Overview

overview

10

Static

static

3

d2844f556c...18.exe

windows7-x64

10

d2844f556c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d2844f556c8d6bd4d75b9abca9772024_JaffaCakes118

  • Size

    936KB

  • Sample

    240907-wg4clawfpk

  • MD5

    d2844f556c8d6bd4d75b9abca9772024

  • SHA1

    52792513b0c39ee30cb148edb4e8598a9e0ee3c2

  • SHA256

    f4b3657abfbbe988943094ece7d7ce7cd05d58f750b108e5c5dfffc34c79b813

  • SHA512

    f7179cd46f466e751b42293ec7f1d2abbe3e3a0d8c63dcf401d0bc06c790230c1efc65ae4a3fe3894a7fd349b48231fd08c24aed8a3c9f14e171893ca74bd5f6

  • SSDEEP

    12288:fhgJUWbgq9RS3o6RXn+B8JusH99cGnnxMUElF5QG+n5FggaVU:fCWWbgeRS3o6RXk2vHjKUEHFA5ygaU

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      d2844f556c8d6bd4d75b9abca9772024_JaffaCakes118

    • Size

      936KB

    • MD5

      d2844f556c8d6bd4d75b9abca9772024

    • SHA1

      52792513b0c39ee30cb148edb4e8598a9e0ee3c2

    • SHA256

      f4b3657abfbbe988943094ece7d7ce7cd05d58f750b108e5c5dfffc34c79b813

    • SHA512

      f7179cd46f466e751b42293ec7f1d2abbe3e3a0d8c63dcf401d0bc06c790230c1efc65ae4a3fe3894a7fd349b48231fd08c24aed8a3c9f14e171893ca74bd5f6

    • SSDEEP

      12288:fhgJUWbgq9RS3o6RXn+B8JusH99cGnnxMUElF5QG+n5FggaVU:fCWWbgeRS3o6RXk2vHjKUEHFA5ygaU

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies WinLogon for persistence

      persistence

    • ModiLoader Second Stage

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks