Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
21-01-2025 00:58
General
-
Target
JaffaCakes118_010780e7a96668345809975af5d39336.exe
-
Size
296KB
-
MD5
010780e7a96668345809975af5d39336
-
SHA1
261b5320770861bf80b1dbcf3dcf039c24239d2b
-
SHA256
3c46b8c4a7b38d4c8faea509f797ce3cb24bf3d807c674a8f1c46e254dbc7769
-
SHA512
f705c961ae63813d5a550c46cbb3e8bb81511de16e61a7f0392be05bcfe2e801690f3ef0da0fcd1c8982c1aea3770c65491e4e04667fbedd6a4735a60658e16f
-
SSDEEP
6144:9jJvSQmQ0GTDCU1b29XSOpxqw/Hc4bjNEezyT80je:B5SQmQ0GTpy9Qw/HctIyJje
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 25 IoCs
-
Loads dropped DLL 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
UPX packed file 31 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_010780e7a96668345809975af5d39336.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_010780e7a96668345809975af5d39336.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_010780e7a96668345809975af5d39336.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_010780e7a96668345809975af5d39336.exe2⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5005ad871fe3a51d3f7b8a92cc801ee8e
SHA10b4962f405a818d86aae2c3f6948f87e9b5a7c71
SHA25607be02c20531767a9ff6ecc28ecb8e7bbbcf25752ecb21123db9bac689efef3e
SHA512fbb10b8db5455e9e597dcd8ad066560a1f448a18c608f218a9cde2c5c6c03065a0c3cc3c9eb5db3404d5530d51f1de43c5a1eb9bcd449cd620aeffafbfbd4f11
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
56KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
4KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB