Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

c0118eec5c...18.exe

windows7-x64

10

c0118eec5c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c0118eec5cb782536073327ab65aec67_JaffaCakes118

  • Size

    673KB

  • Sample

    240825-gdmhcaxerf

  • MD5

    c0118eec5cb782536073327ab65aec67

  • SHA1

    ea27b890f873f5c7011ade3beda3c1f3f6a97fe7

  • SHA256

    2669b69ec69dfd251a32e327180fcc3b30c1d9fa451cb15ffb00fb8cb0e2d591

  • SHA512

    f1f1ac8759c1a9285c69388e8a485d84ccf3177c541e3b6ffb1c847263793f00cae84a2fb88b4f768c24e3fadd588e55f6c4f2cb44ba7146846b04121f5108fc

  • SSDEEP

    12288:jmaWd0zLoWcodNpB4VnBcQXF3Z4mxx7d4t0KIi1sjJ1gV0wfIc1Pa:6aWuwedjmBRXQmX7qtz1GjJYICPa

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      c0118eec5cb782536073327ab65aec67_JaffaCakes118

    • Size

      673KB

    • MD5

      c0118eec5cb782536073327ab65aec67

    • SHA1

      ea27b890f873f5c7011ade3beda3c1f3f6a97fe7

    • SHA256

      2669b69ec69dfd251a32e327180fcc3b30c1d9fa451cb15ffb00fb8cb0e2d591

    • SHA512

      f1f1ac8759c1a9285c69388e8a485d84ccf3177c541e3b6ffb1c847263793f00cae84a2fb88b4f768c24e3fadd588e55f6c4f2cb44ba7146846b04121f5108fc

    • SSDEEP

      12288:jmaWd0zLoWcodNpB4VnBcQXF3Z4mxx7d4t0KIi1sjJ1gV0wfIc1Pa:6aWuwedjmBRXQmX7qtz1GjJYICPa

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks