Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
de3be88fbf9e81e7661991e634777833_JaffaCakes118
-
Size
270KB
-
Sample
240913-m61hkayhrf
-
MD5
de3be88fbf9e81e7661991e634777833
-
SHA1
c10be4a21755615349a855d61f555037dfb5bafc
-
SHA256
232431778830d33b78ec37143775cdbb39b180cfb7496476925a4c882da2b38a
-
SHA512
0067c1642b8e7025c86489352adf5930023b8813032e75e1377b5aebe7dbdb7ba786b973a6d0608da7989eef76569baee944373bd8783150f7dd760024838834
-
SSDEEP
6144:BG377xS2Vp2CeiorXdwTBgWx4v53mSpcCJJvHB:Ur7xS2Vp6RwTyCKbJJvHB
Behavioral task
behavioral1
Sample
de3be88fbf9e81e7661991e634777833_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
de3be88fbf9e81e7661991e634777833_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
de3be88fbf9e81e7661991e634777833_JaffaCakes118
-
Size
270KB
-
MD5
de3be88fbf9e81e7661991e634777833
-
SHA1
c10be4a21755615349a855d61f555037dfb5bafc
-
SHA256
232431778830d33b78ec37143775cdbb39b180cfb7496476925a4c882da2b38a
-
SHA512
0067c1642b8e7025c86489352adf5930023b8813032e75e1377b5aebe7dbdb7ba786b973a6d0608da7989eef76569baee944373bd8783150f7dd760024838834
-
SSDEEP
6144:BG377xS2Vp2CeiorXdwTBgWx4v53mSpcCJJvHB:Ur7xS2Vp6RwTyCKbJJvHB
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3