Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    654b69623060b9d0994cd2c14fc5c357_JaffaCakes118

  • Size

    668KB

  • Sample

    240722-3shctsveqb

  • MD5

    654b69623060b9d0994cd2c14fc5c357

  • SHA1

    1226e9dd4ca8243997c7b1bbac6e1686d08d1af5

  • SHA256

    f5be6e5001a47d22eea6f9b4912a0142ff7cc86f075324fbb967f931fbb833b1

  • SHA512

    9ec952e27eab08916ad31d9a6fe47f988793485b033e1680976a34fefc1a3e5df8dd6ed70b54882f29ddd66703da9c0b803f43253a575ae584f2a64774f2ff80

  • SSDEEP

    12288:fqUfin1qJm/9e/sK1RaAXPTytF3Z4mxxukly74G1TBecNQP2d6sb0:SUf4IWQ7aAXutQmXPy74GpBeDP2d660

Score
10/10

Malware Config

Targets

    • Target

      654b69623060b9d0994cd2c14fc5c357_JaffaCakes118

    • Size

      668KB

    • MD5

      654b69623060b9d0994cd2c14fc5c357

    • SHA1

      1226e9dd4ca8243997c7b1bbac6e1686d08d1af5

    • SHA256

      f5be6e5001a47d22eea6f9b4912a0142ff7cc86f075324fbb967f931fbb833b1

    • SHA512

      9ec952e27eab08916ad31d9a6fe47f988793485b033e1680976a34fefc1a3e5df8dd6ed70b54882f29ddd66703da9c0b803f43253a575ae584f2a64774f2ff80

    • SSDEEP

      12288:fqUfin1qJm/9e/sK1RaAXPTytF3Z4mxxukly74G1TBecNQP2d6sb0:SUf4IWQ7aAXutQmXPy74GpBeDP2d660

    Score
    10/10
    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • ModiLoader Second Stage

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks