General

  • Target

    09064c3bbdf291a2f85c1a049d8bd9df_JaffaCakes118

  • Size

    572KB

  • Sample

    240620-xzyqhatcnd

  • MD5

    09064c3bbdf291a2f85c1a049d8bd9df

  • SHA1

    320eacbd12d6f117885364bd64f1f9e9f99b54b2

  • SHA256

    da42c9b97c23142f2d08d9d042995a69a687c2d18019d0c21c53ed683f618f10

  • SHA512

    726d73dbe57fd33bcc47e499b348ddafdfd5b20b504d51274ca906ba1054d91db355438667e86d8c4342b9ec09fdcbb8ff5d8a9272e9cd9c1e5810f88a670fe6

  • SSDEEP

    12288:pr7xS2Vp6FwTDAbJJvH2oSnSt7KqnGHbq:zS2Vp6FwTWJvHJt7AHb

Malware Config

Targets

    • Target

      09064c3bbdf291a2f85c1a049d8bd9df_JaffaCakes118

    • Size

      572KB

    • MD5

      09064c3bbdf291a2f85c1a049d8bd9df

    • SHA1

      320eacbd12d6f117885364bd64f1f9e9f99b54b2

    • SHA256

      da42c9b97c23142f2d08d9d042995a69a687c2d18019d0c21c53ed683f618f10

    • SHA512

      726d73dbe57fd33bcc47e499b348ddafdfd5b20b504d51274ca906ba1054d91db355438667e86d8c4342b9ec09fdcbb8ff5d8a9272e9cd9c1e5810f88a670fe6

    • SSDEEP

      12288:pr7xS2Vp6FwTDAbJJvH2oSnSt7KqnGHbq:zS2Vp6FwTWJvHJt7AHb

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • UAC bypass

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks