Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
28/09/2024, 00:33
General
-
Target
fb2dc300c0ae48fc9d9257ceb2afee2d_JaffaCakes118.exe
-
Size
623KB
-
MD5
fb2dc300c0ae48fc9d9257ceb2afee2d
-
SHA1
2e0effe96b77e258b3e330f8aa5f4caa118a2d1c
-
SHA256
a2ab4f8dde179c0c38443ef8c16dce1461127576959b4394fac1734d1bf624a4
-
SHA512
a5718f88f6fe78292735a6376635489c7966868f0f242699c5d26be10b153c8ddfc3c8961eca7165d7bc6af662a3aafaa62b0be9000f4ae89d41e902e419b96d
-
SSDEEP
12288:osf+bQz5EQg/EWkTxF3Z4mxxdnnkdVUcgVcXHit3h:7fquUEFVQmXwUcgVcXHq3h
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb2dc300c0ae48fc9d9257ceb2afee2d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fb2dc300c0ae48fc9d9257ceb2afee2d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RECYCLER.EXEC:\Windows\system32\RECYCLER.EXE2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\system32\Delgoto.bat2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD5315d8aaeb3fdad180ee5808287d16348
SHA101fccf19c905992cb3b2e98a0ff09c370827d45a
SHA256ec4ee91712afc76b6bab9bcf83339690bc9e860f5d3605461ffd2fc7df59e78d
SHA512b6a37764a7df990814abbbfcab2984ae83d0ca6b64a39bc39fa6cbfb1e15424417a0992bb3598767507b4f78dff029db46e7ee2eb461feb83e545a95e12abe6b
-
Filesize
623KB
MD5fb2dc300c0ae48fc9d9257ceb2afee2d
SHA12e0effe96b77e258b3e330f8aa5f4caa118a2d1c
SHA256a2ab4f8dde179c0c38443ef8c16dce1461127576959b4394fac1734d1bf624a4
SHA512a5718f88f6fe78292735a6376635489c7966868f0f242699c5d26be10b153c8ddfc3c8961eca7165d7bc6af662a3aafaa62b0be9000f4ae89d41e902e419b96d
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
336KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
1.2MB