General
- Target 2523d4c29b570652b608f5026b3f068e_JaffaCakes118
- Size 356KB
- Sample240508-q5wprsff71
- SHA256 856c83e4bd9e463cfc0ee5ad88ad9e459a540db080630ea19b9de42926ba4f2a
Score
10/10
Malware Config
Targets
-
- Target 2523d4c29b570652b608f5026b3f068e_JaffaCakes118
- Size 356KB
- SHA256 856c83e4bd9e463cfc0ee5ad88ad9e459a540db080630ea19b9de42926ba4f2a
Score10/10ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
Checks for common network interception software
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
Looks for VirtualBox Guest Additions in registry
Looks for VirtualBox drivers on disk
ModiLoader Second Stage
Looks for VMWare Tools registry key
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Deletes itself
Adds Run key to start application
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
Drops file in System32 directory
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1