General
-
Target
4190670a189b03fa8d4a61d50ac5be80_JaffaCakes118
-
Size
280KB
-
Sample
240514-p4ty4sgd58
-
MD5
4190670a189b03fa8d4a61d50ac5be80
-
SHA1
739b72f3b5d83114fca289918e901562c68239ed
-
SHA256
4a267ff8a165f16aa287dc9ed2643b558b8578252c52fb6aaa198bb907751158
-
SHA512
87c74725af6c55511cff83cf3886785786c37223cf5fe0323311a26d011535e8188bf3dd0f1ac5c352cc74b15fe77cb0fa67a9cf683c67da673ab938b879f3ec
-
SSDEEP
6144:7y9n70iH6yfi3hRgmDRgHRW456Oex1Vu5:7y9SyfEDRgH845M3q
Malware Config
Targets
-
-
Target
4190670a189b03fa8d4a61d50ac5be80_JaffaCakes118
-
Size
280KB
-
MD5
4190670a189b03fa8d4a61d50ac5be80
-
SHA1
739b72f3b5d83114fca289918e901562c68239ed
-
SHA256
4a267ff8a165f16aa287dc9ed2643b558b8578252c52fb6aaa198bb907751158
-
SHA512
87c74725af6c55511cff83cf3886785786c37223cf5fe0323311a26d011535e8188bf3dd0f1ac5c352cc74b15fe77cb0fa67a9cf683c67da673ab938b879f3ec
-
SSDEEP
6144:7y9n70iH6yfi3hRgmDRgHRW456Oex1Vu5:7y9SyfEDRgH845M3q
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks for common network interception software
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VirtualBox drivers on disk
-
ModiLoader Second Stage
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Deletes itself
-
Drops startup file
-
Adds Run key to start application
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1