Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    de3be88fbf9e81e7661991e634777833_JaffaCakes118

  • Size

    270KB

  • Sample

    240913-m61hkayhrf

  • MD5

    de3be88fbf9e81e7661991e634777833

  • SHA1

    c10be4a21755615349a855d61f555037dfb5bafc

  • SHA256

    232431778830d33b78ec37143775cdbb39b180cfb7496476925a4c882da2b38a

  • SHA512

    0067c1642b8e7025c86489352adf5930023b8813032e75e1377b5aebe7dbdb7ba786b973a6d0608da7989eef76569baee944373bd8783150f7dd760024838834

  • SSDEEP

    6144:BG377xS2Vp2CeiorXdwTBgWx4v53mSpcCJJvHB:Ur7xS2Vp6RwTyCKbJJvHB

Malware Config

Targets

    • Target

      de3be88fbf9e81e7661991e634777833_JaffaCakes118

    • Size

      270KB

    • MD5

      de3be88fbf9e81e7661991e634777833

    • SHA1

      c10be4a21755615349a855d61f555037dfb5bafc

    • SHA256

      232431778830d33b78ec37143775cdbb39b180cfb7496476925a4c882da2b38a

    • SHA512

      0067c1642b8e7025c86489352adf5930023b8813032e75e1377b5aebe7dbdb7ba786b973a6d0608da7989eef76569baee944373bd8783150f7dd760024838834

    • SSDEEP

      6144:BG377xS2Vp2CeiorXdwTBgWx4v53mSpcCJJvHB:Ur7xS2Vp6RwTyCKbJJvHB

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • UAC bypass

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks