Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    14203ba0786afb5432983edd7bfb2397_JaffaCakes118

  • Size

    651KB

  • Sample

    241004-t4g2rsvckj

  • MD5

    14203ba0786afb5432983edd7bfb2397

  • SHA1

    466553a2300ef0a81cc7fe1fa1699bacca9a5c65

  • SHA256

    74daed329122ccfc9d9be54539075f911920a8cbfb600d35e98a953a692efa61

  • SHA512

    26c3c582c64d9909a19b08003ac0fa4db0b7f73ae7222f70676375eea3871a7d9a4e50e53a836822cae41135065b461d494fc1a3e504621a2862c5be5aabfdda

  • SSDEEP

    12288:kpyZT1trCxu/mDwLRI6BxcDqp9aqCcajVuD3Z7BPQGMWYur0s0D:kUx1tjOD3SxcDDcNDqWYurL0

Malware Config

Targets

    • Target

      14203ba0786afb5432983edd7bfb2397_JaffaCakes118

    • Size

      651KB

    • MD5

      14203ba0786afb5432983edd7bfb2397

    • SHA1

      466553a2300ef0a81cc7fe1fa1699bacca9a5c65

    • SHA256

      74daed329122ccfc9d9be54539075f911920a8cbfb600d35e98a953a692efa61

    • SHA512

      26c3c582c64d9909a19b08003ac0fa4db0b7f73ae7222f70676375eea3871a7d9a4e50e53a836822cae41135065b461d494fc1a3e504621a2862c5be5aabfdda

    • SSDEEP

      12288:kpyZT1trCxu/mDwLRI6BxcDqp9aqCcajVuD3Z7BPQGMWYur0s0D:kUx1tjOD3SxcDDcNDqWYurL0

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Modifies visiblity of hidden/system files in Explorer

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Enumerates processes with tasklist

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks