Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
ddc6aa11a15cb5dfc25d07ce2225fbf2_JaffaCakes118
-
Size
2.6MB
-
Sample
240913-gbdgnaxdqb
-
MD5
ddc6aa11a15cb5dfc25d07ce2225fbf2
-
SHA1
8346fb9cd28e05f317f5620d8e5b40908d9a8193
-
SHA256
4c2704ad45c7678da160bc411bd07cb4587116b3fd8566895d40d3e28191eba4
-
SHA512
cd815ebe9ef2a224bcf6de2a4bd0f8a7a666364ff090951c9c6abd60478f4cae90daec6c7f2cf97fc4b25e0997d95876d0eb456ce613978794573317ec4112b4
-
SSDEEP
49152:+TTGZUDj9XBXo+VbCIHfgDK1ksuEtTqYc4oH7RxDhdNl2:uTlX9XBYQ7gu1kNkqYc46/DhdNl2
Static task
static1
Behavioral task
behavioral1
Sample
ddc6aa11a15cb5dfc25d07ce2225fbf2_JaffaCakes118.exe
Resource
win7-20240903-en
Malware Config
Targets
-
-
Target
ddc6aa11a15cb5dfc25d07ce2225fbf2_JaffaCakes118
-
Size
2.6MB
-
MD5
ddc6aa11a15cb5dfc25d07ce2225fbf2
-
SHA1
8346fb9cd28e05f317f5620d8e5b40908d9a8193
-
SHA256
4c2704ad45c7678da160bc411bd07cb4587116b3fd8566895d40d3e28191eba4
-
SHA512
cd815ebe9ef2a224bcf6de2a4bd0f8a7a666364ff090951c9c6abd60478f4cae90daec6c7f2cf97fc4b25e0997d95876d0eb456ce613978794573317ec4112b4
-
SSDEEP
49152:+TTGZUDj9XBXo+VbCIHfgDK1ksuEtTqYc4oH7RxDhdNl2:uTlX9XBYQ7gu1kNkqYc46/DhdNl2
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-