f10740ce2fef8b072b09991ea00a56be66ba0f601d6d5181c6aed8e5c95f688f836e9189c8013d0f32d50d13d1235f59f195cb3
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
4KB
-
Filesize
300KB
-
Filesize
32KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
4KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
4KB
-
Filesize
300KB