General

  • Target

    147330a7ec2e27e2ed0fe0e921d45087_JaffaCakes118

  • Size

    115KB

  • Sample

    240504-zqyp9aba6s

  • MD5

    147330a7ec2e27e2ed0fe0e921d45087

  • SHA1

    5c1113d0280326cef5f4085f7620a81001837041

  • SHA256

    92247fc31f92d78870fbb2de0226d1f54ecb04534a04a265bd9b82159543a7ee

  • SHA512

    4284af59a6b7391e661c9af3c953204e511d91ce26e7db1e6fd322bfdcde627d86e9b616af6ebdae56834d6a3b4d4ca0c4482f289f8138e5abf19988754cba14

  • SSDEEP

    1536:htKa4ZMnzF22qNmTIMhboDlYkAN5xsnm7UAYekc9oG9/Jmi7Rt/T0:WBZ6zQ2qYTxbp1AYqH4oG9rRt/T0

Malware Config

Targets

    • Target

      147330a7ec2e27e2ed0fe0e921d45087_JaffaCakes118

    • Size

      115KB

    • MD5

      147330a7ec2e27e2ed0fe0e921d45087

    • SHA1

      5c1113d0280326cef5f4085f7620a81001837041

    • SHA256

      92247fc31f92d78870fbb2de0226d1f54ecb04534a04a265bd9b82159543a7ee

    • SHA512

      4284af59a6b7391e661c9af3c953204e511d91ce26e7db1e6fd322bfdcde627d86e9b616af6ebdae56834d6a3b4d4ca0c4482f289f8138e5abf19988754cba14

    • SSDEEP

      1536:htKa4ZMnzF22qNmTIMhboDlYkAN5xsnm7UAYekc9oG9/Jmi7Rt/T0:WBZ6zQ2qYTxbp1AYqH4oG9rRt/T0

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Modifies WinLogon for persistence

    • Looks for VirtualBox Guest Additions in registry

    • ModiLoader Second Stage

    • Adds policy Run key to start application

    • Disables RegEdit via registry modification

    • Disables Task Manager via registry modification

    • Looks for VMWare Tools registry key

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Adds Run key to start application

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v15

Tasks