Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

759cd76c94...18.exe

windows7-x64

10

759cd76c94...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    26/07/2024, 20:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    759cd76c94fbd48a0341abfe88abfa98_JaffaCakes118.exe

  • Size

    43KB

  • MD5

    759cd76c94fbd48a0341abfe88abfa98

  • SHA1

    b7ce525e857fe34e9c7cf1fd5cb288d941cd621e

  • SHA256

    d8a384183e01127e892d8f7545fbc5c22333e08bf2251282e130dd445957e641

  • SHA512

    79d0dbfb9c84e5ea4f44238a36f47c9e782f602b666de20119c01eaef65299fc10ee9b788d6d0b8ac1bc84d1e781ed92371bc9b6bc0fdc5aec4469f62ad33ff8

  • SSDEEP

    768:kvVElnMvr0kTCNMm3Deg06m4cb5WOvi4oUw46c538HbP1MTp8WiUQS3+vxoha5re:kvVEJjMm3Deg9AQ4w46c538HbPW+vUQ0

Score
10/10
modiloadertrojan

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • ModiLoader Second Stage 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\759cd76c94fbd48a0341abfe88abfa98_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\759cd76c94fbd48a0341abfe88abfa98_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    PID:2648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Program Files\Common Files\Microsoft Shared\MSInfo\SysInfo2.dll
    Filesize

    56KB

    MD5

    04cb97773c95887787a02e04ec3908af

    SHA1

    6b64496d03b007de6f3acbaa977a353e514df72a

    SHA256

    d13911770deb902ec08e6e45c792fe40540d81c19ed24c39ddf20a1452171efe

    SHA512

    d05b9b6ad21df43b606fe4cec8427ea0f1ec0c02e8b3e3931414225a6ede5db0118bf084c8d21ba717cf59a11470d592989e8d6af3ba3fd6d5c6eb01ca8b8a82

    Download Submit

  • memory/2648-3-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

    Download