Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

e14ff57209...18.exe

windows7-x64

10

e14ff57209...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e14ff5720919d978167f77802233e5e2_JaffaCakes118

  • Size

    126KB

  • Sample

    240915-afc85avdrg

  • MD5

    e14ff5720919d978167f77802233e5e2

  • SHA1

    bd5c3b127d0984d342bad7220297fbc7a7e4eab6

  • SHA256

    ad6f4877428647bc79ab0f84c9636e5d758d8200af7d635b1346d93ab82d7c41

  • SHA512

    db7da02a7e77e0e9a828f4ee1619f2ccd729d8ad8dfc72e55ea9abd1ab49702244f194495682ed93e259ff153ab0f76b3ec25e31bf22ae9598e4470c572db1fe

  • SSDEEP

    3072:r59NJVpMXqfEn20TTEE5TuP9XknZ9/GtedHB/l:rDHWFn7AENmmNdHD

Score
10/10
modiloaderdiscoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      e14ff5720919d978167f77802233e5e2_JaffaCakes118

    • Size

      126KB

    • MD5

      e14ff5720919d978167f77802233e5e2

    • SHA1

      bd5c3b127d0984d342bad7220297fbc7a7e4eab6

    • SHA256

      ad6f4877428647bc79ab0f84c9636e5d758d8200af7d635b1346d93ab82d7c41

    • SHA512

      db7da02a7e77e0e9a828f4ee1619f2ccd729d8ad8dfc72e55ea9abd1ab49702244f194495682ed93e259ff153ab0f76b3ec25e31bf22ae9598e4470c572db1fe

    • SSDEEP

      3072:r59NJVpMXqfEn20TTEE5TuP9XknZ9/GtedHB/l:rDHWFn7AENmmNdHD

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks