General
-
Target
18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118
-
Size
875KB
-
Sample
240628-chsgyayamk
-
MD5
18669652b47dc9bbacea0b790bc47e1c
-
SHA1
6b852f8c039052bfd7f5c94b486c4e7c040a8077
-
SHA256
76081536605f54e193127ce89901ec20dcb94782cc4c28a8c2cfb58521b23bf4
-
SHA512
d1023c4c071240b1ca01da705eeb83f7b4bd17adfa658982326cc293ee80f1a088b5c1adab7fbce4f24ce5189443e3901df98c786abd7cf2f0427ecc278f60ec
-
SSDEEP
24576:B5T0kUJQCdHVFQlyOW8oooiAhYJWtA7q:B53UVHVFQAp5iAOgtAG
Behavioral task
behavioral1
Sample
18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118
-
Size
875KB
-
MD5
18669652b47dc9bbacea0b790bc47e1c
-
SHA1
6b852f8c039052bfd7f5c94b486c4e7c040a8077
-
SHA256
76081536605f54e193127ce89901ec20dcb94782cc4c28a8c2cfb58521b23bf4
-
SHA512
d1023c4c071240b1ca01da705eeb83f7b4bd17adfa658982326cc293ee80f1a088b5c1adab7fbce4f24ce5189443e3901df98c786abd7cf2f0427ecc278f60ec
-
SSDEEP
24576:B5T0kUJQCdHVFQlyOW8oooiAhYJWtA7q:B53UVHVFQAp5iAOgtAG
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies security service
-
Modifies visiblity of hidden/system files in Explorer
-
ModiLoader Second Stage
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Active Setup
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Active Setup
1Defense Evasion
Modify Registry
6Hide Artifacts
1Hidden Files and Directories
1