Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08/12/2024, 18:24 UTC

General

  • Target

    d159828b7d5098609af8d91fd41f5718_JaffaCakes118.dll

  • Size

    144KB

  • MD5

    d159828b7d5098609af8d91fd41f5718

  • SHA1

    a488ed4f2461b29d7c2d42721d3cdeb8b4e14bfe

  • SHA256

    bb8f340132c7101cf849c226a0e0aef193b03e320bd65f668e5a9f74b8231dbe

  • SHA512

    9672969b722260fb663fec065d6b955a68fbb1651299c982d17439a87a8b9140471ec09a7ba214a5a1e4de3ccafd155fd3910858c1a26f12d4d53a30a9451732

  • SSDEEP

    1536:z0q4Q6mueDbPEPiHCj/PKrOP8B0h2ZOO49TBWYQM:43zLZKr68B0kOOmQJM

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d159828b7d5098609af8d91fd41f5718_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\d159828b7d5098609af8d91fd41f5718_JaffaCakes118.dll
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2284

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2284-0-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.