Resubmissions

06-05-2024 16:38

240506-t5chnsde69 10

06-05-2024 16:25

240506-txd2jadc59 10

General

  • Target

    1d5e6f06b05e39f726439c058ff11ebf_JaffaCakes118

  • Size

    270KB

  • Sample

    240506-t5chnsde69

  • MD5

    1d5e6f06b05e39f726439c058ff11ebf

  • SHA1

    5a6f3293d1980a7220ec3c264f4c87e5f5c4ba4f

  • SHA256

    70668c180217f0354ad3da0b852948423b4217cbc8f3cffb986430bd5e5d910c

  • SHA512

    f2ec95c96315d687cf8db05e1cf360e77e6bb84659e19ea5029b51d6ec6814b8aafe6e3deadb9bd0fc332b0794283d1f650494cec79dd4f7a4f2f8e3f4e4c1f0

  • SSDEEP

    6144:KG377xS2Vp2CeiorXhwTBOz53QpcCJJvH:Zr7xS2Vp6FwT/bJJvH

Malware Config

Targets

    • Target

      1d5e6f06b05e39f726439c058ff11ebf_JaffaCakes118

    • Size

      270KB

    • MD5

      1d5e6f06b05e39f726439c058ff11ebf

    • SHA1

      5a6f3293d1980a7220ec3c264f4c87e5f5c4ba4f

    • SHA256

      70668c180217f0354ad3da0b852948423b4217cbc8f3cffb986430bd5e5d910c

    • SHA512

      f2ec95c96315d687cf8db05e1cf360e77e6bb84659e19ea5029b51d6ec6814b8aafe6e3deadb9bd0fc332b0794283d1f650494cec79dd4f7a4f2f8e3f4e4c1f0

    • SSDEEP

      6144:KG377xS2Vp2CeiorXhwTBOz53QpcCJJvH:Zr7xS2Vp6FwT/bJJvH

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • UAC bypass

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks