Overview

overview

10

Static

static

3

cf172765e9...18.exe

windows7-x64

10

cf172765e9...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cf172765e99d90e176ccdefb830112a2_JaffaCakes118

  • Size

    843KB

  • Sample

    240906-j6bbwswarl

  • MD5

    cf172765e99d90e176ccdefb830112a2

  • SHA1

    d497ec671d78d3c17b27c7d69353fc0876f38b3a

  • SHA256

    69f86109034e5b727474a035e631547f70b32b9e99bfcc5a24a01091f211ead1

  • SHA512

    8eb2e265417f031bb0a828bf99b1fd01fbe83387aecfd048eb1f04412e2bcb40303ab27c15f06165683c188ed9ae51da5c07b79653747cec9a239db558aaffa6

  • SSDEEP

    12288:56WJShs4WdUBfvckyntKjF2Vw0nUmmm3qjRhwvRNjOW0n3RCd1zMKv:56W0GZcfvRynkAOm4jRhOP0nsL4K

Score
10/10
modiloaderdiscoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      cf172765e99d90e176ccdefb830112a2_JaffaCakes118

    • Size

      843KB

    • MD5

      cf172765e99d90e176ccdefb830112a2

    • SHA1

      d497ec671d78d3c17b27c7d69353fc0876f38b3a

    • SHA256

      69f86109034e5b727474a035e631547f70b32b9e99bfcc5a24a01091f211ead1

    • SHA512

      8eb2e265417f031bb0a828bf99b1fd01fbe83387aecfd048eb1f04412e2bcb40303ab27c15f06165683c188ed9ae51da5c07b79653747cec9a239db558aaffa6

    • SSDEEP

      12288:56WJShs4WdUBfvckyntKjF2Vw0nUmmm3qjRhwvRNjOW0n3RCd1zMKv:56W0GZcfvRynkAOm4jRhOP0nsL4K

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks