General
- Target 0f7e42638c9af30868a26ba1bb3ec3eb_JaffaCakes118
- Size 353KB
- Sample240503-c8243adb51
- SHA256 344616174a27817a2074dd8b8e8e5c9836e326ffd5271f2f96277ba8c918e051
Score
10/10
Malware Config
Targets
-
- Target 0f7e42638c9af30868a26ba1bb3ec3eb_JaffaCakes118
- Size 353KB
- SHA256 344616174a27817a2074dd8b8e8e5c9836e326ffd5271f2f96277ba8c918e051
Score10/10ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
Checks for common network interception software
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
Looks for VirtualBox Guest Additions in registry
Looks for VirtualBox drivers on disk
ModiLoader Second Stage
Looks for VMWare Tools registry key
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Deletes itself
Adds Run key to start application
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
Drops file in System32 directory
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1