Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    48e82ab4975db8d8e4a4ece89d3c02c2_JaffaCakes118

  • Size

    116KB

  • Sample

    240715-jweassygpe

  • MD5

    48e82ab4975db8d8e4a4ece89d3c02c2

  • SHA1

    545fb75e578feab5967feb01d01a81f57a504b62

  • SHA256

    aedbbdca5d129120d0b93affffe07b79ed8db8ed3a53fd7670bc4dc6ddb0afac

  • SHA512

    3236ae0e99384736f187e7cc873065233d8317bd0f62bade90b2003fef7b3f57e95a76cd5676ea5fabd4cf9f5e24a5eee26a0485e2a4156d6e5382242d862dc8

  • SSDEEP

    3072:0oy8j7VnNdrPHaSekwi+mWFd1aGkioTAOeWwhhF9out:k8jZ7rvaU3+mWr1aG4TAOexhh3oS

Malware Config

Targets

    • Target

      48e82ab4975db8d8e4a4ece89d3c02c2_JaffaCakes118

    • Size

      116KB

    • MD5

      48e82ab4975db8d8e4a4ece89d3c02c2

    • SHA1

      545fb75e578feab5967feb01d01a81f57a504b62

    • SHA256

      aedbbdca5d129120d0b93affffe07b79ed8db8ed3a53fd7670bc4dc6ddb0afac

    • SHA512

      3236ae0e99384736f187e7cc873065233d8317bd0f62bade90b2003fef7b3f57e95a76cd5676ea5fabd4cf9f5e24a5eee26a0485e2a4156d6e5382242d862dc8

    • SSDEEP

      3072:0oy8j7VnNdrPHaSekwi+mWFd1aGkioTAOeWwhhF9out:k8jZ7rvaU3+mWr1aG4TAOexhh3oS

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • UAC bypass

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks