Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
03/07/2024, 22:34
General
-
Target
23adac595a4a2be82e7838ed98d9e768_JaffaCakes118.exe
-
Size
536KB
-
MD5
23adac595a4a2be82e7838ed98d9e768
-
SHA1
0701b89d4fd029f4061617ad56537e3d0bb493a3
-
SHA256
0fa8bc823cf03e1bd58412d7c3fd01bcc8dc9e8bc70855b2db505b01b27efe3d
-
SHA512
7cacb49e59ed5a318f59e57dbc29598bda5b5c5a28ad39e4043339b367cf0ece6a2208a67bd5f666ece43d82f2f243d65a605062103b5e8b7f0d3184d6fab04b
-
SSDEEP
12288:8aICCl4aBSX9DWXbM2Hp9BmrbO4u52eLwIoHKR+/1xR8l9h:Ojl4iStDWo2fBmrI5ToKs6h
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\23adac595a4a2be82e7838ed98d9e768_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\23adac595a4a2be82e7838ed98d9e768_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB