Overview

overview

10

Static

static

5

cd3ba17007...18.exe

windows7-x64

10

cd3ba17007...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118

  • Size

    534KB

  • Sample

    241206-qpe23szjez

  • MD5

    cd3ba1700710ebbceea51b6b49cada5b

  • SHA1

    481ae12d396fb6e44209e328d3c54756710e43e1

  • SHA256

    d8242255fced86d7dda9ee9335e73e135a86e0a886288ee8eaf86ba25c7e29b8

  • SHA512

    7b229bdcce274a5465d9da1b31f99d35394f5591b85cdf827bef5e0b8d27fea5f15a18404d412935d4e6df4e4ebb21c98b95040e0af2072a32a0df59787b4552

  • SSDEEP

    12288:QBMmKGnhDT+JlCKgI08gnwUBVzsSMhcEKFZNylA8LFR3Gb:CMmnDC+IgJneKlyPFm

Score
10/10
modiloaderdiscoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118

    • Size

      534KB

    • MD5

      cd3ba1700710ebbceea51b6b49cada5b

    • SHA1

      481ae12d396fb6e44209e328d3c54756710e43e1

    • SHA256

      d8242255fced86d7dda9ee9335e73e135a86e0a886288ee8eaf86ba25c7e29b8

    • SHA512

      7b229bdcce274a5465d9da1b31f99d35394f5591b85cdf827bef5e0b8d27fea5f15a18404d412935d4e6df4e4ebb21c98b95040e0af2072a32a0df59787b4552

    • SSDEEP

      12288:QBMmKGnhDT+JlCKgI08gnwUBVzsSMhcEKFZNylA8LFR3Gb:CMmnDC+IgJneKlyPFm

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks