Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25/09/2024, 16:40
General
-
Target
f66d9b0a3a3b431cba3c9921e5f802f7_JaffaCakes118.exe
-
Size
2.6MB
-
MD5
f66d9b0a3a3b431cba3c9921e5f802f7
-
SHA1
1438f2c2f6fbe3810e3e4c31dcb59adc8097d505
-
SHA256
17a3aa16f489f9fd8ac11b96972eb8acd4763680548ca8b2d3a835bb52815671
-
SHA512
7fefebbb5b08f71f7d11ca8e83cc22cb01cda7954073a5eab663f443eac14d055bb22978a0845d1ced2ebfc21bc55448381682b470638cb5a06581d870555a78
-
SSDEEP
49152:GTZ6cvho0oLyjvVRQfRyMy9A0GBXMwc//////MDw8cbk67J3ZdTxvDQ4+c/////I:GTZ6aoLybVCfRTMwc//////qw8cbk676
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f66d9b0a3a3b431cba3c9921e5f802f7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f66d9b0a3a3b431cba3c9921e5f802f7_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
489B
MD54a874ea3b2b8fe5f7da19844c2cbf013
SHA19a45708222684b505c6fd99c6b1ec345dda54746
SHA256014a9aa3970469f4df8506cb16b64e3a42eb093295880121d88bd28b9017d64e
SHA512d416177d78967a0c6cdc26e50e8d19ec08ab7c6b6d1b70668bfd9ee0989ac530bc3ebbbbcbb3249fa0df07900d1fafe1e1fbee656e53c991a83a36dd87fa33d9
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.7MB
-
Filesize
4KB
-
Filesize
4KB