Overview

overview

10

Static

static

3

JaffaCakes...a1.exe

windows7-x64

10

JaffaCakes...a1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6612d4fc1243e4b721a8cdf2d2b13ba1

  • Size

    492KB

  • Sample

    250102-srsr3ayqgk

  • MD5

    6612d4fc1243e4b721a8cdf2d2b13ba1

  • SHA1

    1c7167da04aa51c3c7c6194b43e9388d1159677a

  • SHA256

    6e470fea96558deac57470867ca8a62f8c1c2cb8d851b1e1f9d9d32b7d2a442a

  • SHA512

    e9fc72c8be2c5b7c3bdd28277f4f3a4c4a7307064bc80ed4f75ecec22a5ddc4ee39871bdffbdc84a8d30b9fb426054aee84af5958ed4432194100400c64a660e

  • SSDEEP

    12288:njuTkMa586N2rAs3e3D35UQpXyjWz8iu6pqXALLbr2U7QFxyzw:nsUNl6yD2KXYWzj3rZQFz

Score
10/10
modiloaderdiscoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      JaffaCakes118_6612d4fc1243e4b721a8cdf2d2b13ba1

    • Size

      492KB

    • MD5

      6612d4fc1243e4b721a8cdf2d2b13ba1

    • SHA1

      1c7167da04aa51c3c7c6194b43e9388d1159677a

    • SHA256

      6e470fea96558deac57470867ca8a62f8c1c2cb8d851b1e1f9d9d32b7d2a442a

    • SHA512

      e9fc72c8be2c5b7c3bdd28277f4f3a4c4a7307064bc80ed4f75ecec22a5ddc4ee39871bdffbdc84a8d30b9fb426054aee84af5958ed4432194100400c64a660e

    • SSDEEP

      12288:njuTkMa586N2rAs3e3D35UQpXyjWz8iu6pqXALLbr2U7QFxyzw:nsUNl6yD2KXYWzj3rZQFz

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Enumerates processes with tasklist

      discovery

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks