General
- Target 1d5e6f06b05e39f726439c058ff11ebf_JaffaCakes118
- Size 270KB
- Sample240506-txd2jadc59
- SHA256 70668c180217f0354ad3da0b852948423b4217cbc8f3cffb986430bd5e5d910c
Score
10/10
Malware Config
Targets
-
- Target 1d5e6f06b05e39f726439c058ff11ebf_JaffaCakes118
- Size 270KB
- SHA256 70668c180217f0354ad3da0b852948423b4217cbc8f3cffb986430bd5e5d910c
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks whether UAC is enabled
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1