Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
14203ba0786afb5432983edd7bfb2397_JaffaCakes118
-
Size
651KB
-
Sample
241004-t4g2rsvckj
-
MD5
14203ba0786afb5432983edd7bfb2397
-
SHA1
466553a2300ef0a81cc7fe1fa1699bacca9a5c65
-
SHA256
74daed329122ccfc9d9be54539075f911920a8cbfb600d35e98a953a692efa61
-
SHA512
26c3c582c64d9909a19b08003ac0fa4db0b7f73ae7222f70676375eea3871a7d9a4e50e53a836822cae41135065b461d494fc1a3e504621a2862c5be5aabfdda
-
SSDEEP
12288:kpyZT1trCxu/mDwLRI6BxcDqp9aqCcajVuD3Z7BPQGMWYur0s0D:kUx1tjOD3SxcDDcNDqWYurL0
Behavioral task
behavioral1
Sample
14203ba0786afb5432983edd7bfb2397_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
14203ba0786afb5432983edd7bfb2397_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
14203ba0786afb5432983edd7bfb2397_JaffaCakes118
-
Size
651KB
-
MD5
14203ba0786afb5432983edd7bfb2397
-
SHA1
466553a2300ef0a81cc7fe1fa1699bacca9a5c65
-
SHA256
74daed329122ccfc9d9be54539075f911920a8cbfb600d35e98a953a692efa61
-
SHA512
26c3c582c64d9909a19b08003ac0fa4db0b7f73ae7222f70676375eea3871a7d9a4e50e53a836822cae41135065b461d494fc1a3e504621a2862c5be5aabfdda
-
SSDEEP
12288:kpyZT1trCxu/mDwLRI6BxcDqp9aqCcajVuD3Z7BPQGMWYur0s0D:kUx1tjOD3SxcDDcNDqWYurL0
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies visiblity of hidden/system files in Explorer
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Enumerates processes with tasklist
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2