Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
54100680913b7218b26d54d332b01934_JaffaCakes118
-
Size
1.9MB
-
Sample
241017-2f3mkatdlr
-
MD5
54100680913b7218b26d54d332b01934
-
SHA1
83caa1e6c28bdfa4f774e2dffb046d7471ec8ace
-
SHA256
e8cb0ce834288db7ff7bedb91cb133373f7af9cadfee9a0aeab0f241a843b34f
-
SHA512
6ad7a47eb1f074a567a85868d1b4ceb33b2c83eebc89d4df96451ae5ccc46d2bb0f122b1b77b0d962c86e0665024d92ba4de0c164df973bcdd9782b88abdfe1b
-
SSDEEP
49152:V09FxNqP3VbWXcZyb9IZ6PMhHh2WG5cI3K6VQQ5:SdqIsZyb9fP2HUWDP1Q5
Static task
static1
Behavioral task
behavioral1
Sample
54100680913b7218b26d54d332b01934_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
54100680913b7218b26d54d332b01934_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
54100680913b7218b26d54d332b01934_JaffaCakes118
-
Size
1.9MB
-
MD5
54100680913b7218b26d54d332b01934
-
SHA1
83caa1e6c28bdfa4f774e2dffb046d7471ec8ace
-
SHA256
e8cb0ce834288db7ff7bedb91cb133373f7af9cadfee9a0aeab0f241a843b34f
-
SHA512
6ad7a47eb1f074a567a85868d1b4ceb33b2c83eebc89d4df96451ae5ccc46d2bb0f122b1b77b0d962c86e0665024d92ba4de0c164df973bcdd9782b88abdfe1b
-
SSDEEP
49152:V09FxNqP3VbWXcZyb9IZ6PMhHh2WG5cI3K6VQQ5:SdqIsZyb9fP2HUWDP1Q5
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3