Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
26/09/2024, 17:31
General
-
Target
f8dfc4cab04ca70fa77c5797b49e3a6d_JaffaCakes118.exe
-
Size
270KB
-
MD5
f8dfc4cab04ca70fa77c5797b49e3a6d
-
SHA1
d92d88b49ea6e4aecffdac3f8110c919813ff7d7
-
SHA256
7e4c1b869facf7fafb8f2602d9b84c67881699907a5817e31c2e64de75f444c7
-
SHA512
6e949b59bcafa8800e77ac4f51985e401793fd1ab51d30fee2506f9678e587fd7c2ca039a058d051292fa2f889e5b2e9410c0fba0a3c3238747fc0fcbd35a0a5
-
SSDEEP
6144:RG377xS2Vp2CeiorXdwTBgWx4v53YtpcCJJvHX:Er7xS2Vp6RwTyCJbJJvHX
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 14 IoCs
-
Loads dropped DLL 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8dfc4cab04ca70fa77c5797b49e3a6d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f8dfc4cab04ca70fa77c5797b49e3a6d_JaffaCakes118.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD59d089203515ed4308969c22a789f00ca
SHA1296fa49dbc109df31c5e2a58535d44733b6008cc
SHA256290479c34f9f309a02aa42e1befa74188db6988e271540d5d6c61ad57ee9613e
SHA512640f7a4728d5c62d4679ddf93a3b81c2f2079fd9b6d222cd87dfc53d42df861c4ea7623fae4bed33061995953f588053687210fbf7b513bcf71226a1260ad5dc
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
300KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
300KB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
4KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB