Overview

overview

10

Static

static

7

dfc171c302...18.exe

windows7-x64

10

dfc171c302...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dfc171c302a5b87a5d87160b467683cd_JaffaCakes118

  • Size

    654KB

  • Sample

    240914-jh5ktstcrc

  • MD5

    dfc171c302a5b87a5d87160b467683cd

  • SHA1

    103f3947b4be2b70c63c96b4905df9230baeb974

  • SHA256

    7f66a1c8db08ce2793d9a21e06ac839b3bde0649fdb69490a988162fc5c2121d

  • SHA512

    57006feb2406dd5d257b53eb9cb79bfb4bd96b949e34a2f4f346bbd969140dc7a69fa6988c8eb49c7f9fb8f41ce817e33f061c3ba91f451c5881dfd331b6c4d7

  • SSDEEP

    12288:NHLUMuiv9RgfSjAzRty9jpJ1T1uxp62KW8CcCzyU56RZv+HFkZhCO0:1tAR2X1Ev8W8CcQy2U1VZhE

Score
10/10
modiloaderdiscoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      dfc171c302a5b87a5d87160b467683cd_JaffaCakes118

    • Size

      654KB

    • MD5

      dfc171c302a5b87a5d87160b467683cd

    • SHA1

      103f3947b4be2b70c63c96b4905df9230baeb974

    • SHA256

      7f66a1c8db08ce2793d9a21e06ac839b3bde0649fdb69490a988162fc5c2121d

    • SHA512

      57006feb2406dd5d257b53eb9cb79bfb4bd96b949e34a2f4f346bbd969140dc7a69fa6988c8eb49c7f9fb8f41ce817e33f061c3ba91f451c5881dfd331b6c4d7

    • SSDEEP

      12288:NHLUMuiv9RgfSjAzRty9jpJ1T1uxp62KW8CcCzyU56RZv+HFkZhCO0:1tAR2X1Ev8W8CcQy2U1VZhE

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks