General

  • Target

    10c6f2ab630e600b78ed200b381e7040_JaffaCakes118

  • Size

    270KB

  • Sample

    240503-r8q45ace49

  • MD5

    10c6f2ab630e600b78ed200b381e7040

  • SHA1

    fde4d24d51c1ce8990a6c4a95d31b54139cafd92

  • SHA256

    0bc43275172f6b2c4af4d7518beb64cad28ab6cddade83e042d89654e7bc8355

  • SHA512

    39f8a473b40615ebc98ca894dc2574f27a197c0fd238313c2a95a121a5976819984e58682d598f1e003e8d9063d7bdfdf949945d1704d221c9c0f4a847ee1d88

  • SSDEEP

    6144:KG377xS2Vp2CeiorXhwTBOz53ciSpcCJJvH:Zr7xS2Vp6FwTbiSbJJvH

Malware Config

Targets

    • Target

      10c6f2ab630e600b78ed200b381e7040_JaffaCakes118

    • Size

      270KB

    • MD5

      10c6f2ab630e600b78ed200b381e7040

    • SHA1

      fde4d24d51c1ce8990a6c4a95d31b54139cafd92

    • SHA256

      0bc43275172f6b2c4af4d7518beb64cad28ab6cddade83e042d89654e7bc8355

    • SHA512

      39f8a473b40615ebc98ca894dc2574f27a197c0fd238313c2a95a121a5976819984e58682d598f1e003e8d9063d7bdfdf949945d1704d221c9c0f4a847ee1d88

    • SSDEEP

      6144:KG377xS2Vp2CeiorXhwTBOz53ciSpcCJJvH:Zr7xS2Vp6FwTbiSbJJvH

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • UAC bypass

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks