Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/12/2024, 12:06
Behavioral task
behavioral1
Sample
d25dd2ebc039d139aff5cd50150fb883_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d25dd2ebc039d139aff5cd50150fb883_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
d25dd2ebc039d139aff5cd50150fb883_JaffaCakes118.exe
-
Size
16KB
-
MD5
d25dd2ebc039d139aff5cd50150fb883
-
SHA1
668abae6f35071b8b52a265c4f1468f5a159be0f
-
SHA256
8ac81eab90aaf9d25b646bd5e67ffaeb5eae897243fbde6a8331e40a9bc8281c
-
SHA512
19d67adfeef51036826d52fe8500be6f6e747816503baff9d2d4ea966cab0313e56544ee4f4f2d0af6fa0b7b398a7e2c752de53db2aa534f97c31265cc0e59bf
-
SSDEEP
192:nvknyMu95OOYiyMpt/Mt/8CRk9dFRM2qk5WvGBIP73FPJ/bvbQjcW:Yez2iyiVy8Cm9q2qkQvGBIPBPJ3Az
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral2/memory/4952-0-0x0000000010000000-0x000000001000C000-memory.dmp modiloader_stage2 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d25dd2ebc039d139aff5cd50150fb883_JaffaCakes118.exe