Overview

overview

10

Static

static

10

ccd36a7a88...18.exe

windows7-x64

10

ccd36a7a88...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ccd36a7a88b817167d87e8c321597f4e_JaffaCakes118

  • Size

    2.0MB

  • Sample

    241206-nxbnhswjh1

  • MD5

    ccd36a7a88b817167d87e8c321597f4e

  • SHA1

    a9cfeac34629b89cc1bd484ffa71e85141f54c4e

  • SHA256

    b23ef3c239b2296e7cf083b738a6fb7ad32c7125cccbf9c1b4b38bcb5ddad516

  • SHA512

    e176044f65c9288e008b3f8c0a1546b2c108b2be133209c84f1d402bb21db4793f5ed762a570ad16eadb2c99a7a8b7270487a46b5b7f793e0020946f1567bb49

  • SSDEEP

    49152:EhNDQ14n+tTb52LVucsFaBgv4TV6JzMsJIz2Ee08O3kp:yDQ14+52huX+oMbz33u

Score
10/10
modiloaderbootkitdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      ccd36a7a88b817167d87e8c321597f4e_JaffaCakes118

    • Size

      2.0MB

    • MD5

      ccd36a7a88b817167d87e8c321597f4e

    • SHA1

      a9cfeac34629b89cc1bd484ffa71e85141f54c4e

    • SHA256

      b23ef3c239b2296e7cf083b738a6fb7ad32c7125cccbf9c1b4b38bcb5ddad516

    • SHA512

      e176044f65c9288e008b3f8c0a1546b2c108b2be133209c84f1d402bb21db4793f5ed762a570ad16eadb2c99a7a8b7270487a46b5b7f793e0020946f1567bb49

    • SSDEEP

      49152:EhNDQ14n+tTb52LVucsFaBgv4TV6JzMsJIz2Ee08O3kp:yDQ14+52huX+oMbz33u

    Score
    10/10
    modiloaderbootkitdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies WinLogon for persistence

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks