Overview

overview

10

Static

static

3

ccafbc0dc9...18.exe

windows7-x64

10

ccafbc0dc9...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118

  • Size

    894KB

  • Sample

    241206-nbccxszrbn

  • MD5

    ccafbc0dc9af3a1e10cf69eea429fb96

  • SHA1

    884a0a8d8b4c0f165b56f831e953f05082ab08a3

  • SHA256

    c3d8ab3258f3a6c98fd4da79c60973a1c0989e39811920b96847812a29e50aa1

  • SHA512

    bbd36de70d7820da19dc8666bed2e26ba010aafe8448db9201ded2b9152a90e18e6311649c630ae30884ac6629e57a24d14db64c598f2abfb2e1996fdb0d88c5

  • SSDEEP

    12288:Yxo7YNQg2YcKify3iTntxrr0cuUPnIpVwDIX9cgtWb2/ExgDj48uSeJro0okzLPs:YKwQrsiK3Sr0ckHCb2Mxg348uS8oqzLE

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118

    • Size

      894KB

    • MD5

      ccafbc0dc9af3a1e10cf69eea429fb96

    • SHA1

      884a0a8d8b4c0f165b56f831e953f05082ab08a3

    • SHA256

      c3d8ab3258f3a6c98fd4da79c60973a1c0989e39811920b96847812a29e50aa1

    • SHA512

      bbd36de70d7820da19dc8666bed2e26ba010aafe8448db9201ded2b9152a90e18e6311649c630ae30884ac6629e57a24d14db64c598f2abfb2e1996fdb0d88c5

    • SSDEEP

      12288:Yxo7YNQg2YcKify3iTntxrr0cuUPnIpVwDIX9cgtWb2/ExgDj48uSeJro0okzLPs:YKwQrsiK3Sr0ckHCb2Mxg348uS8oqzLE

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks