General
-
Target
0034802f63e162402422a0ee421cdebb_JaffaCakes118
-
Size
203KB
-
Sample
240619-yhxybatbnj
-
MD5
0034802f63e162402422a0ee421cdebb
-
SHA1
8f7c8aec670598636c33a541b7bc6a53cc3e3bc5
-
SHA256
3464299477e20ea76deebacf67f27b8acf91b962d0e7cd024e32e5126c16b943
-
SHA512
447eebc239820c5384dae6f956e874448ddb4f06af0cd5ec29be511021904834668941c93d86d16822a54636e870e0621c20b49dad26acde1916980177703245
-
SSDEEP
3072:cRDV12ZPLu/5CmnSrFUkPUL2w5LSeDROhXBphUr4sdTtCsfhIMCPKzVnLoG:6f2ZTI5LShTtwLDsXBpKrFovM7
Static task
static1
Behavioral task
behavioral1
Sample
0034802f63e162402422a0ee421cdebb_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0034802f63e162402422a0ee421cdebb_JaffaCakes118.exe
Resource
win10v2004-20240611-en
Malware Config
Targets
-
-
Target
0034802f63e162402422a0ee421cdebb_JaffaCakes118
-
Size
203KB
-
MD5
0034802f63e162402422a0ee421cdebb
-
SHA1
8f7c8aec670598636c33a541b7bc6a53cc3e3bc5
-
SHA256
3464299477e20ea76deebacf67f27b8acf91b962d0e7cd024e32e5126c16b943
-
SHA512
447eebc239820c5384dae6f956e874448ddb4f06af0cd5ec29be511021904834668941c93d86d16822a54636e870e0621c20b49dad26acde1916980177703245
-
SSDEEP
3072:cRDV12ZPLu/5CmnSrFUkPUL2w5LSeDROhXBphUr4sdTtCsfhIMCPKzVnLoG:6f2ZTI5LShTtwLDsXBpKrFovM7
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1