General

  • Target

    JaffaCakes118_e2964e5d62a89406d34f3a5a33b77863

  • Size

    856KB

  • Sample

    250120-k5fewsslak

  • MD5

    e2964e5d62a89406d34f3a5a33b77863

  • SHA1

    31af0d1ff34e9d2d4348568dd01fd394c6509c40

  • SHA256

    1dd90cd58fac054e47f1e83b49afa8a046b4e1ae83cdca1d40c67c0d5066c39f

  • SHA512

    59e50bbd2fc1db5fe09735041d1530a7403c5bb5a431ea0262044f967845bd38cdaf261064266da43c9c6b71f219dba9273716507568310fb22bbb3650afe269

  • SSDEEP

    12288:cJjCWhgzbBA8PtV9m2YkA4UrCuMtfQBSo7n4fUT2a6A2QeTF0XhMdUyGtd:cJmmgPbPikA43xsr4Y2a6A2nChuUr

Malware Config

Targets

    • Target

      JaffaCakes118_e2964e5d62a89406d34f3a5a33b77863

    • Size

      856KB

    • MD5

      e2964e5d62a89406d34f3a5a33b77863

    • SHA1

      31af0d1ff34e9d2d4348568dd01fd394c6509c40

    • SHA256

      1dd90cd58fac054e47f1e83b49afa8a046b4e1ae83cdca1d40c67c0d5066c39f

    • SHA512

      59e50bbd2fc1db5fe09735041d1530a7403c5bb5a431ea0262044f967845bd38cdaf261064266da43c9c6b71f219dba9273716507568310fb22bbb3650afe269

    • SSDEEP

      12288:cJjCWhgzbBA8PtV9m2YkA4UrCuMtfQBSo7n4fUT2a6A2QeTF0XhMdUyGtd:cJmmgPbPikA43xsr4Y2a6A2nChuUr

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • Modiloader family

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Enumerates processes with tasklist

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks