Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
11/07/2024, 07:23
General
-
Target
3833d145deb51045263eecc433f72fb8_JaffaCakes118.exe
-
Size
95KB
-
MD5
3833d145deb51045263eecc433f72fb8
-
SHA1
ab916eff5ec4f679e0130b5e1c8d5b8dc833b428
-
SHA256
4320c709971fee0240c0474182b1606ad6b71dff7fe1796be34521b79c6d917f
-
SHA512
d89a971b1dde908b9aecfec931021887ad81d62996b5ca78340829666583bc303fb419a10805241608955824ef99a828a7a883d6311989be0733d9fca79e66f8
-
SSDEEP
1536:B71Je9+W+eXjNBDm9NAsPsFdOUC6TtgegbhcTXSbJakuwP2joHDLXaHQmPg:B7/LW55xmnEFdOkty96CN1OsHDMP
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3833d145deb51045263eecc433f72fb8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3833d145deb51045263eecc433f72fb8_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3833d145deb51045263eecc433f72fb8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3833d145deb51045263eecc433f72fb8_JaffaCakes118.exe2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5766a974784977e4c4f9aef3ff9d52c7a
SHA19195373d16a505394cfef92091866c1e6dfa90b5
SHA256d0a271165ddd57f07f31cc893f1fa01d35ae3bd2870a25b09883c6668ec4591e
SHA512d463bfac26acf2ada5208ca1aea8355f06b9d4a1cb4e7749cd19c1a08bfc59de8711f4321ebc13eaa043b4e43947465277e07feae4c3dc154c18a2de7fa8113b
-
Filesize
8KB
MD5a082e5473b2a9a4d846ed7ddf637ac76
SHA11703f7969a6e76f8458eda3e8e40fd115c0bfdc3
SHA25673f7171c2af70ccf8ee4c49626fb456807a6a668f6a967298dcd5ed29773bd2a
SHA512abc1ea5a46d0784db23ddd9bd984527913c3e40a3896cfa43e9f4f999e4064038b24aed78e27bf2e705c8c55482e801f520987c2a74be6f01edc32df3d235eaa
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
180KB