Overview

overview

10

Static

static

3

JaffaCakes...aa.exe

windows7-x64

10

JaffaCakes...aa.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_414350e085d768c631c2a09c8d2e9caa

  • Size

    719KB

  • Sample

    250101-a6y9aa1jcj

  • MD5

    414350e085d768c631c2a09c8d2e9caa

  • SHA1

    4789e878650bc54e6a8fb92430adf061d560f4c2

  • SHA256

    8edd163859cc0a1d8ac9cbb63dfa0ce5d7fbf2e37062dc0d0d101b413b20afb8

  • SHA512

    027105d7ccad7a404af46918fa4a7f1b59740e804dc7c0d1dbb7b6f319c739d4d3de9876c5007101bc2b9b7305efe5875afd4b037a32a84216fd70daed116792

  • SSDEEP

    12288:6XgPVmsO7H+JeYkZQors8sEyMGXxeZlX4EEPSwDfAmgBJbf8AwnBrRm8dZ/X:AoZ3J78GKX4bEmCb+rRvZ/X

Score
10/10
modiloaderbootkitdefense_evasiondiscoverypersistencetrojan

Malware Config

Targets

    • Target

      JaffaCakes118_414350e085d768c631c2a09c8d2e9caa

    • Size

      719KB

    • MD5

      414350e085d768c631c2a09c8d2e9caa

    • SHA1

      4789e878650bc54e6a8fb92430adf061d560f4c2

    • SHA256

      8edd163859cc0a1d8ac9cbb63dfa0ce5d7fbf2e37062dc0d0d101b413b20afb8

    • SHA512

      027105d7ccad7a404af46918fa4a7f1b59740e804dc7c0d1dbb7b6f319c739d4d3de9876c5007101bc2b9b7305efe5875afd4b037a32a84216fd70daed116792

    • SSDEEP

      12288:6XgPVmsO7H+JeYkZQors8sEyMGXxeZlX4EEPSwDfAmgBJbf8AwnBrRm8dZ/X:AoZ3J78GKX4bEmCb+rRvZ/X

    Score
    10/10
    modiloaderbootkitdefense_evasiondiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks