Analysis
-
max time kernel
146s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
29/03/2025, 19:55
General
-
Target
JaffaCakes118_966fcbcb17dfc2f6c1457d28fb369ade.exe
-
Size
372KB
-
MD5
966fcbcb17dfc2f6c1457d28fb369ade
-
SHA1
738b1818def1d22e81565dc6cca30f892b0ba2da
-
SHA256
e493d287a40c92f0b00a2ebe8d6dc542cdbcb90f126e6e7c7ad564dfcd651bef
-
SHA512
5448307a7bf7d19e6be1c5b9b10caa62b42ee01ee730ef699b59d8562083984bc736d929132a0d50eb818809220576b05a528bd0f9e2582e0c38ee5ddac1e1ee
-
SSDEEP
6144:JBgh/58KGip9lmh0UwwDdxtPw13OyhFR8uHQagYI9FFweu9DEFx1hs:JBMmKGnhDT+JlCnFweu9DEFS
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 24 IoCs
-
Loads dropped DLL 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
AutoIT Executable 15 IoCs
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext 1 IoCs
-
UPX packed file 44 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_966fcbcb17dfc2f6c1457d28fb369ade.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_966fcbcb17dfc2f6c1457d28fb369ade.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_966fcbcb17dfc2f6c1457d28fb369ade.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_966fcbcb17dfc2f6c1457d28fb369ade.exe"2⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD576ad6e63218fa2dc1eac68d260c1226a
SHA1a99814ae6c6f5c0174b520307c6645807ca70856
SHA2566cacc739ee10d0aab2b5abbdb1716b6d32a7983f553acdc0d6b9574ad13f24ba
SHA512ab9e034c993576206b9d2f27cc4f3815af4b068e1fcebad1c414fbfb348bffe84830240542862f062dfbd5528a0b4cc97be48e2d162d2fd6963b9a63610837f7
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB