Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

e09d277969...18.exe

windows7-x64

10

e09d277969...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e09d277969e196819d46e0fe06b0b047_JaffaCakes118

  • Size

    136KB

  • Sample

    241211-ka84qayrhn

  • MD5

    e09d277969e196819d46e0fe06b0b047

  • SHA1

    43ad3c63d64ae2bb3b4ce111fb492e59dbb5f5f8

  • SHA256

    dd5f09df7d0f4521bdabdf543386f616fbdfe2be8a480bf315103c431d72c355

  • SHA512

    40d6bf2a4cc8807bfd429cbf5bbc381b04636adf30be6ee8ee3b73d13c9734e31f4335fec3c35db9d5067d1ef4d86d21d76416badd8389833cfa9a66a9fb9c39

  • SSDEEP

    1536:/gpHVuNAXTj4Fj/91/NnLZqeWEPVpa8DzePjkgcwYS7S5+Vfk09+2GvwxEnouy8:01oy8j7VnNdrPHaSekwi+mW+2GU0out

Score
10/10
modiloaderdiscoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      e09d277969e196819d46e0fe06b0b047_JaffaCakes118

    • Size

      136KB

    • MD5

      e09d277969e196819d46e0fe06b0b047

    • SHA1

      43ad3c63d64ae2bb3b4ce111fb492e59dbb5f5f8

    • SHA256

      dd5f09df7d0f4521bdabdf543386f616fbdfe2be8a480bf315103c431d72c355

    • SHA512

      40d6bf2a4cc8807bfd429cbf5bbc381b04636adf30be6ee8ee3b73d13c9734e31f4335fec3c35db9d5067d1ef4d86d21d76416badd8389833cfa9a66a9fb9c39

    • SSDEEP

      1536:/gpHVuNAXTj4Fj/91/NnLZqeWEPVpa8DzePjkgcwYS7S5+Vfk09+2GvwxEnouy8:01oy8j7VnNdrPHaSekwi+mW+2GU0out

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks