General
-
Target
29b11d8f057a3c0fb9afec467b7de9af_JaffaCakes118
-
Size
807KB
-
Sample
240707-dprpnasdlr
-
MD5
29b11d8f057a3c0fb9afec467b7de9af
-
SHA1
e8f856aecf3aab221c07891c84ff83731b28df0d
-
SHA256
2f385f6c7ae6dd8c81f908f73a6c1e6f6fd53fcfc4c8186eb3cd1d0951ab8c9c
-
SHA512
51ca9d6428fbc3865d964029d05c92be1b3383a7f9f3e8fe6c19cd5678d0194481a4a94bfd2086d799cc0a61592f228260240402f56e7dc41cc1266e0b9b8d04
-
SSDEEP
24576:FYkjlfgR+tmbs1t9qgYohxfloUZhjaoJKwbgy:FYsfhtmMKcoUvPJKwbgy
Behavioral task
behavioral1
Sample
29b11d8f057a3c0fb9afec467b7de9af_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
29b11d8f057a3c0fb9afec467b7de9af_JaffaCakes118.exe
Resource
win10v2004-20240704-en
Malware Config
Targets
-
-
Target
29b11d8f057a3c0fb9afec467b7de9af_JaffaCakes118
-
Size
807KB
-
MD5
29b11d8f057a3c0fb9afec467b7de9af
-
SHA1
e8f856aecf3aab221c07891c84ff83731b28df0d
-
SHA256
2f385f6c7ae6dd8c81f908f73a6c1e6f6fd53fcfc4c8186eb3cd1d0951ab8c9c
-
SHA512
51ca9d6428fbc3865d964029d05c92be1b3383a7f9f3e8fe6c19cd5678d0194481a4a94bfd2086d799cc0a61592f228260240402f56e7dc41cc1266e0b9b8d04
-
SSDEEP
24576:FYkjlfgR+tmbs1t9qgYohxfloUZhjaoJKwbgy:FYsfhtmMKcoUvPJKwbgy
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies security service
-
Modifies visiblity of hidden/system files in Explorer
-
ModiLoader Second Stage
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Active Setup
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Active Setup
1Defense Evasion
Modify Registry
6Hide Artifacts
1Hidden Files and Directories
1