Overview

overview

10

Static

static

10

JaffaCakes...20.exe

windows7-x64

10

JaffaCakes...20.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_64f974faff2d0221870d9917c9fb3d20

  • Size

    270KB

  • Sample

    250102-pavnjs1nb1

  • MD5

    64f974faff2d0221870d9917c9fb3d20

  • SHA1

    a9fd4018145434b8c4d968d94451ee1d087ab002

  • SHA256

    ec38c00c658ec4dd6a89590fadbd62d3f32103bc7f5c4e1dd53e12590ae6fd9c

  • SHA512

    bd03215e30d480de12b13334032c4c3f96d9ad03270b1a37674cc4c49b498841e2657869ff541d67332892eb9756ed0e15a9c01554114d6a07bc35c2b0951a90

  • SSDEEP

    6144:9G377xS2Vp2CeiorXdwTBgWx4v53IpcCJJvH7:Ar7xS2Vp6RwTyCtbJJvH7

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      JaffaCakes118_64f974faff2d0221870d9917c9fb3d20

    • Size

      270KB

    • MD5

      64f974faff2d0221870d9917c9fb3d20

    • SHA1

      a9fd4018145434b8c4d968d94451ee1d087ab002

    • SHA256

      ec38c00c658ec4dd6a89590fadbd62d3f32103bc7f5c4e1dd53e12590ae6fd9c

    • SHA512

      bd03215e30d480de12b13334032c4c3f96d9ad03270b1a37674cc4c49b498841e2657869ff541d67332892eb9756ed0e15a9c01554114d6a07bc35c2b0951a90

    • SSDEEP

      6144:9G377xS2Vp2CeiorXdwTBgWx4v53IpcCJJvH7:Ar7xS2Vp6RwTyCtbJJvH7

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks