Overview

overview

10

Static

static

10

f92a411ea3...18.exe

windows7-x64

10

f92a411ea3...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f92a411ea31666fae2c8213055ed34eb_JaffaCakes118

  • Size

    273KB

  • Sample

    240926-ztagtszhmc

  • MD5

    f92a411ea31666fae2c8213055ed34eb

  • SHA1

    24f0dddeae69510c82565e5a12e646c59f5e7c33

  • SHA256

    757e0d1e1c2e9bb8685d9c69c9b8bfc04e59a199d7616cb217b3ff011ffdc78c

  • SHA512

    cf1a63f4ade1599d66558fc304c6b58f6dd03c7623457c0c038886b19b70e5383aa53243e48552da53459caf2295db0adb0f823dc5fb9dd69e5de6ef683e2dbe

  • SSDEEP

    6144:kG377xS2Vp2CeiorXdwTBgWx4W53ypcCJJvH:fr7xS2Vp6RwTyCKbJJvH

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      f92a411ea31666fae2c8213055ed34eb_JaffaCakes118

    • Size

      273KB

    • MD5

      f92a411ea31666fae2c8213055ed34eb

    • SHA1

      24f0dddeae69510c82565e5a12e646c59f5e7c33

    • SHA256

      757e0d1e1c2e9bb8685d9c69c9b8bfc04e59a199d7616cb217b3ff011ffdc78c

    • SHA512

      cf1a63f4ade1599d66558fc304c6b58f6dd03c7623457c0c038886b19b70e5383aa53243e48552da53459caf2295db0adb0f823dc5fb9dd69e5de6ef683e2dbe

    • SSDEEP

      6144:kG377xS2Vp2CeiorXdwTBgWx4W53ypcCJJvH:fr7xS2Vp6RwTyCKbJJvH

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks