Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    dcec19431e1904709d7c0c76477f6091_JaffaCakes118

  • Size

    651KB

  • Sample

    240912-yc764a1aqr

  • MD5

    dcec19431e1904709d7c0c76477f6091

  • SHA1

    65156b02bc1665635822ac695f71ebd8f5ac4b8b

  • SHA256

    2015309f6c515a7769d249b1030a2b4e07637bb853e7fa1baab6916f9463cbbe

  • SHA512

    c22863d8f06fcea12bbdc33b463f97592b93445aa359681a6ed0908dbd30172ccdc0872f432de7735565941005a36670b2c11360563d5580c8a97c7cd31ee675

  • SSDEEP

    12288:kpyZT16rCxu/mDwLRI6BxcDqp9aqCcajVuD3Z7BPQGMWYur0s0D:kUx16jOD3SxcDDcNDqWYurL0

Malware Config

Targets

    • Target

      dcec19431e1904709d7c0c76477f6091_JaffaCakes118

    • Size

      651KB

    • MD5

      dcec19431e1904709d7c0c76477f6091

    • SHA1

      65156b02bc1665635822ac695f71ebd8f5ac4b8b

    • SHA256

      2015309f6c515a7769d249b1030a2b4e07637bb853e7fa1baab6916f9463cbbe

    • SHA512

      c22863d8f06fcea12bbdc33b463f97592b93445aa359681a6ed0908dbd30172ccdc0872f432de7735565941005a36670b2c11360563d5580c8a97c7cd31ee675

    • SSDEEP

      12288:kpyZT16rCxu/mDwLRI6BxcDqp9aqCcajVuD3Z7BPQGMWYur0s0D:kUx16jOD3SxcDDcNDqWYurL0

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Modifies visiblity of hidden/system files in Explorer

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Enumerates processes with tasklist

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks